> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wipe.me/llms.txt
> Use this file to discover all available pages before exploring further.
# Human to remote agent
> Send credentials from your notebook to tools running in a remote agent environment without pasting plaintext into the conversation.
You ask Claude Code, Codex, or another coding agent to work on a remote server,
cloud development environment, or build runner. The work needs a credential that you
hold on your notebook: perhaps a GitHub token, database connection URL, or service
account file.
Instead of pasting that value into the agent conversation, create a Wipe.me message
and send the private link. The `wipeme` executable on the remote machine retrieves
the message once and places its contents directly into an approved environment file,
process, or protected directory. The model receives the link and completion status,
not the plaintext.
## How the handoff works
1. You create a Wipe.me message or attachment on your notebook.
2. You paste its private link into the Claude Code, Codex, or other agent
conversation controlling the remote machine.
3. The remote agent asks `wipeme` to consume the message into the destination needed
by the tool.
4. The tool uses the credential on the remote machine.
5. The private link stops working after its one-time retrieval.
Until retrieval, an automatic private link is a bearer credential. Anyone with the
complete link can attempt to open the message. For a less-trusted conversation
channel, use Custom mode and provide its passphrase to `wipeme` through a separate
approved source.
## Publish a GitHub release with a fine-grained token
You ask a remote coding agent to build version `v1.4.0` and publish the resulting
archives to a GitHub release. The build machine has the repository, but it does not
store a GitHub token with permission to create releases.
> Use this Wipe.me link as `GH_TOKEN` only for the approved `gh release create`
> operation. Publish the `v1.4.0` artifacts without displaying or saving the token.
On the remote machine, the [Wipe.me MCP server](/developer-tools/mcp-server) uses
`consume_into_process_env` to retrieve the first encrypted text block and inject it
as `GH_TOKEN` into the approved GitHub CLI process. The process receives the token;
the MCP result returned to the agent contains only execution status.
This is appropriate for a short-lived, fine-grained token scoped to the required
repository and release permission. After the release, revoke the token or let its
configured expiry end.
## Run a PostgreSQL migration with a connection URL
Your managed database provider gives you a production `DATABASE_URL`. A remote agent
has prepared a Prisma migration and needs to apply it from the application server.
> Save the first block from this Wipe.me link as `DATABASE_URL` in the approved
> migration environment file. Run `npx prisma migrate deploy`, then remove the file
> when validation is complete. Do not print the URL.
The remote MCP server uses `consume_into_env_file` to write a mode-`0600`
environment file. The agent can pass that file to the migration workflow and retry
validation without retrieving the one-time message again. Wipe.me does not return
the connection URL through MCP.
Use an environment file when several approved commands need the same credential.
Treat the file as the consumed secret: keep it outside the repository, restrict its
permissions, and remove it after the migration workflow no longer needs it.
## Deliver a Firebase service-account file to a build agent
You need a remote build agent to deploy Firebase resources using a service-account
JSON file stored on your notebook. The agent needs the file at a known protected
path, but its contents do not belong in the task transcript.
> Save the JSON attachment from this Wipe.me link into the approved private
> credentials directory. Use that path as `GOOGLE_APPLICATION_CREDENTIALS` for the
> Firebase deployment. Do not open, summarize, or print the file.
The remote MCP server uses `consume_into_files` to create a new mode-`0700`
directory and write the attachment there without returning its bytes to the agent.
The deployment tool receives the file path. After deployment, remove the local copy
according to the build environment's credential-retention policy.
This workflow keeps file contents out of the intended MCP response and agent
conversation. It does not make a remote machine or an agent with unrestricted
filesystem access trustworthy. Use a controlled build environment and grant only
the access required for the deployment.
## Choose how to run `wipeme` remotely
Install the same Wipe.me CLI package and `wipeme` executable on the machine where
the agent performs the work.
| How the agent works remotely | How to run `wipeme` there |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| The remote agent environment supports an stdio MCP server | Start `wipeme mcp` and use `consume_into_process_env`, `consume_into_env_file`, or `consume_into_files` |
| The agent controls the machine through SSH or another shell | Run ordinary `wipeme exec` or `wipeme read --output` commands in that shell |
| A CI runner performs the operation | Run an ordinary `wipeme` CLI command inside the protected job environment |
MCP and ordinary CLI commands are two modes of the same executable. In both cases,
run `wipeme` on the remote machine where the credential must be used.
Configure structured Wipe.me tools in a compatible remote agent environment.
Install `wipeme` on a remote server, shell, or runner.
## Keep the exposure narrow
* Use a short message expiry and narrowly scoped, short-lived credentials.
* Prefer direct process injection when only one approved command needs the value.
* Use a protected environment file only when the workflow needs retries or several
commands.
* Keep credential files outside source control, agent indexing, previews, and build
artifacts.
* Never use plaintext `wipeme read` output in an agent-controlled terminal.
* Trust the destination tool: after injection, that process can store, transmit, or
print the credential according to its own behavior.