What is Slidingbox Hydrate/Dehydrate?

Encrypted one-time secret handoff, x402 pre-flight, and web page change checks and watches.

How do I install Slidingbox Hydrate/Dehydrate?

Install Slidingbox Hydrate/Dehydrate via npm from https://registry.npmjs.org, then add the server config to your MCP client (Claude Desktop, Cursor, or VS Code).

Is Slidingbox Hydrate/Dehydrate open source?

Yes, Slidingbox Hydrate/Dehydrate is open source under the ISC license. Source code is available at https://github.com/slidingbox/hydrate-dehydrate-mcp.

What category does Slidingbox Hydrate/Dehydrate belong to?

Slidingbox Hydrate/Dehydrate is listed under Other MCP servers on MCPFind.

Slidingbox Hydrate/Dehydrate — MCP Server for Other

@slidingbox/hydrate-dehydrate-mcp

An MCP server for handing a secret from one agent, machine, or person to another without leaving a copy behind.

store_secret encrypts on your machine and returns one token. Whoever holds the token gets the secret exactly once — the first successful read delivers it and destroys it, and a second read returns nothing. Slidingbox stores only ciphertext: the key travels in the token and is never sent to the server.

store_secret("sk-live-...")  ->  sb_PApm-Ui...#0zgYgq2d...
                                 ^ pointer, on the server   ^ key, never sent

retrieve_secret("sb_PApm-Ui...#0zgYgq2d...")  ->  sk-live-...   (and it's gone)

Install

{
  "mcpServers": {
    "hydrate-dehydrate": {
      "command": "npx",
      "args": ["-y", "@slidingbox/hydrate-dehydrate-mcp"],
      "env": { "SLIDINGBOX_API_KEY": "sbk_..." }
    }
  }
}

That block goes in your MCP client's config — claude_desktop_config.json for Claude Desktop, or claude mcp add for Claude Code.

Paying for reads

Storing is free. Reading costs $0.02, and there are two ways to cover it:

Variable	What it does
`SLIDINGBOX_API_KEY`	An evaluation key (`sbk_<id>.<hmac>`). Covers a fixed number of reads for free. Get one instantly: `curl -X POST https://slidingbox.ai/v1/key` — no account, no email.
`SLIDINGBOX_PRIVATE_KEY`	A Base wallet holding USDC. Reads are paid per call over x402 — no account, no invoice, no subscription.
`SLIDINGBOX_URL`	Defaults to `https://slidingbox.ai`.
`SLIDINGBOX_NETWORK`	Defaults to `eip155:8453` (Base mainnet).

With neither set, store_secret still works and retrieve_secret tells you which one to configure. SLIDINGBOX_PRIVATE_KEY signs payments: give it a wallet funded for this purpose and nothing else.

What it is good for

Passing a credential between two agents that share no store and no account.
Sending a secret through a channel you would rather it not persist in — the token in the chat log is inert the moment it is read.
Proving a handoff happened once. A replayed token fails visibly instead of quietly serving a second copy.

What it is not

Not storage, backup, messaging, or key management. Secrets live 60–900 seconds and then expire. Not for protected health information or payment-card data.

How it works

Encryption is AES-256-GCM, done in this process before anything is sent. The server receives {ciphertext, iv} and a time-to-live, and returns an opaque pointer. That is the whole reason this is a local stdio server rather than a route on the API: a remote MCP server would have to receive your plaintext in order to encrypt it.

Payment, when a wallet is configured, is x402 — the read returns 402, the client signs an EIP-3009 authorization for $0.02 USDC, and retries. Paying wallets are screened against the OFAC SDN list before settlement; see https://slidingbox.ai/compliance.

API: https://slidingbox.ai/developers
Agent-readable: https://slidingbox.ai/llms.txt, https://slidingbox.ai/.well-known/slidingbox.json

Development

npm install
npm test        # offline: crypto round-trip and token parsing
node server.mjs # speaks MCP over stdio

If this stops working

Slidingbox is a small product and may be retired. This server is built to say so rather than fail opaquely: a retired service answers 410, and a domain that no longer resolves is reported as a retirement, not as a stack trace. Nothing you store is ever held longer than 900 seconds, so a shutdown cannot strand data.

Set up in your AI client

AI clientOperating system

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json

{
  "mcpServers": {
    "ai-slidingbox-hydrate-dehydrate": {
      "command": "npx",
      "args": [
        "-y",
        "@slidingbox/hydrate-dehydrate-mcp"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Compatible MCP Clients

Slidingbox Hydrate/Dehydrate works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.

Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.

VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.

Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.

Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

Slidingbox Hydrate/Dehydrate