exec_with_secrets
Run a child shell command with project secrets injected as environment variables, automatically redacting leaked values from stdout and stderr so credentials never appear in chat.
Instructions
[exec] Run a child shell command with project secrets injected as environment variables and any leaked secret values redacted from captured stdout/stderr before they return to the agent. Use to let an agent run a script that needs credentials (npm run db:migrate, terraform plan, vercel deploy) without ever putting plaintext values in the chat; prefer env_generate if you need to write a .env file to disk and validate_secret for upstream liveness checks. Spawns a real child process — has whatever side effects the command itself causes (writes, network, exec). Subject to BOTH tool policy and exec policy (allowlist/denylist). Returns a text body with Exit code: N then STDOUT: and STDERR: blocks; both streams are scrubbed against the secret values that were injected (verbatim; base64/hex/URL/JSON-encoded for values up to 256 chars; 16+ char slices of each credential part, skipping credential parts longer than 1024 chars, where a whole opaque value counts as one part). A scrubbed value reads [QRING:REDACTED:<KEY_NAME>], naming the keyring key it came from. Which secrets are injected: when the project's .q-ring.json declares a secrets manifest, only the declared keys (intersected with keys); without one, only credential-shaped names (…_KEY, …_TOKEN, …_SECRET, …_PASSWORD, …_URL, …DSN, ...), and the result ends with a NOTE naming the skipped keys. On every path, keys named like process-control variables (NODE_OPTIONS, LD_PRELOAD, GIT*, MAVEN_OPTS, ...) or that are not plain identifiers are never injected.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | Positional arguments passed to `command`. Example: ['run', 'db:migrate']. Each element is passed verbatim with no extra shell parsing. | |
| keys | No | Whitelist of exact key names to inject. Omit to inject every allowed secret (the manifest's keys when the project declares one, else the credential-shaped names in scope; subject to `tags`). | |
| tags | No | Inject only secrets carrying at least one of these tags. Combinable with `keys` as an AND filter. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| command | Yes | Executable name or full command to run. Example: 'pnpm', 'node', '/usr/bin/env'. Must be allowed by exec policy. | |
| profile | No | Exec sandbox profile. 'restricted' (default) denies network-tool binaries (curl, wget, ssh, scp, nc, netcat, ncat) AND common interpreters/shells (python, node, deno, bun, perl, ruby, php, sh, bash, zsh) — since those could otherwise egress the injected secrets — strips proxy env vars, and caps runtime at 30s. It still is NOT a real OS sandbox (it does not restrict PATH, and some allowed binary could in principle make network calls); for genuinely untrusted commands use OS-level isolation (containers, network namespaces). 'ci' allows network and interpreters with a 300s cap and blocks a few destructive commands; 'unrestricted' inherits the full server environment. Define a custom profile in .q-ring.json to allow specific interpreters with secrets. | restricted |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |