Core concepts
Security model
What the Pastepile MCP server can and cannot touch: local execution, zero-knowledge encryption boundaries, and why protected pastes can never leak into a model context.
1 min read · Updated
The security model has one guiding rule: the server can never read what Pastepile itself cannot read.
Trust boundaries
- The server runs on your machine, launched by your MCP client. It talks to exactly one host:
https://pastepile.com(or the deployment you set viaPASTEPILE_API). - The API key is read from the environment, sent as an
X-API-Keyheader, and never logged, echoed back to the model, or persisted. - Tool failures return as model-visible error text, never crashes, and the server writes nothing to disk.
- The package has zero dependencies, so its supply-chain surface is the package itself, which ships as readable, unbuilt source.
Zero-knowledge content stays zero-knowledge
Pastepile's end-to-end encrypted pastes keep the decryption key in the URL fragment, which browsers never send to the server. The API cannot decrypt them, therefore the MCP server cannot either. The same boundary protects other guarded content:
| Paste type | What `pastepile_get` returns |
|---|---|
| End-to-end encrypted | A refusal naming the reason (encrypted); content never reaches the model |
| Password-protected | A refusal (password_protected); the API has no password path for automated clients |
| Burn-after-read | A refusal (burn_after_read); automated reads must not destroy one-time secrets |
| Sealed time capsule | A refusal (sealed) until the unlock time passes |
This is enforced server-side, not by the MCP wrapper: no alternative client, prompt injection, or bug in this package can bypass it.
Handling secrets
- Never ask an assistant to save credentials as a plain paste. Pastes are readable by anyone holding the URL.
- For secret material, use the web app's encrypted pastes: they are deliberately unreadable through this API.
- The paste viewer's Content Intelligence flags private keys and credentials on sight, but the honest advice is simpler: keep secrets out of plaintext pastes entirely.
Related documentation
How Pastepile MCP worksArchitecture of the Pastepile MCP server: a stateless, zero-dependency stdio process that maps four tools onto the public REST API.AuthenticationThe Pastepile MCP server works anonymously, and an API key turns it into a private memory layer with per-key isolation and higher limits.