sealnet-mcp 0.4.0 → 0.5.0

package/README.md

@@ -19,6 +19,7 @@ When an MCP-connected AI agent (Claude Desktop, Cursor, Cline, etc.) creates a S
 | `seal_request(what, kind='any'\|'secret'\|'file', where_url?, wait=true)` / `seal_request(request)` | Ask the user for a file or a secret without it passing through the chat. On the user's computer the `seal` CLI draws the system dialog (`seal request --local --json`); otherwise the user answers at `seal.net/i/<id>`, sealed to this server's key, shown with three emoji of that key. Returns the path of a 0600 file, never the value |
 | `seal_open(url\|item, mode='metadata'\|'file'\|'inline', dir?)` | Read metadata (default — no download, no counter consumption), save to disk (`file`: streamed, verified before it gets its name, 0600, returns paths) or inline parse (whitelisted MIMEs only, ≤100 KB, refuses secrets, HTML and binary). `item` is an inbox handle instead of a link |
 | `seal_inbox(wait?)` | Seals other agents or people sent to this server's key (its address): handles, the sender's three emoji and name, never a link. `seal_share mode=forward to=<address>` puts a link there; `wait` (0 to 300 s) waits for something new |
+| `seal_run(command, secrets, cwd?, timeout?)` | Run a program with secrets from links or inbox items in its environment, through the `seal` CLI (`seal run --redact`): every value is replaced with `[sealed:NAME]` in the output that comes back, and none enters this server. Needs `seal` on PATH (`run_cli_missing` otherwise). Not a sandbox: a program that prints a value transformed escapes the redaction |
 | `seal_list()` | List SEALs created by **this MCP server only** (scope: `state.json`; never reveals user's CLI seals) |
 | `seal_revoke(handle)` | Revoke by opaque handle (model never learns raw `seal_id`) |
 

package/dist/cli.cjs

@@ -11811,7 +11811,7 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Files sent to your key arrive in seal_inbox; open them with seal_open item. Never read or print a SEAL handoff file.",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Anything sent to you without a link (to your key, your address) waits in seal_inbox: call it, then seal_open item. To run a program with a secret in its environment, use seal_run: the value stays out of the chat. Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
@@ -12011,7 +12011,7 @@ var seal_mcp_v1_default = {
     },
     seal_inbox: {
       title: "Check the inbox",
-      description: "Seals other agents or people sent to your key (your address). Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
+      description: "What other agents or people sent to you: seals addressed to your key (your address), no link needed. Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
       annotations: { readOnlyHint: true, openWorldHint: true },
       input: {
         properties: {
@@ -12043,6 +12043,46 @@ var seal_mcp_v1_default = {
         MUST_NOT_contain: ["path", "fragment", "url", "seal_id", "share_code"]
       }
     },
+    seal_run: {
+      title: "Run a program with secrets",
+      description: "Run a program with secrets from SEAL links or your inbox in its environment. The values never enter this conversation: they are removed from the output you get back. Use it instead of reading a secret file.",
+      annotations: { destructiveHint: true, openWorldHint: true },
+      input: {
+        required: ["command", "secrets"],
+        properties: {
+          command: { type: "array", items: { type: "string" }, minItems: 1, description: "The program and its arguments, run without a shell." },
+          secrets: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Each one is a link or an inbox item carrying one text file (up to 64 KiB), put into one variable of the program's environment.",
+            items: {
+              one_of: ["url", "item"],
+              properties: {
+                url: { type: "string", format: "uri", description: "Full SEAL share URL including fragment." },
+                item: { type: "string", pattern: "^in_", description: "An inbox handle from seal_inbox (`in_\u2026`), instead of a URL." },
+                name: { type: "string", pattern: "^[A-Za-z_][A-Za-z0-9_]*$", description: "The variable; default: the file's name in capitals (`Brave API key` \u2192 `BRAVE_API_KEY`)." }
+              }
+            }
+          },
+          cwd: { type: "string", description: "Working directory of the program; default this server's." },
+          timeout: { type: "integer", minimum: 1, maximum: 600, default: 120, description: "Seconds; after them the program is killed." }
+        }
+      },
+      flow: "SPEC-ADDRESS F4. Runs `seal run --redact --json --seal <url>=<NAME> \u2026 --item <inbox id>=<NAME> \u2026 -- <command\u2026>`, the `seal` CLI found on PATH as seal_request finds it, with this server's key as SEAL_SEED in the CLI's environment only and stdin closed. The CLI opens the links and inbox items with that key, removes SEAL_SEED and SEAL_PASSWORD from the program's environment and replaces every value of 8 bytes or more in its output with `[sealed:NAME]`. The values never enter this server's memory (\u04182). After `timeout` the CLI and the program are killed as one process group. Not a sandbox: the host lets the model run commands anyway, and a program that prints a value transformed (base64, one character at a time) escapes the redaction.",
+      output: {
+        type: "object",
+        required: ["exit_code", "stdout", "stderr", "redactions", "truncated"],
+        properties: {
+          exit_code: { type: "integer", description: "The program's; 128 + the signal when a signal killed it." },
+          stdout: { type: "string", description: "The last 64 KiB of the program's stdout, values replaced." },
+          stderr: { type: "string", description: "The last 64 KiB of its stderr, values replaced." },
+          redactions: { type: "integer", minimum: 0, description: "How many values were replaced." },
+          truncated: { type: "boolean", description: "A stream was longer than 64 KiB: only its end is here." }
+        },
+        MUST_NOT_contain: ["value", "secret_value", "content"]
+      }
+    },
     seal_list: {
       title: "List SEALs created via THIS MCP server",
       description: "Seals you created through this server: opaque handles with status and expiry. Seals made with the CLI or the desktop client live elsewhere and are not listed.",
@@ -12390,6 +12430,10 @@ var seal_mcp_v1_default = {
     request_cancelled: "seal_request: the user closed the dialog or declined the link. Ask again only if they want to.",
     request_expired: "seal_request: nobody answered the link before it expired. Make a new request if still needed.",
     request_failed: "seal_request: the local dialog or seal.net failed for a reason other than the above; the message says which.",
+    run_cli_missing: "seal_run: there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh",
+    run_not_text: "seal_run: a link carries more than one file, or a file over 64 KiB or not UTF-8 text: not a secret for an environment.",
+    run_timeout: "seal_run: the program ran longer than `timeout` and was killed with the CLI.",
+    run_failed: "seal_run: the CLI refused before the program started (a bad or gone link, a password, two secrets for one variable, a program that does not start); the message has the CLI's code.",
     pro_secret_not_found: "seal_pro_secret_use: no secret with that id or path in the organisation, or it has no version yet.",
     pro_secret_not_granted: "seal_pro_secret_use: the secret exists but this version is not granted to this agent, or the grant was revoked. A person grants it on the secret's page.",
     pro_secret_expired: "seal_pro_secret_use: the secret version has expired.",
@@ -13474,6 +13518,68 @@ async function sealRevoke(ctx, input) {
   return { revoked: true, revokedAt: now };
 }
 
