> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wipe.me/llms.txt
> Use this file to discover all available pages before exploring further.
# MCP server
> Let AI agents coordinate secret creation, transfer, and tool execution without receiving plaintext.
The Wipe.me MCP server gives Codex, Claude, and other local MCP hosts a safer way
to coordinate secrets. The agent can request an operation and receive status,
paths, or a private link, but the server never returns decrypted text, attachment
bytes, generated passwords, environment values, or child-process output.
It is included in the [`wipeme` CLI](https://github.com/wipe-me/cli) beginning with
[`v0.3.0-alpha.3`](https://github.com/wipe-me/cli/releases/tag/v0.3.0-alpha.3).
This release is an alpha prerelease and has not received an independent security
audit. MCP tools can consume one-time messages and write or execute locally; review
your agent host's approval prompts and the active Wipe.me access policy.
Configure ChatGPT desktop, Codex, Claude Code, or Claude Desktop.
## Why use the MCP server?
Ordinary chat-based secret handling can leave plaintext in prompts, transcripts,
tool arguments, traces, screenshots, and provider logs. With Wipe.me, the MCP host
coordinates a local operation while plaintext moves directly between Wipe.me and a
file, environment value, or approved child process.
The MCP server deliberately has no direct-read tool. Do not place literal secrets
or passphrases in MCP arguments: use private-link files, inherited environment
variables, passphrase files, or other supported local sources.
## Generate a password and share only its link
Use `generate_secret` when a human or another system needs a newly generated
password. Wipe.me generates it with operating-system cryptographic randomness,
encrypts it locally, and returns only the private link.
```json theme={null}
{
"length": 32,
"chars": "portable",
"expires_in_seconds": 3600
}
```
The agent can relay the link without learning the generated value. The recipient
opens it once through the web application or consumes it through an approved local
Wipe.me workflow.
## Generate into an environment file
Use `generate_secret_into_env_file` when a local application and a remote recipient
need the same newly generated value. The server writes the value to a private
mode-`0600` environment file and releases the link only after the file is installed
successfully.
```json theme={null}
{
"length": 32,
"chars": "portable",
"destination_file": "/workspace/private/database.env",
"environment": [
{ "name": "DATABASE_PASSWORD" }
],
"format": "shell",
"overwrite": false,
"expires_in_seconds": 3600
}
```
The agent sees the destination path and private link, not the password. A trusted
command can then source the file without printing it:
```sh theme={null}
sh -c '. /workspace/private/database.env && exec ./bin/migrate'
```
## Consume a message into environment variables
For commands that may be retried or run more than once, prefer
`consume_into_env_file`. It consumes the remote message once and maps selected text
blocks into a reusable private file without returning the values through MCP.
```json theme={null}
{
"link_file": "/workspace/private/message.link",
"destination_file": "/workspace/private/application.env",
"environment": [
{ "name": "DATABASE_PASSWORD", "block": 0 },
{ "name": "API_TOKEN", "block": 1 }
],
"format": "shell",
"overwrite": false
}
```
Run the application with the resulting variables:
```sh theme={null}
sh -c '. /workspace/private/application.env && exec ./bin/start'
```
For Docker, request `"format": "docker"`, then pass the file directly:
```sh theme={null}
docker run --rm --env-file /workspace/private/container.env example/app migrate
```
The environment file can support validation, restarts, and multiple commands
without consuming another message. Treat it as the secret: keep it outside source
control, restrict access, and delete it when it is no longer needed.
## Consume a private message and attachments into a folder
Use `consume_into_files` for configuration bundles, certificates, reports, or
other attachments. The destination directory must not already exist. Wipe.me
creates it with mode `0700` and writes message and attachment files with mode
`0600`.
```json theme={null}
{
"link_file": "/workspace/private/deployment-bundle.link",
"destination_directory": "/workspace/private/deployment-bundle",
"message_filename": "instructions.txt",
"write_message": true,
"write_attachments": true
}
```
Plaintext stays in the destination directory and is not copied into the MCP result.
Existing directories are refused, filenames are made traversal-safe, and files are
never silently overwritten.
## Create a private link from existing environment variables
Use `create_from_env` when a secret is already available to the local MCP server
process and needs to be handed off without appearing in the agent conversation.
Each requested value becomes a text block in the resulting one-time message.
```json theme={null}
{
"variables": [
{ "source": "DATABASE_PASSWORD" },
{ "source": "API_TOKEN" }
],
"expires_in_seconds": 3600
}
```
In host mode, variables must be inherited by the `wipeme mcp` process. Restricted
mode additionally requires their names in `mcp.allowed_source_env`. Missing or
empty values fail before anything is uploaded. The values never appear in the tool
result; only the private link does.
## One immediate command without a secret file
`consume_into_process_env` injects selected message blocks directly into one child
process. `generate_secret_into_process_env` similarly creates a password, uploads
it, injects it into a child, and releases the link only after an accepted exit.
Use these for deliberate one-shot execution. Prefer environment files when a
command may fail, restart, or require multiple runs. The server launches direct
commands without inserting a shell, and child output is not returned through MCP.
## Access policies
Local stdio MCP defaults to `host` access. Filesystem paths, environment names, and
commands are governed by the MCP host, operating-system account, sandbox, and
approval flow.
Use restricted mode when Wipe.me itself should enforce additional read roots,
write roots, environment-name allowlists, and administrator-defined process
profiles:
```sh theme={null}
wipeme mcp --access restricted
```
Inspect the resolved non-secret policy before connecting a host:
```sh theme={null}
wipeme mcp --show-policy
```
Restart the MCP host after changing its launcher environment or Wipe.me policy.
## Available tools
| Tool | Purpose |
| ---------------------------------- | ------------------------------------------------------------------------- |
| `inspect_private_link` | Validate link syntax locally without echoing the link |
| `generate_secret` | Generate and encrypt a password, returning only its link |
| `generate_secret_into_env_file` | Generate one password, save it locally, and return its link |
| `generate_secret_into_process_env` | Generate and inject a password into one child process |
| `create_from_files` | Encrypt a message file and attachments |
| `create_from_env` | Encrypt inherited environment values |
| `create_from_process_output` | Encrypt a command's stdout without returning it |
| `consume_into_env_file` | Map message blocks into a private environment file |
| `retry_into_env_file` | Retry local environment-file output without retrieving again |
| `consume_into_files` | Write message content and attachments into a new private directory |
| `retry_into_files` | Retry protected file output without retrieving again |
| `consume_into_process_env` | Inject message blocks into one child process |
| `retry_process_env` | Retry a retained process operation without retrieving or generating again |
| `forget_recovery` | Abandon retained recovery state safely |
| `delete_message` | Delete a message using its private capability |
Install the alpha release and connect your MCP host.
Use the same functionality directly from a terminal or script.