Skip to main content
Glama

List secrets

secrets_list
Read-onlyIdempotent

Items are ordered by created_at descending, then id descending. Without an owner filter, returns the deduplicated union of organization secrets the caller may list, project secrets the caller may list, and the caller's own user secrets.

Input Schema

NameRequiredDescriptionDefault
kindNoFilter secrets by material kind.
nameNoCase-insensitive glob over the list's logical name. `*` matches zero or more characters, `?` matches one character, and `\` escapes a wildcard.
sortNoSort order for named resources that expose created and modified timestamps.
limitNoMaximum number of items to return in one page.
orgIDYesOrganization ID (org_...).
cursorNoOpaque pagination cursor from a previous response's next_cursor. Omit for the first page.
metadataNoMetadata key/value filters, encoded as metadata[key]=value.
owner_kindNoFilter by the immutable owner kind.
owner_project_idNoRequired with owner_kind=project and invalid with other owner kinds.
mcp_oauth_flow_idNoFilter to secrets that have a version created by this MCP OAuth flow.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / properties / orgID / description
      Added value: +"Organization ID (org_...)."
  2. First observed

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), so the description adds real value beyond them: a deterministic ordering guarantee (created_at desc, then id desc) and permission-scoped, deduplicated default result semantics. It does not cover pagination behavior, but with annotations present this is a solid contribution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, no filler, every clause carrying load-bearing information about ordering and default scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter listing tool with no output schema, the description covers default scope and ordering but says nothing about pagination results (next_cursor, limit interaction) or the filter dimensions, leaving the agent to infer those from the schema alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description resolves something the schema leaves implicit: the default sort order applied when the sort parameter is omitted, which is meaningful for an agent deciding whether to pass sort.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The name/title pair (secrets_list / List secrets) plus the description's scope statement make it clear this enumerates secrets in an org, and the 'deduplicated union of organization, project, and user secrets' line distinguishes it from a single-scope read. However, the description never states the plain verb+resource itself and does not distinguish this from the similarly named sibling grant_secrets_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies when the default scope applies ('without an owner filter...'), which nudges the agent toward owner_kind for narrowing, but it gives no explicit when-to-use/when-not guidance and never names an alternative such as secrets_get or grant_secrets_list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.