+// src/tools/run.ts
+var import_node_child_process3 = require("child_process");
+async function sealRun(ctx, input) {
+  const cli = findSealCli();
+  if (!cli) throw new ToolError("run_cli_missing", "there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh");
+  const args = ["--json", "run", "--redact"];
+  for (const secret of input.secrets) {
+    if (secret.url === void 0 === (secret.item === void 0)) {
+      throw new ToolError("run_failed", "each secret takes exactly one of `url` (a SEAL link) and `item` (an inbox handle from seal_inbox)");
+    }
+    const name = secret.name === void 0 ? "" : `=${secret.name}`;
+    if (secret.url !== void 0) args.push("--seal", secret.url + name);
+    else args.push("--item", (await inboxItem(ctx, secret.item)).id + name);
+  }
+  args.push("--", ...input.command);
+  const env = { ...process.env, SEAL_SEED: bytesToBase64url(ctx.identity.secret) };
+  const { stdout, timedOut } = await runGroup(cli, args, { cwd: input.cwd, env, timeoutMs: input.timeout * 1e3 });
+  if (timedOut) throw new ToolError("run_timeout", `the program ran longer than ${input.timeout} s and was killed`);
+  let answer;
+  try {
+    answer = JSON.parse(stdout);
+  } catch {
+    throw new ToolError("run_failed", "the `seal` CLI answered no JSON: it is older than 1.4.0 (seal run --redact). Update it: curl -fsSL https://seal.net/install.sh | sh");
+  }
+  if ("error" in answer) {
+    throw new ToolError(answer.error.code === "run.not_text" ? "run_not_text" : "run_failed", `seal run: ${answer.error.code}: ${answer.error.message}`);
+  }
+  return {
+    exitCode: answer.exit_code,
+    stdout: answer.stdout,
+    stderr: answer.stderr,
+    redactions: answer.redactions,
+    truncated: answer.truncated
+  };
+}
+function runGroup(cli, args, opts) {
+  const group = process.platform !== "win32";
+  return new Promise((resolve5, reject) => {
+    const child = (0, import_node_child_process3.spawn)(cli, args, { cwd: opts.cwd, env: opts.env, stdio: ["ignore", "pipe", "ignore"], detached: group });
+    let stdout = "";
+    let timedOut = false;
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => stdout += chunk);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (group && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {
+      }
+    }, opts.timeoutMs);
+    child.on("error", (err2) => {
+      clearTimeout(timer);
+      reject(new ToolError("run_failed", `could not start ${cli}: ${err2.message}`, err2));
+    });
+    child.on("close", () => {
+      clearTimeout(timer);
+      resolve5({ stdout, timedOut });
+    });
+  });
+}
+
 // src/tools/share.ts
 var import_node_fs6 = require("fs");
 var import_promises9 = require("fs/promises");
@@ -14317,6 +14423,15 @@ function inboxOutputToWire(out) {
     }))
   };
 }
+function runOutputToWire(out) {
+  return {
+    exit_code: out.exitCode,
+    stdout: out.stdout,
+    stderr: out.stderr,
+    redactions: out.redactions,
+    truncated: out.truncated
+  };
+}
 function listOutputToWire(out) {
   return {
     entries: out.entries.map((entry) => ({
@@ -14347,7 +14462,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.5.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14356,6 +14471,8 @@ var SHARE_INPUT = seal_mcp_v1_default.tools.seal_share.input.properties;
 var REQUEST_INPUT = seal_mcp_v1_default.tools.seal_request.input.properties;
 var OPEN_INPUT = seal_mcp_v1_default.tools.seal_open.input.properties;
 var INBOX_INPUT = seal_mcp_v1_default.tools.seal_inbox.input.properties;
+var RUN_INPUT = seal_mcp_v1_default.tools.seal_run.input.properties;
+var RUN_SECRET = RUN_INPUT.secrets.items.properties;
 var PRO_SECRET_USE = seal_mcp_v1_default.pro_tools.seal_pro_secret_use;
 var PRO_SECRET_REQUEST = seal_mcp_v1_default.pro_tools.seal_pro_secret_request;
 var PRO_FILE_GET = seal_mcp_v1_default.pro_tools.seal_pro_file_get;
@@ -14533,6 +14650,29 @@ async function createServer(options) {
     },
     async (args) => wrapTool(() => sealInbox(ctx, { wait: args.wait }), inboxOutputToWire)
   );
+  mcp.registerTool(
+    "seal_run",
+    {
+      ...toolMeta("seal_run"),
+      inputSchema: {
+        command: external_exports.array(external_exports.string()).min(1).describe(RUN_INPUT.command.description),
+        secrets: external_exports.array(
+          external_exports.object({
+            // Exactly one of `url` and `item`: the handler refuses anything else (contract `one_of`).
+            url: external_exports.string().url().optional().describe(RUN_SECRET.url.description),
+            item: external_exports.string().regex(/^in_/).optional().describe(RUN_SECRET.item.description),
+            name: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional().describe(RUN_SECRET.name.description)
+          })
+        ).min(1).max(10).describe(RUN_INPUT.secrets.description),
+        cwd: external_exports.string().optional().describe(RUN_INPUT.cwd.description),
+        timeout: external_exports.number().int().min(1).max(600).default(RUN_INPUT.timeout.default).describe(RUN_INPUT.timeout.description)
+      }
+    },
+    async (args) => wrapTool(
+      () => sealRun(ctx, { command: args.command, secrets: args.secrets, cwd: args.cwd, timeout: args.timeout }),
+      runOutputToWire
+    )
+  );
   mcp.registerTool(
     "seal_list",
     {

package/dist/cli.js

@@ -11783,7 +11783,7 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Files sent to your key arrive in seal_inbox; open them with seal_open item. Never read or print a SEAL handoff file.",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Anything sent to you without a link (to your key, your address) waits in seal_inbox: call it, then seal_open item. To run a program with a secret in its environment, use seal_run: the value stays out of the chat. Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
@@ -11983,7 +11983,7 @@ var seal_mcp_v1_default = {
     },
     seal_inbox: {
       title: "Check the inbox",
-      description: "Seals other agents or people sent to your key (your address). Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
+      description: "What other agents or people sent to you: seals addressed to your key (your address), no link needed. Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
       annotations: { readOnlyHint: true, openWorldHint: true },
       input: {
         properties: {
@@ -12015,6 +12015,46 @@ var seal_mcp_v1_default = {
         MUST_NOT_contain: ["path", "fragment", "url", "seal_id", "share_code"]
       }
     },
+    seal_run: {
+      title: "Run a program with secrets",
+      description: "Run a program with secrets from SEAL links or your inbox in its environment. The values never enter this conversation: they are removed from the output you get back. Use it instead of reading a secret file.",
+      annotations: { destructiveHint: true, openWorldHint: true },
+      input: {
+        required: ["command", "secrets"],
+        properties: {
+          command: { type: "array", items: { type: "string" }, minItems: 1, description: "The program and its arguments, run without a shell." },
+          secrets: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Each one is a link or an inbox item carrying one text file (up to 64 KiB), put into one variable of the program's environment.",
+            items: {
+              one_of: ["url", "item"],
+              properties: {
+                url: { type: "string", format: "uri", description: "Full SEAL share URL including fragment." },
+                item: { type: "string", pattern: "^in_", description: "An inbox handle from seal_inbox (`in_\u2026`), instead of a URL." },
+                name: { type: "string", pattern: "^[A-Za-z_][A-Za-z0-9_]*$", description: "The variable; default: the file's name in capitals (`Brave API key` \u2192 `BRAVE_API_KEY`)." }
+              }
+            }
+          },
+          cwd: { type: "string", description: "Working directory of the program; default this server's." },
+          timeout: { type: "integer", minimum: 1, maximum: 600, default: 120, description: "Seconds; after them the program is killed." }
+        }
+      },
+      flow: "SPEC-ADDRESS F4. Runs `seal run --redact --json --seal <url>=<NAME> \u2026 --item <inbox id>=<NAME> \u2026 -- <command\u2026>`, the `seal` CLI found on PATH as seal_request finds it, with this server's key as SEAL_SEED in the CLI's environment only and stdin closed. The CLI opens the links and inbox items with that key, removes SEAL_SEED and SEAL_PASSWORD from the program's environment and replaces every value of 8 bytes or more in its output with `[sealed:NAME]`. The values never enter this server's memory (\u04182). After `timeout` the CLI and the program are killed as one process group. Not a sandbox: the host lets the model run commands anyway, and a program that prints a value transformed (base64, one character at a time) escapes the redaction.",
+      output: {
+        type: "object",
+        required: ["exit_code", "stdout", "stderr", "redactions", "truncated"],
+        properties: {
+          exit_code: { type: "integer", description: "The program's; 128 + the signal when a signal killed it." },
+          stdout: { type: "string", description: "The last 64 KiB of the program's stdout, values replaced." },
+          stderr: { type: "string", description: "The last 64 KiB of its stderr, values replaced." },
+          redactions: { type: "integer", minimum: 0, description: "How many values were replaced." },
+          truncated: { type: "boolean", description: "A stream was longer than 64 KiB: only its end is here." }
+        },
+        MUST_NOT_contain: ["value", "secret_value", "content"]
+      }
+    },
     seal_list: {
       title: "List SEALs created via THIS MCP server",
       description: "Seals you created through this server: opaque handles with status and expiry. Seals made with the CLI or the desktop client live elsewhere and are not listed.",
@@ -12362,6 +12402,10 @@ var seal_mcp_v1_default = {
     request_cancelled: "seal_request: the user closed the dialog or declined the link. Ask again only if they want to.",
     request_expired: "seal_request: nobody answered the link before it expired. Make a new request if still needed.",
     request_failed: "seal_request: the local dialog or seal.net failed for a reason other than the above; the message says which.",
+    run_cli_missing: "seal_run: there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh",
+    run_not_text: "seal_run: a link carries more than one file, or a file over 64 KiB or not UTF-8 text: not a secret for an environment.",
+    run_timeout: "seal_run: the program ran longer than `timeout` and was killed with the CLI.",
+    run_failed: "seal_run: the CLI refused before the program started (a bad or gone link, a password, two secrets for one variable, a program that does not start); the message has the CLI's code.",
     pro_secret_not_found: "seal_pro_secret_use: no secret with that id or path in the organisation, or it has no version yet.",
     pro_secret_not_granted: "seal_pro_secret_use: the secret exists but this version is not granted to this agent, or the grant was revoked. A person grants it on the secret's page.",
     pro_secret_expired: "seal_pro_secret_use: the secret version has expired.",
@@ -13446,6 +13490,68 @@ async function sealRevoke(ctx, input) {
   return { revoked: true, revokedAt: now };
 }
 
