Protect a Sample File with an Agent

Preview. This flow is verified end to end on Cloak's infrastructure; the @cloakapps/cloak-encrypt-mcp npm package is in the final stage of publishing. Until it is on the public registry, step 2 requires access from Cloak — ask us for preview access. For a fully self-serve start today, use the KMS developer quickstart.

Developer-adopted

One npm config block

Agent-operated

The agent encrypts the file

Human-governed

You open it in the browser

Receipted

Signed record, verified

Before you start

✓ An MCP-capable agent host installed — Claude Desktop, Cursor, or Claude Code.
✓ Node.js 18.17 or newer.
✓ Nothing else. No prior Cloak account — you create one in step 1.

This quickstart uses software keys — the sandbox path. Files are encrypted on your machine; no HSM, no agent credential needed. The higher-assurance paths are linked at the end.

1

Create your account in the web app ~3 min

Sign up at the Cloak Files web app (free tier). Why the web app and not the terminal: signup provisions your cloak certificate — the identity your agent will encrypt files to. The MCP server deliberately never provisions identity; humans do.

Success check: you can log in and see the (empty) file view.

2

Connect the MCP server to your agent ~3 min

Add the Cloak Files MCP server to your agent host config and restart the host:

{
  "mcpServers": {
    "cloakFiles": {
      "command": "npx",
      "args": ["-y", "@cloakapps/cloak-encrypt-mcp"]
    }
  }
}

Then cache your session in a terminal (prompts for your password without echoing it):

npx -y @cloakapps/cloak-encrypt-mcp login --user you@example.com

Success check: your agent host lists four tools — encrypt_file, decrypt_file, cloak_file, uncloak_file.

If something breaks: re-running login is always safe — it refreshes both your session and your cached certificate on every run.

3

Ask the agent to protect a file ~2 min

Save something as sample-contract.txt, then paste into your agent:

Protect sample-contract.txt with Cloak for you@example.com

Success check: sample-contract.txt.clk appears next to the source file, and the tool response includes a signed receipt (JWS). Copy the receipt — you verify it in step 5.

Notice what didn't happen: the plaintext never left your machine. The MCP server runs locally; only the encrypted .clk is shareable.

4

Open the protected file as the human ~3 min

Switch to the web app, open the .clk file, and see the decrypted content. This is the governed half of the workflow: the same file, human access, no agent, no terminal. Recipients you addressed in step 3 can do the same from their own accounts; people without an account get an invite.

Success check: the original contents render in the browser.

5

Verify the receipt ~2 min

Paste the receipt from step 3 into the verify page. It proves the operation, actor, file reference, and timestamp were recorded and signed by the Cloak platform key — verifiable by anyone, offline, without calling Cloak.

Honest scope: in software-key mode the client asserts the operation and Cloak signs that assertion — the receipt proves the record, not the encryption itself. HSM-backed modes add server-witnessed key operations linked into the receipt.

Success check: a green “valid” result.

Protect a sample file with an agent