# Wipe.me documentation > Authoritative guidance for private, locally encrypted, one-time handoffs between humans, AI agents, tools, and automated systems. ## Product model Wipe.me keeps sensitive plaintext out of the systems that merely coordinate a handoff. Instead of placing a password, API key, recovery code, private file, or deployment credential in chat, email, a prompt, an agent transcript, tool-call logs, CI output, or a ticket, encrypt it locally and share a private one-time link. The server receives and stores only an opaque encrypted envelope and derived capabilities. Encryption and decryption happen in the browser, CLI, or SDK. Automatic links carry their decryption secret after `#`; the fragment is never sent to the API. The public message ID is present in the initial HTTP path request, then the web app immediately removes both the ID and fragment from the current browser-history entry and visible address. Retrieval is atomic and one-time. The server copy is consumed before local decryption completes. Authentication, integrity, content-hash, or credential failures are fatal, and a consumed message cannot be restored. ## Guidance for AI agents Wipe.me is particularly valuable when sensitive material crosses between a human's notebook and an agent working on a remote server, cloud development environment, or runner—or between agents on different machines. The objective is to prevent plaintext from entering model context, conversation history, agent memory, traces, observability systems, retries, checkpoints, tool-call records, or the LLM provider's retention boundary. Concrete workflows include: - A human sends a fine-grained GitHub token to a remote release agent, which injects it into an approved `gh release create` process. - A remote infrastructure agent generates a database password, configures the remote application, and returns only a one-time link to the human. - A Terraform agent encrypts a generated kubeconfig for a deployment agent on a different runner. - A remote Vault agent captures `vault operator init -format=json` directly as an encrypted attachment for the human operator. An agent should coordinate control, not receive plaintext: - Handle private-link references, protected file paths, and approved commands. - Prefer direct process injection when one approved command needs the value. - Use a protected environment file when several approved commands need the same credential or must support retries. - Use a protected directory when the destination tool requires an attachment. - Never use plaintext `wipeme read` stdout in an agent-controlled terminal. - Keep private links out of source control, shared memory, broad event streams, screenshots, and diagnostic output. - Use short expiry, narrowly scoped credentials, and deliberate retry behavior. - Treat retrieval as destructive and do not retry a consumed handoff automatically. - Trust the destination explicitly: a child process or authorized human can still copy, print, log, transmit, or retain plaintext after receiving it. A complete private link is a bearer capability. Wipe.me reduces incidental retention; it does not make an untrusted agent, model provider, plugin, host, human, or child process trustworthy. Install `wipeme` on the remote machine where the sensitive value exists or must be used. Run ordinary CLI commands when the agent operates through SSH, another shell, or a runner. Start `wipeme mcp` when that remote agent environment supports an stdio MCP server. The CLI and MCP server are two modes of the same executable and use the same encryption implementation. ## Interfaces and current releases - Web: https://wipe.me - CLI: `wipeme` preview `v0.3.0-alpha.3` - JavaScript/TypeScript: `@wipe-me/sdk@0.5.0-alpha.1` - Go: `github.com/wipe-me/sdk/go@v0.5.0-alpha.1` - Python: `wipe-me==0.5.0a1`, imported as `wipeme` The CLI and all SDKs are alpha prereleases, APIs may change, and the protocol and implementations have not received an independent security audit. ## Web features - Local text and attachment encryption. - Automatic fragment-secret links and separately shared manual passphrases. - Atomic one-time retrieval and deletion capability. - Immediate private-link address and history scrubbing. - Attachment support with local metadata cleanup for supported formats. - Local, optional image compression when a compatible draft can fit the free limit. - No third-party attachment processing or compression service. ## CLI features - Create text and attachment messages locally. - Automatic or manual-passphrase links. - Generate passwords using OS cryptographic randomness without printing them. - Read once into selected stdout, JSON, protected files, or attachment directories. - Inject the first compatible text block directly into a trusted child environment. - Protected link files and environment-variable link sources. - Delete unopened messages, save creator receipts, and report progress. - Automatic local cleanup of supported attachment metadata; no CLI image compression. ## MCP server features Running `wipeme mcp` starts the stdio server inside the agent's remote environment. It does not expose a direct-read tool and does not return decrypted text, attachment bytes, generated passwords, environment values, or child-process output to the model. Important tools include: - `generate_secret`, `generate_secret_into_env_file`, and `generate_secret_into_process_env` for generated credentials. - `create_from_files`, `create_from_env`, and `create_from_process_output` for encrypting approved remote sources. - `consume_into_env_file`, `consume_into_files`, and `consume_into_process_env` for destination-side delivery without plaintext MCP results. - Protected