+// src/tools/run.ts
+import { spawn } from "child_process";
+async function sealRun(ctx, input) {
+  const cli = findSealCli();
+  if (!cli) throw new ToolError("run_cli_missing", "there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh");
+  const args = ["--json", "run", "--redact"];
+  for (const secret of input.secrets) {
+    if (secret.url === void 0 === (secret.item === void 0)) {
+      throw new ToolError("run_failed", "each secret takes exactly one of `url` (a SEAL link) and `item` (an inbox handle from seal_inbox)");
+    }
+    const name = secret.name === void 0 ? "" : `=${secret.name}`;
+    if (secret.url !== void 0) args.push("--seal", secret.url + name);
+    else args.push("--item", (await inboxItem(ctx, secret.item)).id + name);
+  }
+  args.push("--", ...input.command);
+  const env = { ...process.env, SEAL_SEED: bytesToBase64url(ctx.identity.secret) };
+  const { stdout, timedOut } = await runGroup(cli, args, { cwd: input.cwd, env, timeoutMs: input.timeout * 1e3 });
+  if (timedOut) throw new ToolError("run_timeout", `the program ran longer than ${input.timeout} s and was killed`);
+  let answer;
+  try {
+    answer = JSON.parse(stdout);
+  } catch {
+    throw new ToolError("run_failed", "the `seal` CLI answered no JSON: it is older than 1.4.0 (seal run --redact). Update it: curl -fsSL https://seal.net/install.sh | sh");
+  }
+  if ("error" in answer) {
+    throw new ToolError(answer.error.code === "run.not_text" ? "run_not_text" : "run_failed", `seal run: ${answer.error.code}: ${answer.error.message}`);
+  }
+  return {
+    exitCode: answer.exit_code,
+    stdout: answer.stdout,
+    stderr: answer.stderr,
+    redactions: answer.redactions,
+    truncated: answer.truncated
+  };
+}
+function runGroup(cli, args, opts) {
+  const group = process.platform !== "win32";
+  return new Promise((resolve5, reject) => {
+    const child = spawn(cli, args, { cwd: opts.cwd, env: opts.env, stdio: ["ignore", "pipe", "ignore"], detached: group });
+    let stdout = "";
+    let timedOut = false;
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => stdout += chunk);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (group && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {
+      }
+    }, opts.timeoutMs);
+    child.on("error", (err2) => {
+      clearTimeout(timer);
+      reject(new ToolError("run_failed", `could not start ${cli}: ${err2.message}`, err2));
+    });
+    child.on("close", () => {
+      clearTimeout(timer);
+      resolve5({ stdout, timedOut });
+    });
+  });
+}
+
 // src/tools/share.ts
 import { openAsBlob as openAsBlob2 } from "fs";
 import { stat as stat3 } from "fs/promises";
@@ -14289,6 +14395,15 @@ function inboxOutputToWire(out) {
     }))
   };
 }
+function runOutputToWire(out) {
+  return {
+    exit_code: out.exitCode,
+    stdout: out.stdout,
+    stderr: out.stderr,
+    redactions: out.redactions,
+    truncated: out.truncated
+  };
+}
 function listOutputToWire(out) {
   return {
     entries: out.entries.map((entry) => ({
@@ -14319,7 +14434,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.5.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14328,6 +14443,8 @@ var SHARE_INPUT = seal_mcp_v1_default.tools.seal_share.input.properties;
 var REQUEST_INPUT = seal_mcp_v1_default.tools.seal_request.input.properties;
 var OPEN_INPUT = seal_mcp_v1_default.tools.seal_open.input.properties;
 var INBOX_INPUT = seal_mcp_v1_default.tools.seal_inbox.input.properties;
+var RUN_INPUT = seal_mcp_v1_default.tools.seal_run.input.properties;
+var RUN_SECRET = RUN_INPUT.secrets.items.properties;
 var PRO_SECRET_USE = seal_mcp_v1_default.pro_tools.seal_pro_secret_use;
 var PRO_SECRET_REQUEST = seal_mcp_v1_default.pro_tools.seal_pro_secret_request;
 var PRO_FILE_GET = seal_mcp_v1_default.pro_tools.seal_pro_file_get;
@@ -14505,6 +14622,29 @@ async function createServer(options) {
     },
     async (args) => wrapTool(() => sealInbox(ctx, { wait: args.wait }), inboxOutputToWire)
   );
+  mcp.registerTool(
+    "seal_run",
+    {
+      ...toolMeta("seal_run"),
+      inputSchema: {
+        command: external_exports.array(external_exports.string()).min(1).describe(RUN_INPUT.command.description),
+        secrets: external_exports.array(
+          external_exports.object({
+            // Exactly one of `url` and `item`: the handler refuses anything else (contract `one_of`).
+            url: external_exports.string().url().optional().describe(RUN_SECRET.url.description),
+            item: external_exports.string().regex(/^in_/).optional().describe(RUN_SECRET.item.description),
+            name: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional().describe(RUN_SECRET.name.description)
+          })
+        ).min(1).max(10).describe(RUN_INPUT.secrets.description),
+        cwd: external_exports.string().optional().describe(RUN_INPUT.cwd.description),
+        timeout: external_exports.number().int().min(1).max(600).default(RUN_INPUT.timeout.default).describe(RUN_INPUT.timeout.description)
+      }
+    },
+    async (args) => wrapTool(
+      () => sealRun(ctx, { command: args.command, secrets: args.secrets, cwd: args.cwd, timeout: args.timeout }),
+      runOutputToWire
+    )
+  );
   mcp.registerTool(
     "seal_list",
     {

