MCP server

The Wipe.me MCP server gives Codex, Claude, and other local MCP hosts a safer way to coordinate secrets. The agent can request an operation and receive status, paths, or a private link, but the server never returns decrypted text, attachment bytes, generated passwords, environment values, or child-process output. It is included in the wipeme CLI beginning with v0.3.0-alpha.3.

This release is an alpha prerelease and has not received an independent security audit. MCP tools can consume one-time messages and write or execute locally; review your agent host’s approval prompts and the active Wipe.me access policy.

Connect an AI platform

Configure ChatGPT desktop, Codex, Claude Code, or Claude Desktop.

Why use the MCP server?

Ordinary chat-based secret handling can leave plaintext in prompts, transcripts, tool arguments, traces, screenshots, and provider logs. With Wipe.me, the MCP host coordinates a local operation while plaintext moves directly between Wipe.me and a file, environment value, or approved child process. The MCP server deliberately has no direct-read tool. Do not place literal secrets or passphrases in MCP arguments: use private-link files, inherited environment variables, passphrase files, or other supported local sources. Use generate_secret when a human or another system needs a newly generated password. Wipe.me generates it with operating-system cryptographic randomness, encrypts it locally, and returns only the private link.

{
  "length": 32,
  "chars": "portable",
  "expires_in_seconds": 3600
}

The agent can relay the link without learning the generated value. The recipient opens it once through the web application or consumes it through an approved local Wipe.me workflow.

Generate into an environment file

Use generate_secret_into_env_file when a local application and a remote recipient need the same newly generated value. The server writes the value to a private mode-0600 environment file and releases the link only after the file is installed successfully.

{
  "length": 32,
  "chars": "portable",
  "destination_file": "/workspace/private/database.env",
  "environment": [
    { "name": "DATABASE_PASSWORD" }
  ],
  "format": "shell",
  "overwrite": false,
  "expires_in_seconds": 3600
}

The agent sees the destination path and private link, not the password. A trusted command can then source the file without printing it:

sh -c '. /workspace/private/database.env && exec ./bin/migrate'

Consume a message into environment variables

For commands that may be retried or run more than once, prefer consume_into_env_file. It consumes the remote message once and maps selected text blocks into a reusable private file without returning the values through MCP.

{
  "link_file": "/workspace/private/message.link",
  "destination_file": "/workspace/private/application.env",
  "environment": [
    { "name": "DATABASE_PASSWORD", "block": 0 },
    { "name": "API_TOKEN", "block": 1 }
  ],
  "format": "shell",
  "overwrite": false
}

Run the application with the resulting variables:

sh -c '. /workspace/private/application.env && exec ./bin/start'

For Docker, request "format": "docker", then pass the file directly:

docker run --rm --env-file /workspace/private/container.env example/app migrate

The environment file can support validation, restarts, and multiple commands without consuming another message. Treat it as the secret: keep it outside source control, restrict access, and delete it when it is no longer needed.

Consume a private message and attachments into a folder

Use consume_into_files for configuration bundles, certificates, reports, or other attachments. The destination directory must not already exist. Wipe.me creates it with mode 0700 and writes message and attachment files with mode 0600.

{
  "link_file": "/workspace/private/deployment-bundle.link",
  "destination_directory": "/workspace/private/deployment-bundle",
  "message_filename": "instructions.txt",
  "write_message": true,
  "write_attachments": true
}

Plaintext stays in the destination directory and is not copied into the MCP result. Existing directories are refused, filenames are made traversal-safe, and files are never silently overwritten.

Create a private link from existing environment variables

Use create_from_env when a secret is already available to the local MCP server process and needs to be handed off without appearing in the agent conversation. Each requested value becomes a text block in the resulting one-time message.

{
  "variables": [
    { "source": "DATABASE_PASSWORD" },
    { "source": "API_TOKEN" }
  ],
  "expires_in_seconds": 3600
}

In host mode, variables must be inherited by the wipeme mcp process. Restricted mode additionally requires their names in mcp.allowed_source_env. Missing or empty values fail before anything is uploaded. The values never appear in the tool result; only the private link does.

One immediate command without a secret file

consume_into_process_env injects selected message blocks directly into one child process. generate_secret_into_process_env similarly creates a password, uploads it, injects it into a child, and releases the link only after an accepted exit. Use these for deliberate one-shot execution. Prefer environment files when a command may fail, restart, or require multiple runs. The server launches direct commands without inserting a shell, and child output is not returned through MCP.

Access policies

Local stdio MCP defaults to host access. Filesystem paths, environment names, and commands are governed by the MCP host, operating-system account, sandbox, and approval flow. Use restricted mode when Wipe.me itself should enforce additional read roots, write roots, environment-name allowlists, and administrator-defined process profiles:

wipeme mcp --access restricted

Inspect the resolved non-secret policy before connecting a host:

wipeme mcp --show-policy

Restart the MCP host after changing its launcher environment or Wipe.me policy.

Available tools

Tool	Purpose
`inspect_private_link`	Validate link syntax locally without echoing the link
`generate_secret`	Generate and encrypt a password, returning only its link
`generate_secret_into_env_file`	Generate one password, save it locally, and return its link
`generate_secret_into_process_env`	Generate and inject a password into one child process
`create_from_files`	Encrypt a message file and attachments
`create_from_env`	Encrypt inherited environment values
`create_from_process_output`	Encrypt a command’s stdout without returning it
`consume_into_env_file`	Map message blocks into a private environment file
`retry_into_env_file`	Retry local environment-file output without retrieving again
`consume_into_files`	Write message content and attachments into a new private directory
`retry_into_files`	Retry protected file output without retrieving again
`consume_into_process_env`	Inject message blocks into one child process
`retry_process_env`	Retry a retained process operation without retrieving or generating again
`forget_recovery`	Abandon retained recovery state safely
`delete_message`	Delete a message using its private capability

Installation

Install the alpha release and connect your MCP host.

CLI reference

Use the same functionality directly from a terminal or script.

Overview

Use cases

Developer Tools

Connect an AI platform

Why use the MCP server?

Generate into an environment file

Consume a message into environment variables

Consume a private message and attachments into a folder

Create a private link from existing environment variables

One immediate command without a secret file

Access policies

Available tools

Installation

CLI reference

Connect an AI platform

​Why use the MCP server?

​Generate a password and share only its link

​Generate into an environment file

​Consume a message into environment variables

​Consume a private message and attachments into a folder

​Create a private link from existing environment variables

​One immediate command without a secret file

​Access policies

​Available tools

Installation

CLI reference

Why use the MCP server?

Generate a password and share only its link

Generate into an environment file

Consume a message into environment variables

Consume a private message and attachments into a folder

Create a private link from existing environment variables

One immediate command without a secret file

Access policies

Available tools