Some tasks need a credential briefly
An agent may need a temporary test token to run a deployment check or connect to a sandbox. A one-time message can reduce how long the share remains available, but it does not make the agent a protected or isolated recipient.
Use only credentials safe for this task
Prefer a disposable, narrowly scoped credential with a short lifetime. Confirm what tools, logs, memory, plugins, and external services the agent can access. KeySlip’s local MCP process exposes `send_secret` and `read_secret` over stdio; the agent and the local process can see plaintext when a read occurs.
Encrypt locally and keep the link private
Send a short, task-specific message through the browser, CLI, API client, or local MCP workflow. KeySlip uses AES-256-GCM locally. An optional extra password is derived using PBKDF2-HMAC-SHA256 with 600,000 iterations; pass it separately and only if your workflow handles it safely. The link’s # fragment contains the decryption key.
Make the read explicit and informed
Tell the agent what credential it is about to receive and what it may use it for. Read only after you are ready for the plaintext to enter the agent’s context. A read consumes the stored message even if the connection fails, times out, decryption fails, or the page closes. Never configure an automatic retry for a read.
End the underlying access at its source
The agent may retain, summarize, or expose plaintext according to its runtime and connected tools. Review the task output and logs. Revoke or rotate the credential in the system that issued it when the task ends. Expiring or deleting a KeySlip message does not revoke a credential already read.
Review integration and security details
See API & agents for local MCP configuration, and Security explained for what encryption protects and its limits. Teams evaluating a shared workflow can request the Teams pilot.