Skip to main content
Glama

q-ring

OS keychain secrets for AI coding agents, over MCP.

CI NPM Version NPM Downloads Docs MCP Tools Smithery Cursor Directory PulseMCP mcpservers.org License Discord YouTube X

Stop pasting API keys into plain-text .env files or wrestling with clunky secret managers. q-ring securely anchors your credentials to your OS's native vault (macOS Keychain, Linux Secret Service, Windows Credential Vault) and supercharges them with mechanics from quantum physics.

📖 View the Official Documentation for a complete CLI reference, MCP prompt cookbooks, and architecture details.

Why q-ring?

  • Superposition: Store one key with multiple states (dev/staging/prod) that collapse based on context.

  • Entanglement: Link keys across projects so rotating one automatically updates them all.

  • Tunneling: Create ephemeral, in-memory secrets that self-destruct after a set time or read count.

  • Teleportation: Securely pack and share AES-256-GCM encrypted secret bundles.

  • Seamless AI Integration: 44 built-in MCP tools for native use in Cursor, Kiro, and Claude Code.

🚀 Installation

q-ring is designed to be installed globally so it's available anywhere in your terminal. Pick your favorite package manager:

# pnpm (recommended)
pnpm add -g @i4ctime/q-ring

# npm
npm install -g @i4ctime/q-ring

# yarn
yarn global add @i4ctime/q-ring

# Homebrew (macOS / Linux)
brew install i4ctime/tap/qring

Docker (MCP server)

The repo ships a Dockerfile that builds the MCP server and exposes it through mcp-proxy — useful for hosted MCP deployments (e.g. Glama) or keeping the server off the host entirely:

git clone https://github.com/I4cTime/q-ring.git
cd q-ring
docker build -t qring-mcp .
docker run --rm -p 8080:8080 qring-mcp

Note: inside a container there is no OS keychain (GNOME Keyring / macOS Keychain), so this path is for the MCP protocol surface, ephemeral use, and CI experiments — not for durable local secret storage. For day-to-day use install the CLI natively via one of the package managers above.

Related MCP server: Vaulted MCP Server

⚡ Quick Start

# 1️⃣ Store a secret (prompts securely if value is omitted)
qring set OPENAI_API_KEY sk-...

# 2️⃣ Retrieve it anytime
qring get OPENAI_API_KEY

# 3️⃣ List all keys (values are never shown)
qring list

# 4️⃣ Generate a cryptographic secret and save it
qring generate --format api-key --prefix "sk-" --save MY_KEY

# 5️⃣ Run a full health scan
qring health

# Something not working? Diagnose the install (keyring, audit, MCP wiring)
qring doctor

# Tab completion for your shell
qring completion zsh > ~/.zsh/completions/_qring   # also: bash, fish

Quantum Features

Superposition — One Key, Multiple Environments

A single secret can hold different values for dev, staging, and prod simultaneously. The correct value resolves based on your current context.

# Set environment-specific values
qring set API_KEY "sk-dev-123" --env dev
qring set API_KEY "sk-stg-456" --env staging
qring set API_KEY "sk-prod-789" --env prod

# Value resolves based on context
QRING_ENV=prod qring get API_KEY   # → sk-prod-789
QRING_ENV=dev  qring get API_KEY   # → sk-dev-123

# Inspect the quantum state
qring inspect API_KEY

Wavefunction Collapse — Smart Environment Detection

q-ring auto-detects your environment without explicit flags. Resolution order:

  1. --env flag

  2. QRING_ENV environment variable

  3. NODE_ENV environment variable

  4. Git branch heuristics (main/master → prod, develop → dev)

  5. .q-ring.json project config

  6. Default environment from the secret

# See what environment q-ring detects
qring env

# Project config (.q-ring.json)
echo '{"env": "staging", "branchMap": {"release/*": "staging"}}' > .q-ring.json

Quantum Decay — Secrets with TTL

Secrets can have a time-to-live. Expired secrets are blocked from reads. Stale secrets (75%+ lifetime) trigger warnings.

