AI Workflows

Sirr gives every secret a death clock. These patterns show how to use ephemeral secrets with AI agents, CI/CD pipelines, distributed teams, and short-lived contractor engagements.

Claude Code + MCP

The fastest way to give Claude direct access to your secrets vault. Install the MCP server, configure it once, and Claude can push and retrieve secrets without you ever pasting credentials into a chat window.

Setup

npm install -g @sirr/mcp

Add the Sirr MCP server to your project's .mcp.json:

{
  "mcpServers": {
    "sirr": {
      "command": "sirr-mcp",
      "env": {
        "SIRR_SERVER": "http://localhost:39999",
        "SIRR_TOKEN": "your-token"
      }
    }
  }
}

Example conversation

❯ set the BITBUCKET_TOKEN to 123asdzxc

⏺ sirr-mcp - push_secret (MCP)(key: "BITBUCKET_TOKEN", value: "123asdzxc", max_reads: 1)
  ⎿  Stored secret 'BITBUCKET_TOKEN'. Burns after 1 read.

⏺ Stored. Burns after first read.

❯ deploy to staging using sirr:BITBUCKET_TOKEN

⏺ sirr-mcp - get_secret (MCP)(key: "BITBUCKET_TOKEN")
  ⎿  123asdzxc

⏺ Got it. Deploying to staging with the token. Done.

❯ what is the BITBUCKET_TOKEN?

⏺ sirr-mcp - get_secret (MCP)(key: "BITBUCKET_TOKEN")
  ⎿  Secret 'BITBUCKET_TOKEN' not found, expired, or already burned.

⏺ The secret no longer exists on the server.

Python agents

AI agent frameworks like LangChain and CrewAI often need database credentials, API keys, or service tokens. Instead of hardcoding them or storing them in long-lived environment variables, push one-time secrets that self-destruct after the agent reads them.

import os
from sirr import SirrClient

sirr = SirrClient(
    server="http://localhost:39999",
    token=os.environ["SIRR_TOKEN"],
)

# Push a one-time credential for the agent
sirr.push(
    "DB_URL",
    "postgres://user:pass@db:5432/app",
    reads=1,
    ttl=3600,
)

# Agent reads it -- credential is gone
secret = sirr.get("DB_URL")
print(secret.value)
# Any subsequent read will fail

LangChain tool example

from langchain.tools import tool
from sirr import SirrClient

sirr = SirrClient(
    server="http://localhost:39999",
    token=os.environ["SIRR_TOKEN"],
)

@tool
def get_database_url() -> str:
    """Retrieve the database URL. This is a one-time credential."""
    secret = sirr.get("DB_URL")
    return secret.value

CI/CD one-time tokens

Push a deploy token before the pipeline runs. The token is read exactly once during deployment and then ceases to exist. If the pipeline is replayed or an attacker intercepts the logs, the token is already gone.

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      SIRR_SERVER: ${{ secrets.SIRR_SERVER }}
      SIRR_TOKEN: ${{ secrets.SIRR_TOKEN }}
    steps:
      - name: Push one-time deploy token
        run: |
          sirr push DEPLOY_TOKEN="${{ secrets.DEPLOY_TOKEN }}" \
            --reads 1 \
            --ttl 5m

      - name: Deploy
        run: |
          export DEPLOY_TOKEN="$(sirr get DEPLOY_TOKEN)"
          ./deploy.sh

      # DEPLOY_TOKEN is already burned --
      # replaying this job will fail at the get step

Team .env sync

Share a complete development environment with a teammate without sending credentials over Slack, email, or git. Push your .env file with a short TTL, share the Sirr server address, and let them pull it.

sirr push .env --ttl 24h

export SIRR_SERVER="http://your-sirr-server:39999"
export SIRR_TOKEN="shared-token"

sirr pull .env

Contractor access

When onboarding a contractor, push the credentials they need with a TTL that matches the engagement. When the engagement ends, the credentials expire automatically -- no manual revocation, no forgotten service accounts.

# Push credentials that expire in 14 days
sirr push STAGING_API_KEY="sk-contractor-abc" \
  --ttl 14d

sirr push STAGING_DB_URL="postgres://..." \
  --ttl 14d

# Contractor pulls on their machine
# 14 days later -- credentials are gone

If the engagement ends early, revoke access immediately:

sirr delete STAGING_API_KEY
sirr delete STAGING_DB_URL

Security mental model

The secret is born dying.

Traditional secret management treats credentials as long-lived assets to protect. Sirr inverts this: credentials are liabilities to eliminate. Every secret has a death clock from the moment it is created.

The core principle: reduce the window of exposure. A secret that exists for 5 minutes is a smaller liability than one that exists for 5 years. A secret that can be read once is a smaller liability than one with unlimited reads.