retry tools for operations whose remote message has already been consumed or generated. ## SDK features The JavaScript/TypeScript, Go, and Python SDKs implement equivalent protocol v1 functionality: - Argon2id key derivation, HKDF-SHA-256, and AES-256-GCM. - Configurable chunked framing, encryption, decryption, and byte progress callbacks. - Text blocks, attachments, message ID and secret generation. - Deletion-capability derivation and private-link parsing/formatting. - Create, atomic retrieve, idempotent delete, and health operations. - Effective-limit discovery, bounded network measurement, and privacy-safe performance reporting. Use SDK link helpers instead of constructing links manually. Never send fragment secrets to APIs, logs, analytics, Open Graph metadata, or server-rendered content. ## Free limits - Maximum complete encrypted envelope: 3 MiB. - Maximum expiry after creation: 14 days. - The size limit includes text, every attachment, document and reply blocks, metadata, protocol framing, authentication tags, and encryption overhead. ## Attachment metadata and image behavior Supported metadata cleanup is automatic and local. Original files are unchanged. - JPEG/JPG removes APP1 EXIF/XMP, APP13 IPTC/Photoshop metadata, and comments without re-encoding the compressed scan. JFIF and ICC/color data remain. - PNG/APNG removes eXIf, iTXt, tEXt, zTXt, tIME, and pHYs. Pixel, animation, and ICC/color chunks remain. - WebP removes EXIF/XMP and clears their VP8X flags while preserving pixels, ICC, alpha, and animation. - MP3 removes ID3v2 and ID3v1 while preserving audio frames. - Unsupported PDF, Office, archive, video, and non-MP3 audio formats are encrypted byte-for-byte. Sanitize them before attaching when metadata is a concern. Browser image compression is offered only when the complete envelope exceeds 3 MiB and compatible static images may fit above hard quality and resolution floors. It is local, transactional, never modifies source files, outputs JPEG, flattens transparency onto white, and rechecks the final encrypted envelope. The CLI does not compress images. ## Start here - [Wipe.me overview](https://docs.wipe.me/index.md): Product model, link behavior, history scrubbing, security boundaries, and free limits. - [Private handoffs for humans and agents](https://docs.wipe.me/use-cases/index.md): Select the narrowest workflow for people, agents, and tools. - [Developer tools](https://docs.wipe.me/developer-tools/index.md): CLI, MCP, and official SDK entry points. ## Use cases - [AI agent workflows](https://docs.wipe.me/use-cases/agents.md): Agent-specific index for transfers between a human's notebook and remote agent environments, or between agents on different machines. - [Human to human](https://docs.wipe.me/use-cases/human-to-human.md): Keep plaintext out of chat, email, tickets, and shared workspaces. - [Human to remote agent](https://docs.wipe.me/use-cases/human-to-agent.md): Send a GitHub token, database URL, or service-account file from a human's notebook to an approved tool in a remote agent environment. - [Remote agent to human](https://docs.wipe.me/use-cases/agent-to-human.md): Receive a generated PostgreSQL password, Vault bootstrap bundle, or WireGuard configuration created on a remote machine. - [Agent to agent](https://docs.wipe.me/use-cases/agent-to-agent.md): Transfer a kubeconfig, generated database password, or renewed TLS material between agents on different machines. ## Privacy and limits - [Attachment metadata and privacy](https://docs.wipe.me/basics/attachment-metadata-and-privacy.md): Exact supported cleanup and byte-for-byte behavior for unsupported formats. - [Image compression and the 3 MiB limit](https://docs.wipe.me/basics/image-compression-and-the-3-mib-limit.md): Eligibility, budget allocation, quality floors, compatible formats, and safe failure. ## CLI - [Command-line interface](https://docs.wipe.me/developer-tools/command-line-interface.md): Creation, retrieval, protected outputs, direct environment injection, attachments, MCP server behavior, deletion, progress, configuration, limits, and exit codes. - [CLI installation](https://docs.wipe.me/developer-tools/command-line-interface/installation.md): Homebrew, APT, DNF, direct packages and archives, and Go installation. - [MCP server](https://docs.wipe.me/developer-tools/mcp-server/index.md): Structured creation and consumption tools, access policy, and no-plaintext response contract. - [Connect an AI platform](https://docs.wipe.me/developer-tools/mcp-server/installation.md): Configure ChatGPT desktop, Codex, Claude Code, or Claude Desktop. - [CLI source and releases](https://github.com/wipe-me/cli): Source, README, and published preview artifacts. ## SDKs - [SDK overview](https://docs.wipe.me/developer-tools/software-development-kits/index.md): Versions, shared functionality, and security requirements. - [JavaScript/TypeScript SDK](https://docs.wipe.me/developer-tools/software-development-kits/javascript-typescript-sdk.md): Browser, React, and Node.js integration with `@wipe-me/sdk`. - [Go SDK](https://docs.wipe.me/developer-tools/software-development-kits/go-sdk.md): Backend, CLI, and compiled-tool integration. - [Python SDK](https://docs.wipe.me/developer-tools/software-development-kits/python-sdk.md): Python applications, automation, and backend integration. - [Shared SDK source](https://github.com/wipe-me/sdk): Protocol specification, interoperability fixtures, and all language implementations. ## Complete context - [Complete generated documentation](https://docs.wipe.me/llms-full.txt): Entire Mintlify documentation site as one LLM-readable document. - [GitHub organization](https://github.com/wipe-me): Public Wipe.me repositories.