The technical architecture is interesting because it avoids a database entirely, relying on RAM-only storage. This means once the data is read or the timer hits zero, it is physically gone. For those of us implementing an AI workflow in the office, the inclusion of an MCP server and a REST API is the real draw. It allows an LLM agent to create a "dead-drop" style link. The agent can generate a secret, send the link to a human, and the moment that human claims the data, the link returns a 404. It prevents the same credential from being leaked or reused across multiple sessions.
If you are setting this up as a practical tutorial for your team, here is the basic logic of how the two different flows work:
Web Flow (Zero-Knowledge) #
-
The browser encrypts the data locally.
-
The encryption key is appended after the
#
in the URL.3. Since fragments (everything after the #) aren't sent to the server, the server only stores the encrypted blob in RAM.
- The recipient's browser uses the key in the URL to decrypt the content.
Agent/API Flow (Server-Side) #
-
The AI agent sends plaintext to the REST API.
-
The server encrypts the data before storing it in RAM.
-
A unique link is generated and returned to the agent.
-
The first person to click the link retrieves the secret; subsequent attempts fail.
One thing to keep in mind for a real-world deployment: the API flow is not zero-knowledge because the server briefly handles the plaintext. If you are dealing with ultra-high-security keys, the web interface is the safer bet. For standard team coordination or passing temporary API tokens between agents and humans, the API flow is more than sufficient.
Since it is open source under the MIT license, we can actually self-host this via Docker to keep everything within our own infrastructure. This removes the anxiety of using a third-party service for company secrets.
For anyone wanting to dig into the source or deploy it themselves, the specific repository is available here:
https://github.com/mmmpym/flashpaper
It's a lightweight alternative to Bitwarden's send feature or Privnote, especially for those of us who prefer tools that don't bloat our tech stack with unnecessary database dependencies.
Next Dozenal: Building a Puzzle Game with AI Assistants →