package/dist/index.cjs

@@ -4145,7 +4145,7 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Files sent to your key arrive in seal_inbox; open them with seal_open item. Never read or print a SEAL handoff file.",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Anything sent to you without a link (to your key, your address) waits in seal_inbox: call it, then seal_open item. To run a program with a secret in its environment, use seal_run: the value stays out of the chat. Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
@@ -4345,7 +4345,7 @@ var seal_mcp_v1_default = {
     },
     seal_inbox: {
       title: "Check the inbox",
-      description: "Seals other agents or people sent to your key (your address). Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
+      description: "What other agents or people sent to you: seals addressed to your key (your address), no link needed. Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
       annotations: { readOnlyHint: true, openWorldHint: true },
       input: {
         properties: {
@@ -4377,6 +4377,46 @@ var seal_mcp_v1_default = {
         MUST_NOT_contain: ["path", "fragment", "url", "seal_id", "share_code"]
       }
     },
+    seal_run: {
+      title: "Run a program with secrets",
+      description: "Run a program with secrets from SEAL links or your inbox in its environment. The values never enter this conversation: they are removed from the output you get back. Use it instead of reading a secret file.",
+      annotations: { destructiveHint: true, openWorldHint: true },
+      input: {
+        required: ["command", "secrets"],
+        properties: {
+          command: { type: "array", items: { type: "string" }, minItems: 1, description: "The program and its arguments, run without a shell." },
+          secrets: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Each one is a link or an inbox item carrying one text file (up to 64 KiB), put into one variable of the program's environment.",
+            items: {
+              one_of: ["url", "item"],
+              properties: {
+                url: { type: "string", format: "uri", description: "Full SEAL share URL including fragment." },
+                item: { type: "string", pattern: "^in_", description: "An inbox handle from seal_inbox (`in_\u2026`), instead of a URL." },
+                name: { type: "string", pattern: "^[A-Za-z_][A-Za-z0-9_]*$", description: "The variable; default: the file's name in capitals (`Brave API key` \u2192 `BRAVE_API_KEY`)." }
+              }
+            }
+          },
+          cwd: { type: "string", description: "Working directory of the program; default this server's." },
+          timeout: { type: "integer", minimum: 1, maximum: 600, default: 120, description: "Seconds; after them the program is killed." }
+        }
+      },
+      flow: "SPEC-ADDRESS F4. Runs `seal run --redact --json --seal <url>=<NAME> \u2026 --item <inbox id>=<NAME> \u2026 -- <command\u2026>`, the `seal` CLI found on PATH as seal_request finds it, with this server's key as SEAL_SEED in the CLI's environment only and stdin closed. The CLI opens the links and inbox items with that key, removes SEAL_SEED and SEAL_PASSWORD from the program's environment and replaces every value of 8 bytes or more in its output with `[sealed:NAME]`. The values never enter this server's memory (\u04182). After `timeout` the CLI and the program are killed as one process group. Not a sandbox: the host lets the model run commands anyway, and a program that prints a value transformed (base64, one character at a time) escapes the redaction.",
+      output: {
+        type: "object",
+        required: ["exit_code", "stdout", "stderr", "redactions", "truncated"],
+        properties: {
+          exit_code: { type: "integer", description: "The program's; 128 + the signal when a signal killed it." },
+          stdout: { type: "string", description: "The last 64 KiB of the program's stdout, values replaced." },
+          stderr: { type: "string", description: "The last 64 KiB of its stderr, values replaced." },
+          redactions: { type: "integer", minimum: 0, description: "How many values were replaced." },
+          truncated: { type: "boolean", description: "A stream was longer than 64 KiB: only its end is here." }
+        },
+        MUST_NOT_contain: ["value", "secret_value", "content"]
+      }
+    },
     seal_list: {
       title: "List SEALs created via THIS MCP server",
       description: "Seals you created through this server: opaque handles with status and expiry. Seals made with the CLI or the desktop client live elsewhere and are not listed.",
@@ -4724,6 +4764,10 @@ var seal_mcp_v1_default = {
     request_cancelled: "seal_request: the user closed the dialog or declined the link. Ask again only if they want to.",
     request_expired: "seal_request: nobody answered the link before it expired. Make a new request if still needed.",
     request_failed: "seal_request: the local dialog or seal.net failed for a reason other than the above; the message says which.",
+    run_cli_missing: "seal_run: there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh",
+    run_not_text: "seal_run: a link carries more than one file, or a file over 64 KiB or not UTF-8 text: not a secret for an environment.",
+    run_timeout: "seal_run: the program ran longer than `timeout` and was killed with the CLI.",
+    run_failed: "seal_run: the CLI refused before the program started (a bad or gone link, a password, two secrets for one variable, a program that does not start); the message has the CLI's code.",
     pro_secret_not_found: "seal_pro_secret_use: no secret with that id or path in the organisation, or it has no version yet.",
     pro_secret_not_granted: "seal_pro_secret_use: the secret exists but this version is not granted to this agent, or the grant was revoked. A person grants it on the secret's page.",
     pro_secret_expired: "seal_pro_secret_use: the secret version has expired.",
@@ -13274,6 +13318,68 @@ async function sealRevoke(ctx, input) {
   return { revoked: true, revokedAt: now };
 }
 
