Skip to main content
Glama

Runtime Cloud

by com.withruntime
OverviewDiscussionsAdmin

runtime_secrets

Destructive

Secrets such as API keys: sandboxes see a placeholder, and the egress proxy adds the value on HTTPS to the hosts you name. set(name, value, hosts, header?, format?, rules?, only?): Store or replace one. Sandboxes see a placeholder in the environment variable of this name; the egress proxy swaps in the value in a credential header (Authorization, x-api-key and the like) of HTTPS requests to hosts, or sets header on each; never in the URL or another header. rules (an account with credit) limit it by method and path. only limits which sandboxes get it, by label selectors and/or ids. The value is never returned. list: Names, hosts, header and placeholder; never values. delete(name): Erase one by name; its placeholder stops being replaced. It does not revoke the key at its provider. jobs_ actions: the copy a scheduled job puts in its run's environment. Bind one with runtime_jobs create input.secrets: [{name: ENV_NAME, secretId}]. It belongs to the person whose key stored it and is versioned; a deleted name cannot be reused. put stores a new name; rotate replaces the value (expectedVersion); delete stops future use, not the provider's token; reveal shows a value and needs its own permission, so prefer binding.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idNo
nameNoThe environment variable the placeholder is in, inside every sandbox of the organization. Upper case letters, digits and underscores.
onlyNoOptional. Which sandboxes get the secret: those matching labels, and those named in sandboxes. Any other sandbox of the organization sees no placeholder and its requests never carry the value. {} gives it back to every sandbox. Absent when replacing a secret: the scope it has stays, so a new value never widens who gets it. Absent on a new secret: every sandbox, as before.
afterNo
hostsNoWhere the value may go. The proxy puts it only into HTTPS requests to these hosts.
limitNo
rulesNoOptional, for an account with credit. The value goes only into requests a rule allows, by method and path. A request whose path could be read two ways (an encoded slash, a semicolon, a backslash) gets no secret that has rules. Absent: every request to the hosts. Replacing a secret without rules clears them.
valueNoThe secret. Visible ASCII and spaces, at most 8 KiB. Stored sealed and never returned.
actionYes
formatNoOptional, with header. The header's value, with {value} where the secret goes. Default "{value}".
headerNoOptional. Set this header on every request to the hosts, replacing one the sandbox sent, so code needs no placeholder at all; the value then goes into this header and nowhere else. Without it, the placeholder is replaced only in a credential header: Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token.
versionNo
idempotencyKeyNoOptional: left out, one is made and returned as idempotencyKey. Send it back only to retry this exact call after a temporary error.
expectedVersionNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / properties / only
      Added value: +{
+  "additionalProperties": false,
+  "description": "Optional. Which sandboxes get the secret: those matching labels, and those named in sandboxes. Any other sandbox of the organization sees no placeholder and its requests never carry the value. {} gives it back to every sandbox. Absent when replacing a secret: the scope it has stays, so a new value never widens who gets it. Absent on a new secret: every sandbox, as before.",
+  "properties": {
+    "labels": {
+      "description": "Sandboxes whose labels match any one of these selectors get the secret, including ones created or labelled later.",
+      "items": {
+        "additionalProperties": {
+          "type": "string"
+        },
+        "description": "A selector: a sandbox whose labels hold every one of these key/value pairs.",
+        "minProperties": 1,
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "sandboxes": {
+      "description": "These sandboxes (ids of this organization's sandboxes) get the secret.",
+      "items": {
+        "format": "uuid",
+        "type": "string"
+      },
+      "type": "array"
+    }
+  },
+  "type": "object"
+}
  2. Changed2 schema fields changed
    • changedInput schema / properties / header / description
      Previous value: -"Optional. Set this header on every request to the hosts, replacing one the sandbox sent, so code needs no placeholder at all."New value: +"Optional. Set this header on every request to the hosts, replacing one the sandbox sent, so code needs no placeholder at all; the value then goes into this header and nowhere else. Without it, the placeholder is replaced only in a credential header: Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token, private-token."
    • changedInput schema / properties / rules / items / properties / paths / description
      Previous value: -"Exact paths, or prefixes ending in /* for every path under them. Written canonically: starting with /, no . or .. segments, no ; or \\, no encoded slash."New value: +"Exact paths, or prefixes ending in /* for every path under them. Written canonically: starting with /, no . or .. segments, no ; or \\, no encoded slash. An escaped character other than a letter, digit, -, ., _ or ~ matches only the same escape: a client that sends %3A needs a rule with %3A, not :."
  3. Changed1 schema field changed
    • changedInput schema / properties / rules / description
      Previous value: -"Optional, paid accounts only. The value goes only into requests a rule allows, by method and path. A request whose path could be read two ways (an encoded slash, a semicolon, a backslash) gets no secret that has rules. Absent: every request to the hosts. Replacing a secret without rules clears them."New value: +"Optional, for an account with credit. The value goes only into requests a rule allows, by method and path. A request whose path could be read two ways (an encoded slash, a semicolon, a backslash) gets no secret that has rules. Absent: every request to the hosts. Replacing a secret without rules clears them."
  4. Changed1 schema field changed
    • changedInput schema / properties / idempotencyKey / description
      Previous value: -"Unique per call; reuse it only to retry this exact call after a lost reply or a temporary error."New value: +"Optional: left out, one is made and returned as idempotencyKey. Send it back only to retry this exact call after a temporary error."
  5. Changed7 schema fields changed
    • changedInput schema / properties / action / enum
      Previous value: -[
-  "set",
-  "list",
-  "delete"
-]New value: +[
+  "set",
+  "list",
+  "delete",
+  "jobs_list",
+  "jobs_get",
+  "jobs_put",
+  "jobs_rotate",
+  "jobs_delete",
+  "jobs_reveal"
+]
    • addedInput schema / properties / after
      Added value: +{
+  "type": "string"
+}
    • addedInput schema / properties / expectedVersion
      Added value: +{
+  "maximum": 2147483646,
+  "minimum": 1,
+  "type": "integer"
+}
    • addedInput schema / properties / id
      Added value: +{
+  "type": "string"
+}
    • addedInput schema / properties / idempotencyKey
      Added value: +{
+  "description": "Unique per call; reuse it only to retry this exact call after a lost reply or a temporary error.",
+  "type": "string"
+}
    • addedInput schema / properties / limit
      Added value: +{
+  "maximum": 100,
+  "minimum": 1,
+  "type": "integer"
+}
    • addedInput schema / properties / version
      Added value: +{
+  "maximum": 2147483646,
+  "minimum": 1,
+  "type": "integer"
+}
  6. Added

TDQS

Score is being calculated.

All Runtime Cloud toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources