# LinkPilot [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/TetraCoreHQ/linkpilot-mcp  
**GitHub Stars:** 1  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/linkpilot

## Description
Send a password or API key as a link that opens once. Encrypted client-side, so we cannot read it.

## Tools
Capabilities this server exposes over MCP:

- **create_secret_link** — Encrypt text locally and return a one-time URL
- **create_short_link** — Shorten a URL, with click tracking
- **list_links** — List short links and their click counts
- **list_secrets** — Secret **metadata** only: status, views, expiry
- **revoke_secret** — Destroy a secret link immediately
- **whoami** — Plan, limits, usage and remaining rate budget

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "linkpilot": {
    "command": "npx",
    "args": ["-y","@uselinkpilot/mcp"],
    "env": {
      "LINKPILOT_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `LINKPILOT_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What the LinkPilot MCP server does

The LinkPilot MCP server gives an MCP-compatible assistant tools for sharing credentials and managing links through the LinkPilot service. Its primary operation, `create_secret_link`, encrypts supplied text locally and returns a URL intended for one use. After the recipient opens it, the secret is destroyed when burn-after-read behavior is enabled, which is the default.

The server also handles ordinary URL shortening. `create_short_link` creates a shortened URL with click tracking, while `list_links` reports existing short links and their click counts. Secret management is intentionally limited: `list_secrets` returns metadata such as status, view count, and expiry, but never returns secret contents. `revoke_secret` immediately invalidates a secret link, and `whoami` reports the account plan, limits, usage, and remaining rate budget.

## How the LinkPilot MCP server works

Encryption occurs inside the MCP server process through the LinkPilot SDK before data is sent to the API. The documented scheme is AES-GCM-256, with a locally generated key. That key is placed in the URL fragment, which browsers do not send in HTTP requests. The service therefore stores encrypted data without receiving the key needed to decrypt it.

The assistant still sees the plaintext because it must provide the value to `create_secret_link`. This tool does not protect a secret from the model or from the context in which the model operates. It is intended for credentials the assistant is already handling, such as a generated password or a value deliberately supplied by the user.

There is no recovery path if the share URL is lost. Optional expiry values include `30m`, `2h`, `7d`, or a number of seconds. Pro plans can add a passphrase; it contributes to the key, while only a SHA-256 hash is sent for server-side checking. The passphrase should be delivered separately from the link.

## Setup and configuration

Create an API key in the LinkPilot account dashboard. API keys begin with `lp_live_`, and API access is available on every plan, including Free. Configure the server with the `LINKPILOT_API_KEY` environment variable:

```json
{
  "mcpServers": {
    "linkpilot": {
      "command": "npx",
      "args": ["-y", "@uselinkpilot/mcp"],
      "env": { "LINKPILOT_API_KEY": "lp_live_your_key" }
    }
  }
}
```

Claude Code can register the same command with `claude mcp add`. The key is read from the environment, is not written to disk by the server, and is not echoed in logs or errors.

## Tools and capabilities

The LinkPilot MCP server exposes these tools:

- `create_secret_link`: Encrypt text locally and return a one-time URL.
- `create_short_link`: Shorten a URL and enable click tracking.
- `list_links`: Show short links and their click counts.
- `list_secrets`: Show secret-link metadata without contents.
- `revoke_secret`: Destroy a secret link immediately.
- `whoami`: Show plan, limits, usage, and remaining rate budget.

`revoke_secret` is marked destructive so compatible clients may request confirmation. Read-only tools are annotated accordingly. The service API rejects plaintext secret payloads, and no API route returns a secret payload or decryption key.

## Limitations and notes

Do not use this server when the assistant must never see the secret; create such links directly through the LinkPilot website or CLI instead. A lost URL means the encrypted secret cannot be recovered. A passphrase only adds protection when it is sent through a different channel. The server uses the standard MCP command shown above and requires a valid API key.

_Full upstream README: https://allmcps.com/mcp/linkpilot/readme_