hush. from an agent

Two MCP tools. The encryption happens on your machine, so an agent using hush gets the same guarantee a browser does.

Tool	What it does
hush_create	Encrypts a secret locally, stores the ciphertext, returns a link that works exactly once
hush_reveal	Opens a link and destroys it

It is a local binary rather than an endpoint on this server for one reason: if the server did the encrypting, the server could read every secret an agent created, and hush's claim would hold for browser users while quietly not holding for you. hush-mcp is a peer of the browser — it mints the AES-256 key, encrypts, posts only ciphertext, and assembles the #fragment link itself.

1. Install it

go install github.com/orchard9/hush/cmd/hush-mcp@latest

Needs Go 1.26 or newer, and nothing else: the binary imports only the standard library, so there is no dependency to resolve and no service to run.

Most clients do not expand ~, so get the absolute path once and paste that everywhere below:

echo "$(go env GOPATH)/bin/hush-mcp"

2. Register it with your client

Every client here launches the same binary over stdio. The JSON shape is the portable part; only VS Code spells the wrapper key differently.

Claude Code

claude mcp add hush -e HUSH_BASE_URL=https://hush.threesix.ai \
  -- /Users/you/go/bin/hush-mcp

The -- is load-bearing: everything after it is the command to launch, so Claude Code stops reading those arguments as its own. Add -s user to get the server in every project rather than this one. claude mcp list then prints hush: … ✔ Connected.

Codex CLI

codex mcp add hush --env HUSH_BASE_URL=https://hush.threesix.ai \
  -- /Users/you/go/bin/hush-mcp

That writes ~/.codex/config.toml. The same thing by hand:

[mcp_servers.hush]
command = "/Users/you/go/bin/hush-mcp"
env = { "HUSH_BASE_URL" = "https://hush.threesix.ai" }

Confirm with codex mcp get hush, or /mcp in a session.

Gemini CLI

gemini mcp add hush /Users/you/go/bin/hush-mcp \
  -e HUSH_BASE_URL=https://hush.threesix.ai -s user

Without -s user the entry lands in the current project's .gemini/settings.json instead of ~/.gemini/settings.json. Confirm with /mcp in a session.

VS Code

code --add-mcp '{"name":"hush","type":"stdio","command":"/Users/you/go/bin/hush-mcp","env":{"HUSH_BASE_URL":"https://hush.threesix.ai"}}'

By hand the file is .vscode/mcp.json for one workspace, or the user-level mcp.json that MCP: Open User Configuration opens — and its wrapper key is servers, not mcpServers:

{
  "servers": {
    "hush": {
      "type": "stdio",
      "command": "/Users/you/go/bin/hush-mcp",
      "env": { "HUSH_BASE_URL": "https://hush.threesix.ai" }
    }
  }
}

Claude Desktop, Cursor, omp, anything else

One block, in that client's config file:

{
  "mcpServers": {
    "hush": {
      "type": "stdio",
      "command": "/Users/you/go/bin/hush-mcp",
      "env": { "HUSH_BASE_URL": "https://hush.threesix.ai" }
    }
  }
}

Client	File
Claude Desktop	macOS `~/Library/Application Support/Claude/claude_desktop_config.json`, Windows `%APPDATA%\Claude\claude_desktop_config.json` — then quit the app completely and reopen it
Cursor	`~/.cursor/mcp.json` for every project, `.cursor/mcp.json` for one
omp	`~/.omp/agent/mcp.json`

From a clone of the repo, make mcp does the omp case for you: it builds the binary, proves the handshake before wiring anything, then rewrites only hush's entry — backing the file up and leaving every other server alone.

3. Prove it before you trust it

A misconfigured stdio server reaches you as an opaque “server disconnected”. Run the handshake yourself instead, where the error is legible:

printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{}}}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
  | /Users/you/go/bin/hush-mcp

Two JSON lines come back: the first names the server hush, the second lists hush_create and hush_reveal. That is the same binary, launched the same way, that your client will run.

4. Use it

Ask in words; the agent picks the tool.

“Put this in a hush link so I can send it: <the credential>”
“Open this hush link: https://hush.threesix.ai/s/…#…”

Three behaviours worth knowing before an agent calls either tool:

hush_reveal destroys the link. After it returns, the intended recipient cannot open it. An agent that reveals a link “just to check” has burned it.
The link is shown once. hush cannot rebuild it, because the key it carries was never sent to the server.
The #fragment is the key. Chat clients and mail rewriters truncate fragments, and a link without one carries no key. The tool says exactly that, without touching the secret.

Configuration

Variable	Meaning
HUSH_BASE_URL	Which deployment `hush_create` posts to. Defaults to `https://hush.threesix.ai`
HUSH_CREATE_TOKEN	Only for a deployment that has closed anonymous create. Unset is the normal case

hush_reveal ignores both and reveals against the link's own origin. A link minted by another hush deployment would be meaningless here, and reporting it gone would be a lie about a secret nobody had touched.

When a client will not connect

Use the absolute path: most clients do not expand ~.
Restart the client. Claude Desktop needs a full quit, not a window close.
Check the wrapper key — servers in VS Code, mcpServers everywhere else.
Ask the client: claude mcp list, codex mcp get hush, or /mcp in a session. VS Code logs to Output → MCP, Claude Desktop to ~/Library/Logs/Claude/mcp*.log.
A gone error is not a connection fault: that link was already opened, expired, or never existed. If you did not open it, assume someone else did and rotate the secret.

Source: github.com/orchard9/hush.

Encrypted in your browser. The key travels in the link's #fragment, which browsers never send to a server. · create a secret