+// src/tools/run.ts
+var import_node_child_process2 = require("child_process");
+async function sealRun(ctx, input) {
+  const cli = findSealCli();
+  if (!cli) throw new ToolError("run_cli_missing", "there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh");
+  const args = ["--json", "run", "--redact"];
+  for (const secret of input.secrets) {
+    if (secret.url === void 0 === (secret.item === void 0)) {
+      throw new ToolError("run_failed", "each secret takes exactly one of `url` (a SEAL link) and `item` (an inbox handle from seal_inbox)");
+    }
+    const name = secret.name === void 0 ? "" : `=${secret.name}`;
+    if (secret.url !== void 0) args.push("--seal", secret.url + name);
+    else args.push("--item", (await inboxItem(ctx, secret.item)).id + name);
+  }
+  args.push("--", ...input.command);
+  const env = { ...process.env, SEAL_SEED: bytesToBase64url(ctx.identity.secret) };
+  const { stdout, timedOut } = await runGroup(cli, args, { cwd: input.cwd, env, timeoutMs: input.timeout * 1e3 });
+  if (timedOut) throw new ToolError("run_timeout", `the program ran longer than ${input.timeout} s and was killed`);
+  let answer;
+  try {
+    answer = JSON.parse(stdout);
+  } catch {
+    throw new ToolError("run_failed", "the `seal` CLI answered no JSON: it is older than 1.4.0 (seal run --redact). Update it: curl -fsSL https://seal.net/install.sh | sh");
+  }
+  if ("error" in answer) {
+    throw new ToolError(answer.error.code === "run.not_text" ? "run_not_text" : "run_failed", `seal run: ${answer.error.code}: ${answer.error.message}`);
+  }
+  return {
+    exitCode: answer.exit_code,
+    stdout: answer.stdout,
+    stderr: answer.stderr,
+    redactions: answer.redactions,
+    truncated: answer.truncated
+  };
+}
+function runGroup(cli, args, opts) {
+  const group = process.platform !== "win32";
+  return new Promise((resolve5, reject) => {
+    const child = (0, import_node_child_process2.spawn)(cli, args, { cwd: opts.cwd, env: opts.env, stdio: ["ignore", "pipe", "ignore"], detached: group });
+    let stdout = "";
+    let timedOut = false;
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => stdout += chunk);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (group && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {
+      }
+    }, opts.timeoutMs);
+    child.on("error", (err2) => {
+      clearTimeout(timer);
+      reject(new ToolError("run_failed", `could not start ${cli}: ${err2.message}`, err2));
+    });
+    child.on("close", () => {
+      clearTimeout(timer);
+      resolve5({ stdout, timedOut });
+    });
+  });
+}
+
 // src/tools/share.ts
 var import_node_fs5 = require("fs");
 var import_promises9 = require("fs/promises");
@@ -14117,6 +14223,15 @@ function inboxOutputToWire(out) {
     }))
   };
 }
+function runOutputToWire(out) {
+  return {
+    exit_code: out.exitCode,
+    stdout: out.stdout,
+    stderr: out.stderr,
+    redactions: out.redactions,
+    truncated: out.truncated
+  };
+}
 function listOutputToWire(out) {
   return {
     entries: out.entries.map((entry) => ({
@@ -14147,7 +14262,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.5.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14156,6 +14271,8 @@ var SHARE_INPUT = seal_mcp_v1_default.tools.seal_share.input.properties;
 var REQUEST_INPUT = seal_mcp_v1_default.tools.seal_request.input.properties;
 var OPEN_INPUT = seal_mcp_v1_default.tools.seal_open.input.properties;
 var INBOX_INPUT = seal_mcp_v1_default.tools.seal_inbox.input.properties;
+var RUN_INPUT = seal_mcp_v1_default.tools.seal_run.input.properties;
+var RUN_SECRET = RUN_INPUT.secrets.items.properties;
 var PRO_SECRET_USE = seal_mcp_v1_default.pro_tools.seal_pro_secret_use;
 var PRO_SECRET_REQUEST = seal_mcp_v1_default.pro_tools.seal_pro_secret_request;
 var PRO_FILE_GET = seal_mcp_v1_default.pro_tools.seal_pro_file_get;
@@ -14333,6 +14450,29 @@ async function createServer(options) {
     },
     async (args) => wrapTool(() => sealInbox(ctx, { wait: args.wait }), inboxOutputToWire)
   );
+  mcp.registerTool(
+    "seal_run",
+    {
+      ...toolMeta("seal_run"),
+      inputSchema: {
+        command: external_exports.array(external_exports.string()).min(1).describe(RUN_INPUT.command.description),
+        secrets: external_exports.array(
+          external_exports.object({
+            // Exactly one of `url` and `item`: the handler refuses anything else (contract `one_of`).
+            url: external_exports.string().url().optional().describe(RUN_SECRET.url.description),
+            item: external_exports.string().regex(/^in_/).optional().describe(RUN_SECRET.item.description),
+            name: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional().describe(RUN_SECRET.name.description)
+          })
+        ).min(1).max(10).describe(RUN_INPUT.secrets.description),
+        cwd: external_exports.string().optional().describe(RUN_INPUT.cwd.description),
+        timeout: external_exports.number().int().min(1).max(600).default(RUN_INPUT.timeout.default).describe(RUN_INPUT.timeout.description)
+      }
+    },
+    async (args) => wrapTool(
+      () => sealRun(ctx, { command: args.command, secrets: args.secrets, cwd: args.cwd, timeout: args.timeout }),
+      runOutputToWire
+    )
+  );
   mcp.registerTool(
     "seal_list",
     {
@@ -14499,7 +14639,7 @@ function osDefaultDir(env, platform, home) {
 }
 
 // src/seed.ts
-var import_node_child_process2 = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_crypto4 = require("crypto");
 var import_node_fs6 = require("fs");
 var import_node_path10 = require("path");
@@ -14533,7 +14673,7 @@ function keyringEntry(keyring, platform, service, account) {
 }
 function readKeytarLinuxEntry(service, account) {
   return new Promise((resolve5) => {
-    (0, import_node_child_process2.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+    (0, import_node_child_process3.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
       const value = err2 ? "" : stdout.replace(/\n$/, "");
       resolve5(value.length > 0 ? value : null);
     });

package/dist/index.d.cts

@@ -840,8 +840,8 @@ interface WorkloadCredentials {
 }
 
 /**
- * MCP server bootstrap — wires the six tools (`seal_share`,
- * `seal_request`, `seal_open`, `seal_inbox`, `seal_list`, `seal_revoke`) to a
+ * MCP server bootstrap — wires the seven tools (`seal_share`,
+ * `seal_request`, `seal_open`, `seal_inbox`, `seal_run`, `seal_list`, `seal_revoke`) to a
  * stdio-transport `McpServer` instance, and `seal_pro_secret_use`,
  * `seal_pro_secret_request` and `seal_pro_file_get` when SEAL Pro workload
  * credentials exist (contract `pro_tools`).

package/dist/index.d.ts

@@ -840,8 +840,8 @@ interface WorkloadCredentials {
 }
 
 /**
- * MCP server bootstrap — wires the six tools (`seal_share`,
- * `seal_request`, `seal_open`, `seal_inbox`, `seal_list`, `seal_revoke`) to a
+ * MCP server bootstrap — wires the seven tools (`seal_share`,
+ * `seal_request`, `seal_open`, `seal_inbox`, `seal_run`, `seal_list`, `seal_revoke`) to a
  * stdio-transport `McpServer` instance, and `seal_pro_secret_use`,
  * `seal_pro_secret_request` and `seal_pro_file_get` when SEAL Pro workload
  * credentials exist (contract `pro_tools`).

package/dist/index.js

@@ -4065,7 +4065,7 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Files sent to your key arrive in seal_inbox; open them with seal_open item. Never read or print a SEAL handoff file.",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Anything sent to you without a link (to your key, your address) waits in seal_inbox: call it, then seal_open item. To run a program with a secret in its environment, use seal_run: the value stays out of the chat. Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
@@ -4265,7 +4265,7 @@ var seal_mcp_v1_default = {
     },
     seal_inbox: {
       title: "Check the inbox",
-      description: "Seals other agents or people sent to your key (your address). Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
+      description: "What other agents or people sent to you: seals addressed to your key (your address), no link needed. Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
       annotations: { readOnlyHint: true, openWorldHint: true },
       input: {
         properties: {
@@ -4297,6 +4297,46 @@ var seal_mcp_v1_default = {
         MUST_NOT_contain: ["path", "fragment", "url", "seal_id", "share_code"]
       }
     },
+    seal_run: {
+      title: "Run a program with secrets",
+      description: "Run a program with secrets from SEAL links or your inbox in its environment. The values never enter this conversation: they are removed from the output you get back. Use it instead of reading a secret file.",
+      annotations: { destructiveHint: true, openWorldHint: true },
+      input: {
+        required: ["command", "secrets"],
+        properties: {
+          command: { type: "array", items: { type: "string" }, minItems: 1, description: "The program and its arguments, run without a shell." },
+          secrets: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Each one is a link or an inbox item carrying one text file (up to 64 KiB), put into one variable of the program's environment.",
+            items: {
+              one_of: ["url", "item"],
+              properties: {
+                url: { type: "string", format: "uri", description: "Full SEAL share URL including fragment." },
+                item: { type: "string", pattern: "^in_", description: "An inbox handle from seal_inbox (`in_\u2026`), instead of a URL." },
+                name: { type: "string", pattern: "^[A-Za-z_][A-Za-z0-9_]*$", description: "The variable; default: the file's name in capitals (`Brave API key` \u2192 `BRAVE_API_KEY`)." }
+              }
+            }
+          },
+          cwd: { type: "string", description: "Working directory of the program; default this server's." },
+          timeout: { type: "integer", minimum: 1, maximum: 600, default: 120, description: "Seconds; after them the program is killed." }
+        }
+      },
+      flow: "SPEC-ADDRESS F4. Runs `seal run --redact --json --seal <url>=<NAME> \u2026 --item <inbox id>=<NAME> \u2026 -- <command\u2026>`, the `seal` CLI found on PATH as seal_request finds it, with this server's key as SEAL_SEED in the CLI's environment only and stdin closed. The CLI opens the links and inbox items with that key, removes SEAL_SEED and SEAL_PASSWORD from the program's environment and replaces every value of 8 bytes or more in its output with `[sealed:NAME]`. The values never enter this server's memory (\u04182). After `timeout` the CLI and the program are killed as one process group. Not a sandbox: the host lets the model run commands anyway, and a program that prints a value transformed (base64, one character at a time) escapes the redaction.",
+      output: {
+        type: "object",
+        required: ["exit_code", "stdout", "stderr", "redactions", "truncated"],
+        properties: {
+          exit_code: { type: "integer", description: "The program's; 128 + the signal when a signal killed it." },
+          stdout: { type: "string", description: "The last 64 KiB of the program's stdout, values replaced." },
+          stderr: { type: "string", description: "The last 64 KiB of its stderr, values replaced." },
+          redactions: { type: "integer", minimum: 0, description: "How many values were replaced." },
+          truncated: { type: "boolean", description: "A stream was longer than 64 KiB: only its end is here." }
+        },
+        MUST_NOT_contain: ["value", "secret_value", "content"]
+      }
+    },
     seal_list: {
       title: "List SEALs created via THIS MCP server",
       description: "Seals you created through this server: opaque handles with status and expiry. Seals made with the CLI or the desktop client live elsewhere and are not listed.",
@@ -4644,6 +4684,10 @@ var seal_mcp_v1_default = {
     request_cancelled: "seal_request: the user closed the dialog or declined the link. Ask again only if they want to.",
     request_expired: "seal_request: nobody answered the link before it expired. Make a new request if still needed.",
     request_failed: "seal_request: the local dialog or seal.net failed for a reason other than the above; the message says which.",
+    run_cli_missing: "seal_run: there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh",
+    run_not_text: "seal_run: a link carries more than one file, or a file over 64 KiB or not UTF-8 text: not a secret for an environment.",
+    run_timeout: "seal_run: the program ran longer than `timeout` and was killed with the CLI.",
+    run_failed: "seal_run: the CLI refused before the program started (a bad or gone link, a password, two secrets for one variable, a program that does not start); the message has the CLI's code.",
     pro_secret_not_found: "seal_pro_secret_use: no secret with that id or path in the organisation, or it has no version yet.",
     pro_secret_not_granted: "seal_pro_secret_use: the secret exists but this version is not granted to this agent, or the grant was revoked. A person grants it on the secret's page.",
     pro_secret_expired: "seal_pro_secret_use: the secret version has expired.",
@@ -13194,6 +13238,68 @@ async function sealRevoke(ctx, input) {
   return { revoked: true, revokedAt: now };
 }
 
+// src/tools/run.ts
+import { spawn } from "child_process";
+async function sealRun(ctx, input) {
+  const cli = findSealCli();
+  if (!cli) throw new ToolError("run_cli_missing", "there is no `seal` CLI on PATH. Install it: curl -fsSL https://seal.net/install.sh | sh");
+  const args = ["--json", "run", "--redact"];
+  for (const secret of input.secrets) {
+    if (secret.url === void 0 === (secret.item === void 0)) {
+      throw new ToolError("run_failed", "each secret takes exactly one of `url` (a SEAL link) and `item` (an inbox handle from seal_inbox)");
+    }
+    const name = secret.name === void 0 ? "" : `=${secret.name}`;
+    if (secret.url !== void 0) args.push("--seal", secret.url + name);
+    else args.push("--item", (await inboxItem(ctx, secret.item)).id + name);
+  }
+  args.push("--", ...input.command);
+  const env = { ...process.env, SEAL_SEED: bytesToBase64url(ctx.identity.secret) };
+  const { stdout, timedOut } = await runGroup(cli, args, { cwd: input.cwd, env, timeoutMs: input.timeout * 1e3 });
+  if (timedOut) throw new ToolError("run_timeout", `the program ran longer than ${input.timeout} s and was killed`);
+  let answer;
+  try {
+    answer = JSON.parse(stdout);
+  } catch {
+    throw new ToolError("run_failed", "the `seal` CLI answered no JSON: it is older than 1.4.0 (seal run --redact). Update it: curl -fsSL https://seal.net/install.sh | sh");
+  }
+  if ("error" in answer) {
+    throw new ToolError(answer.error.code === "run.not_text" ? "run_not_text" : "run_failed", `seal run: ${answer.error.code}: ${answer.error.message}`);
+  }
+  return {
+    exitCode: answer.exit_code,
+    stdout: answer.stdout,
+    stderr: answer.stderr,
+    redactions: answer.redactions,
+    truncated: answer.truncated
+  };
+}
+function runGroup(cli, args, opts) {
+  const group = process.platform !== "win32";
+  return new Promise((resolve5, reject) => {
+    const child = spawn(cli, args, { cwd: opts.cwd, env: opts.env, stdio: ["ignore", "pipe", "ignore"], detached: group });
+    let stdout = "";
+    let timedOut = false;
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => stdout += chunk);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (group && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {
+      }
+    }, opts.timeoutMs);
+    child.on("error", (err2) => {
+      clearTimeout(timer);
+      reject(new ToolError("run_failed", `could not start ${cli}: ${err2.message}`, err2));
+    });
+    child.on("close", () => {
+      clearTimeout(timer);
+      resolve5({ stdout, timedOut });
+    });
+  });
+}
+
 // src/tools/share.ts
 import { openAsBlob as openAsBlob2 } from "fs";
 import { stat as stat3 } from "fs/promises";
@@ -14037,6 +14143,15 @@ function inboxOutputToWire(out) {
     }))
   };
 }
+function runOutputToWire(out) {
+  return {
+    exit_code: out.exitCode,
+    stdout: out.stdout,
+    stderr: out.stderr,
+    redactions: out.redactions,
+    truncated: out.truncated
+  };
+}
 function listOutputToWire(out) {
   return {
     entries: out.entries.map((entry) => ({
@@ -14067,7 +14182,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.4.0";
+var SERVER_VERSION = "0.5.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14076,6 +14191,8 @@ var SHARE_INPUT = seal_mcp_v1_default.tools.seal_share.input.properties;
 var REQUEST_INPUT = seal_mcp_v1_default.tools.seal_request.input.properties;
 var OPEN_INPUT = seal_mcp_v1_default.tools.seal_open.input.properties;
 var INBOX_INPUT = seal_mcp_v1_default.tools.seal_inbox.input.properties;
+var RUN_INPUT = seal_mcp_v1_default.tools.seal_run.input.properties;
+var RUN_SECRET = RUN_INPUT.secrets.items.properties;
 var PRO_SECRET_USE = seal_mcp_v1_default.pro_tools.seal_pro_secret_use;
 var PRO_SECRET_REQUEST = seal_mcp_v1_default.pro_tools.seal_pro_secret_request;
 var PRO_FILE_GET = seal_mcp_v1_default.pro_tools.seal_pro_file_get;
@@ -14253,6 +14370,29 @@ async function createServer(options) {
     },
     async (args) => wrapTool(() => sealInbox(ctx, { wait: args.wait }), inboxOutputToWire)
   );
+  mcp.registerTool(
+    "seal_run",
+    {
+      ...toolMeta("seal_run"),
+      inputSchema: {
+        command: external_exports.array(external_exports.string()).min(1).describe(RUN_INPUT.command.description),
+        secrets: external_exports.array(
+          external_exports.object({
+            // Exactly one of `url` and `item`: the handler refuses anything else (contract `one_of`).
+            url: external_exports.string().url().optional().describe(RUN_SECRET.url.description),
+            item: external_exports.string().regex(/^in_/).optional().describe(RUN_SECRET.item.description),
+            name: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional().describe(RUN_SECRET.name.description)
+          })
+        ).min(1).max(10).describe(RUN_INPUT.secrets.description),
+        cwd: external_exports.string().optional().describe(RUN_INPUT.cwd.description),
+        timeout: external_exports.number().int().min(1).max(600).default(RUN_INPUT.timeout.default).describe(RUN_INPUT.timeout.description)
+      }
+    },
+    async (args) => wrapTool(
+      () => sealRun(ctx, { command: args.command, secrets: args.secrets, cwd: args.cwd, timeout: args.timeout }),
+      runOutputToWire
+    )
+  );
   mcp.registerTool(
     "seal_list",
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealnet-mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "mcpName": "net.seal/mcp",
   "description": "Model Context Protocol server for SEAL: handoff mode puts the link on the user's clipboard or in a 0600 file, never in the chat; explicit opt-in to forward mode with strict TTL/recipient policy.",
   "type": "module",