# Set a secret that expires in 1 hour
qring set SESSION_TOKEN "tok-..." --ttl 3600

# Set with explicit expiry
qring set CERT_KEY "..." --expires "2026-06-01T00:00:00Z"

# Health check shows decay status
qring health

Observer Effect — Audit Everything

Every secret read, write, and delete is logged with a tamper-evident hash chain. Access patterns are tracked for anomaly detection.

# View audit log
qring audit
qring audit --key OPENAI_KEY --limit 50

# Detect anomalies (burst access, unusual hours, chain tampering)
qring audit --anomalies

# Verify audit chain integrity
qring audit:verify

# Export audit log
qring audit:export --format json --since 2026-03-01
qring audit:export --format csv --output audit-report.csv

Quantum Noise — Secret Generation

Generate cryptographically strong secrets in common formats.

qring generate                          # API key (default)
qring generate --format password -l 32  # Strong password
qring generate --format uuid            # UUID v4
qring generate --format token           # Base64url token
qring generate --format hex -l 64       # 64-byte hex
qring generate --format api-key --prefix "sk-live-" --save STRIPE_KEY

Entanglement — Linked Secrets

Link secrets across projects. When you rotate one, all entangled copies update automatically.

# Entangle two secrets
qring entangle API_KEY API_KEY_BACKUP

# Now updating API_KEY also updates API_KEY_BACKUP
qring set API_KEY "new-value"

# Unlink entangled secrets
qring disentangle API_KEY API_KEY_BACKUP

Tunneling — Ephemeral Secrets

Create secrets that exist only in memory. They never touch disk. Optional TTL and max-read self-destruction.

# Create an ephemeral secret (returns tunnel ID)
qring tunnel create "temporary-token-xyz" --ttl 300 --max-reads 1

# Read it (self-destructs after this read)
qring tunnel read tun_abc123

# List active tunnels
qring tunnel list

Teleportation — Encrypted Sharing

Pack secrets into AES-256-GCM encrypted bundles for secure transfer between machines. Keys are derived with PBKDF2-HMAC-SHA512 (210 000 iterations) from your passphrase; each bundle records its iteration count, so bundles produced by older versions still unpack.

# Pack secrets (prompts for passphrase)
qring teleport pack --keys "API_KEY,DB_PASS" > bundle.txt

# On another machine: unpack (prompts for passphrase)
cat bundle.txt | qring teleport unpack

# Preview without importing
qring teleport unpack <bundle> --dry-run

Import — Bulk Secret Ingestion

Import secrets from .env files directly into q-ring. Supports standard dotenv syntax including comments, quoted values, and escape sequences. The CLI accepts either a file path or raw content; the import_dotenv MCP tool only accepts raw content (it never reads files from disk) so an agent can't coerce it into reading arbitrary local files.

# Import all secrets from a .env file
qring import .env

# Import to project scope, skipping existing keys
qring import .env --project --skip-existing

# Preview what would be imported
qring import .env --dry-run

Selective Export

Export only the secrets you need using key names or tag filters.

# Export specific keys
qring export --keys "API_KEY,DB_PASS,REDIS_URL"

# Export by tag
qring export --tags "backend"

# Combine with format
qring export --keys "API_KEY,DB_PASS" --format json

Secret Search and Filtering

Filter qring list output by tag, expiry state, or key pattern.

# Filter by tag
qring list --tag backend

# Show only expired secrets
qring list --expired

# Show only stale secrets (75%+ decay)
qring list --stale

# Glob pattern on key name
qring list --filter "API_*"

# Script-friendly existence check (exit 0 if present, 1 if not; decay-aware)
qring has OPENAI_API_KEY --quiet && echo "configured"

Project Secret Manifest

Declare required secrets in .q-ring.json and validate project readiness with a single command.

# Validate project secrets against the manifest
qring check

# See which secrets are present, missing, expired, or stale
qring check --project-path /path/to/project

Env File Sync

Generate a .env file from the project manifest, resolving each key from q-ring with environment-aware superposition collapse.

# Generate to stdout
qring env:generate

# Write to a file
qring env:generate --output .env

# Force a specific environment
qring env:generate --env staging --output .env.staging

Secret References & Least-Privilege Run

A qring:// reference is a committable pointer to a secret — it goes in your .env file instead of the value. qring run resolves references and manifest keys at spawn time, injecting only what the project declares (unlike exec, which injects the whole scope). Output is auto-redacted.

# .env — safe to commit: these are references, not values
DATABASE_URL=qring://project/DATABASE_URL
OPENAI_API_KEY=qring://global/OPENAI_API_KEY
STRIPE_KEY=qring:///STRIPE_KEY            # auto scope: project, then global
SESSION_TTL=3600                          # plain values pass through

# Run with declared secrets injected (manifest + .env refs)
qring run -- pnpm dev

# Preview what would be injected, without running
qring run --dry-run -- pnpm dev

# Pin an environment, use a specific env file, or skip the manifest
qring run --env prod --env-file .env.prod --no-manifest -- ./deploy.sh

The key lives in the path, never the host (qring://project/KEY, not qring://KEY) — URL hosts are case-insensitive, and env-var keys are not. Malformed references fail loudly instead of leaking a literal qring://… string into the child. A reference pinned to an environment: qring://project/DATABASE_URL?env=prod.

Editor Setup

Wire the q-ring MCP server into an editor's MCP config with one command. Merges non-destructively — other servers are preserved, and an existing q-ring entry is only replaced with --force.

qring setup cursor          # .cursor/mcp.json (project) or --global for ~/.cursor
qring setup kiro            # .kiro/settings/mcp.json, with read-only autoApprove list
qring setup claude          # .mcp.json (project scope)

# Preview without writing
qring setup cursor --dry-run

Push to Deployment Platforms

Push manifest secrets to GitHub Actions, Vercel, or Cloudflare Workers through each platform's own authenticated CLI (gh / vercel / wrangler) — q-ring never holds platform tokens, and values travel over stdin, never argv. Every push is recorded in the audit chain.

# Push the .q-ring.json manifest keys to GitHub Actions secrets
qring push github --repo you/your-app

# Push to Vercel environments
qring push vercel --vercel-env production,preview

# Push to Cloudflare Workers secrets
qring push cloudflare

# Explicit keys, preview first
qring push github --keys DATABASE_URL,API_KEY --dry-run

Secret Liveness Validation

Test if a secret is actually valid with its target service. q-ring auto-detects the provider from key prefixes (sk- → OpenAI, ghp_ → GitHub, etc.) or accepts an explicit provider name.

# Validate a single secret
qring validate OPENAI_API_KEY

# Force a specific provider
qring validate SOME_KEY --provider stripe

# Validate all secrets with detectable providers
qring validate --all

# Only validate manifest-declared secrets
qring validate --all --manifest

# List available providers
qring validate --list-providers

Built-in providers: OpenAI, Anthropic, OpenRouter, Google AI (Gemini), Groq, Hugging Face, ElevenLabs*, Vercel*, Stripe, GitHub, AWS (format check), Generic HTTP. Keys are only ever sent in headers, never URLs. (*no safe public prefix — select explicitly with --provider or the manifest provider field.)

Output:

  ✓ OPENAI_API_KEY   valid    (openai, 342ms)
  ✗ STRIPE_KEY       invalid  (stripe, 128ms) — API key has been revoked
  ⚠ AWS_ACCESS_KEY   error    (aws, 10002ms) — network timeout
  ○ DATABASE_URL     unknown  — no provider detected

Hooks — Callbacks on Secret Change

Register webhooks, shell commands, or process signals that fire when secrets are created, updated, or deleted. Supports key matching, glob patterns, tag filtering, and scope constraints.

# Run a shell command when a secret changes
qring hook add --key DB_PASS --exec "docker restart app"

# POST to a webhook on any write/delete
qring hook add --key API_KEY --url "https://hooks.example.com/rotate"

# Trigger on all secrets tagged "backend"
qring hook add --tag backend --exec "pm2 restart all"

# Signal a process when DB secrets change
qring hook add --key-pattern "DB_*" --signal-target "node"

# List all hooks
qring hook list

# Remove a hook
qring hook remove <id>

# Enable/disable
qring hook enable <id>
qring hook disable <id>

# Dry-run test a hook
qring hook test <id>

Hooks are fire-and-forget: a failing hook never blocks secret operations. The hook registry is stored at ~/.config/q-ring/hooks.json.

SSRF protection: HTTP hook URLs targeting private/loopback IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7) are blocked by default. DNS is checked up front and re-validated at connect time, so a hostname can't pass the check then rebind to a private address before the socket opens. To allow hooks targeting local services (e.g. during development), set the environment variable Q_RING_ALLOW_PRIVATE_HOOKS=1.

Configurable Rotation

Set a rotation format per secret so the agent auto-rotates with the correct value shape.

# Store a secret with rotation format metadata
qring set STRIPE_KEY "sk-..." --rotation-format api-key --rotation-prefix "sk-"

# Store a password with password rotation format
qring set DB_PASS "..." --rotation-format password

Secure Execution & Auto-Redaction

Run commands with secrets securely injected into the environment. All known secret values are automatically redacted from stdout and stderr to prevent leaking into terminal logs or agent transcripts. Exec profiles restrict which commands may be run.

# Execute a deployment script with secrets injected
qring exec -- npm run deploy

# Inject only specific tags
qring exec --tags backend -- node server.js

# Run with a restricted profile (blocks network tools and interpreters/shells, 30s timeout)
qring exec --profile restricted -- npm test

Codebase Secret Scanner

Migrating a legacy codebase? Quickly scan directories for hardcoded credentials using regex heuristics and Shannon entropy analysis.

# Scan current directory
qring scan .

Output:

  ✗ src/db/connection.js:12
    Key:     DB_PASSWORD
    Entropy: 4.23
    Context: const DB_PASSWORD = "..."

Composite / Templated Secrets

Store complex connection strings that dynamically resolve other secrets. If DB_PASS rotates, DB_URL is automatically correct without manual updates.

qring set DB_USER "admin"
qring set DB_PASS "supersecret"
qring set DB_URL "postgres://{{DB_USER}}:{{DB_PASS}}@localhost/mydb"

# Resolves embedded templates automatically
qring get DB_URL 
# Output: postgres://admin:supersecret@localhost/mydb

User Approvals (Zero-Trust Agent)

Protect sensitive production secrets from being read autonomously by the MCP server without explicit user approval. Each approval token is HMAC-verified, scoped, reasoned, and time-limited. The gate applies to bulk reads too — export_secrets and teleport_pack over MCP skip approval-protected keys that lack a valid grant.

# Mark a secret as requiring approval
qring set PROD_DB_URL "..." --requires-approval

# Temporarily grant MCP access for 1 hour with a reason
qring approve PROD_DB_URL --for 3600 --reason "deploying v2.0"

# List all approvals with verification status
qring approvals

# Revoke an approval
qring approve PROD_DB_URL --revoke

When an agent is blocked on an approval-protected key, q-ring raises a desktop notification (Linux notify-send, macOS osascript) naming the key and the exact qring approve command — throttled per key, disabled with QRING_NOTIFY=off.

Canary Honeytokens

Plant fake credentials that look and read exactly like real ones. Anything that touches one — a compromised MCP server, an over-curious agent, exfiltrated tooling sweeping the ring — gets the fake value back with no tell, while q-ring fires a desktop alert and writes a canary event into the tamper-evident audit chain.

# Plant a canary shaped like a real AWS access key
qring canary plant AWS_SECRET_ACCESS_KEY --format aws

# Other shapes: github, openai, anthropic, stripe, generic
qring canary plant GHP_BACKUP_TOKEN --format github

# See what's been tripped
qring canary list
qring audit --action canary

Values are CSPRNG noise in the provider's real token shape (an aws canary matches AKIA[A-Z0-9]{16}) — plausible enough to be taken, never valid. Alerts are throttled to one per key per 30 seconds; the audit trail records every read.

Canaries are built to stay covert: they carry no identifying description (add an innocuous cover story with --description if you like), their flag never appears in MCP tool responses, and trip records are visible only from the operator's terminal — never to agents via MCP audit tools. Bulk export and delete trip them just like reads, so sweeping the ring or removing the tripwire both ring the bell. Done with one? qring canary disarm <key> turns it back into an ordinary secret (qring set over a canary warns you first — the flag deliberately survives overwrites so an agent can't launder it away).

MCP Airlock

Run a third-party MCP server behind q-ring. The airlock sits between your agent host and the wrapped server, spawns it with a stripped environment (no inherited API keys — opt back in with --inherit-env), and records every tool call that crosses it as a wrap event in the audit chain, grouped per session and labeled with the calling client's identity. Tool arguments are never logged — they may contain secrets.

{
  "mcpServers": {
    "some-server": {
      "command": "qring",
      "args": ["mcp", "wrap", "--", "npx", "-y", "some-mcp-server"]
    }
  }
}

Tools-only proxy today: tools/list and tools/call pass through verbatim (pagination, progress notifications, cancellation, and tools/list_changed included; long-running tools are governed by the host's own timeout, with a generous airlock ceiling configurable via QRING_WRAP_TIMEOUT_MS). A wrapped server's resources and prompts are not proxied yet — a resources-heavy server will look tools-only behind the airlock.

Be clear about what the airlock is: env stripping plus a tamper-evident record of every tool call. It is not a sandbox — the wrapped process still runs as your user with normal filesystem, network, and OS-keychain access, and tool descriptions/results pass through uninspected. See docs/threat-model.md for the honest boundary picture.

Just-In-Time (JIT) Provisioning

Instead of storing static credentials, configure q-ring to dynamically generate short-lived tokens on the fly when requested (e.g. AWS STS, generic HTTP endpoints).

# Store the STS role configuration
qring set AWS_TEMP_KEYS '{"roleArn":"arn:aws:iam::123:role/AgentRole", "durationSeconds":3600}' --jit-provider aws-sts

# Resolving the secret automatically assumes the role and caches the temporary token
qring get AWS_TEMP_KEYS

Project Context for AI Agents

A safe, redacted overview of the project's secrets, configuration, and state. Designed to be fed into an AI agent's system prompt without ever exposing secret values.

# Human-readable summary
qring context

# JSON output (for MCP / programmatic use)
qring context --json

Secret-Aware Linter

Scan specific files for hardcoded secrets with optional auto-fix. When --fix is used, detected secrets are replaced with process.env.KEY references and stored in q-ring.

# Lint files for hardcoded secrets
qring lint src/config.ts src/db.ts

# Auto-fix: replace hardcoded values and store in q-ring
qring lint src/config.ts --fix

# Scan entire directory with auto-fix
qring scan . --fix

Agent Memory

Encrypted, persistent key-value store that survives across AI agent sessions. Useful for remembering rotation history, project decisions, or context.

# Store a memory
qring remember last_rotation "Rotated STRIPE_KEY on 2026-03-21"

# Retrieve it
qring recall last_rotation

# List all memories
qring recall

# Forget
qring forget last_rotation

Pre-Commit Secret Scanning

Install a git pre-commit hook that automatically blocks commits containing hardcoded secrets.

# Install the hook
qring hook:install

# Uninstall
qring hook:uninstall

Secret Analytics

Analyze usage patterns and get optimization suggestions for your secrets.

qring analyze

Output includes most accessed secrets, unused/stale secrets, scope optimization suggestions, and rotation recommendations.

Service Setup Wizard

Quickly set up a new service integration with secrets, manifest entries, and hooks in one command.

# Create secrets for a new Stripe integration
qring wizard stripe --keys STRIPE_KEY,STRIPE_SECRET --provider stripe --tags payment

# With a hook to restart the app on change
qring wizard myservice --hook-exec "pm2 restart app"

Governance Policy

Define project-level governance rules in .q-ring.json to control which MCP tools can be used, which keys are accessible, and which commands can be executed. Policy is enforced at both the MCP server and keyring level.

Over MCP, policy is resolved from the directory the server was launched in — not from the projectPath a caller passes — so an agent can't sidestep restrictions by pointing at a directory with no policy. Launch the MCP server from your project root (where .q-ring.json lives). Edits to .q-ring.json are picked up automatically (the policy cache invalidates on file change), so you don't need to restart the server.

Policy files are schema-validated and fail closed: an invalid policy object (say, a typo like denytools) raises a PolicyConfigError instead of being silently ignored, so a malformed rule can never widen access.

# View the active policy
qring policy

# JSON output
qring policy --json

Example policy in .q-ring.json:

{
  "policy": {
    "mcp": {
      "denyTools": ["delete_secret"],
      "deniedKeys": ["PROD_DB_PASSWORD"],
      "deniedTags": ["production"]
    },
    "exec": {
      "denyCommands": ["curl", "wget", "ssh"],
      "maxRuntimeSeconds": 30
    },
    "secrets": {
      "requireApprovalForTags": ["production"],
      "maxTtlSeconds": 86400
    }
  }
}

Exec Profiles

Restrict command execution with named profiles that control allowed commands, network access, timeouts, and environment sanitization.

# Run with the "restricted" profile (blocks network tools and interpreters/shells; 30s timeout)
qring exec --profile restricted -- npm test

# Run with the "ci" profile (5min timeout, allows network)
qring exec --profile ci -- npm run deploy

# Default: unrestricted
qring exec -- echo "hello"

Built-in profiles: unrestricted, restricted (denies network tools and interpreters/shells — python -c, node -e, bash and friends can't exfiltrate injected secrets; 30s limit), ci (5min limit, blocks destructive commands).

Tamper-Evident Audit

Every audit event includes a SHA-256 hash of the previous event, creating a tamper-evident chain. Since v0.14 the chain is also anchored with a keyed HMAC stored in the OS keyring, so qring audit:verify detects truncation and whole-file rewrites — not just in-place edits. Verify integrity and export logs in multiple formats. Events from MCP sessions are additionally stamped with the connecting client's self-reported identity (clientInfo name@version) — shown in qring audit output and filterable with qring audit --agent <label>. It's an audit label for "which agent did this", never an authorization boundary, since clients choose what to report.

# Verify the entire audit chain
qring audit:verify

# Export as JSON
qring audit:export --format json --since 2026-03-01

# Export as CSV
qring audit:export --format csv --output audit-report.csv

Encrypted File Backend (Headless / CI)

Hosts with no OS keyring at all (headless Linux, containers, CI) can opt into an encrypted file store. Everything — secrets, the audit anchor, the agent-memory key — routes through it.

export QRING_BACKEND=file
export QRING_FILE_PASSPHRASE="a strong passphrase"   # required — no passphrase, no access
qring set CI_TOKEN

The store is AES-256-GCM at ~/.config/q-ring/file-backend.enc (mode 0600, path override via QRING_FILE_BACKEND_PATH), keyed by PBKDF2 from the passphrase. It is explicit-only: a missing OS keyring never falls back to it silently, and without the passphrase every operation fails closed — q-ring never encrypts under a machine-derivable key.

Team & Org Scopes

Extend beyond global and project scopes with team and org scopes for shared secrets across groups. Resolution order: project → team → org → global (most specific wins).

# Store a secret in team scope
qring set SHARED_API_KEY "sk-..." --team my-team

# Store in org scope
qring set ORG_LICENSE "lic-..." --org acme-corp

# Resolution cascades: project > team > org > global
qring get API_KEY --team my-team --org acme-corp

Issuer-Native Rotation

Attempt provider-native secret rotation (for providers that support it) or fall back to local generation.

# Rotate via the detected provider
qring rotate STRIPE_KEY

# Force a specific provider
qring rotate API_KEY --provider openai

CI Secret Validation

Batch-validate all secrets against their providers in a CI-friendly mode. Returns a structured pass/fail report with exit code 1 on failure.

# Validate all secrets (CI mode)
qring ci:validate

# JSON output for pipeline parsing
qring ci:validate --json

Agent Mode — Autonomous Monitoring

A background daemon that continuously monitors secret health, detects anomalies, and optionally auto-rotates expired secrets.

# Start the agent
qring agent --interval 60 --verbose

# With auto-rotation of expired secrets
qring agent --auto-rotate

# Single scan (for CI/cron)
qring agent --once

Quantum Status Dashboard — Live Monitoring

Launch a real-time dashboard in your browser that turns the entire quantum subsystem into one glanceable page. It's a single self-contained HTML page served locally — no cloud, no config, fully offline — built as a Preact + htm app (runtime bundled and inlined). It streams updates every 5 seconds via Server-Sent Events and diffs the DOM in place, so data refreshes without re-running entrance animations and your search input, caret, and scroll position are preserved across ticks.

What you get:

  • KPI strip — total secrets, detected environment, protected count, active approvals, hooks, 24-hour reads, and live anomaly count.

  • Health summary — donut chart of healthy / stale / expired / no-decay secrets plus per-scope counts (global / project / team / org).

  • Environment — wavefunction collapse details: detected env, source, branch, and any project context.

  • Manifest.q-ring.json summary with declared / required / missing / expired / stale keys.

  • Policy — at-a-glance view of MCP, exec, and secret policies (allow/deny tools, deny keys/tags, allow/deny commands, approval & rotation requirements).

  • Secrets table — searchable, sortable view of every secret (key, scope, env, type, decay, tags, last read), with quick chips for expired, stale, and protected filters. Press / to focus the search box.

  • Quantum cards — decay timers, superposition states, entanglement pairs, and active quantum tunnels.

  • Approvals & hooks — live list of valid (and tampered) approval grants and every registered hook with its match summary.

  • Agent memory — count of encrypted memory keys persisted at ~/.config/q-ring/agent-memory.enc.

  • Anomaly alerts — burst reads, off-hours access, tampered audit chain, and other suspicious patterns.

  • Audit log (24h) — filterable feed with action chips (read/write/delete/export), source chips (cli/mcp/hook/agent), and a free-text filter.

Top-bar controls let you pause SSE updates (handy while reading the audit feed), refresh on demand, or jump to the raw JSON snapshot at /api/status. Keyboard shortcuts: / focus secrets search · P pause · R refresh.

The dashboard binds to 127.0.0.1 only and never exposes secret values, but it does surface key names, the audit log, and approval grants — so every route is gated by a random, per-launch token. qring status prints (and opens) the full URL including ?token=…; requests without the token get a 403. Stop the server to invalidate the token.

# Open the dashboard (auto-launches your browser at http://127.0.0.1:9876/?token=…)
qring status

# Specify a custom port
qring status --port 4200

# Don't auto-open the browser (copy the printed tokenized URL yourself)
qring status --no-open

MCP Server

q-ring includes a full MCP server with 44 tools for AI agent integration.

Core Tools

Tool

Description

get_secret

Read a secret value (collapses superposition, audits the read)

list_secrets

List keys + metadata in scope (values never exposed); filter by tag, expiry, glob

set_secret

Create or overwrite a single secret with optional TTL, per-env state, tags, rotation format

delete_secret

Permanently remove a secret value (not undoable from q-ring)

has_secret

Boolean existence check that respects decay (no audit read)

export_secrets

Render multiple secrets as .env or JSON for one-off export (skips approval-protected keys without a grant)

import_dotenv

Parse .env text and bulk-store every key/value pair (accepts raw content only — never reads files)

check_project

Compare .q-ring.json manifest against the keyring for missing/expired/stale keys

env_generate

Render a complete .env body from the project manifest, with warnings for gaps

Quantum Tools

Tool

Description

inspect_secret

Show metadata for one key (states, decay, entanglement, access count) without revealing the value

detect_environment

Resolve which env slug should drive superposition collapse for the current context

generate_secret

Generate a CSPRNG-backed value in a chosen format and optionally store it

entangle_secrets

Link two keys so future writes/rotations propagate the same value

disentangle_secrets

Break the sync link between two keys (does not delete values)

Tunneling Tools

Tool

Description

tunnel_create

Stash a value in process memory and return an opaque ID (never touches disk)

tunnel_read

Fetch a tunneled value by ID — may self-destruct on read

tunnel_list

Enumerate active tunnels with remaining read budget and TTL (IDs only)

tunnel_destroy

Immediately remove a tunnel from memory before its TTL/reads run out

Teleportation Tools

Tool

Description

teleport_pack

Encrypt selected secrets into a passphrase-protected AES-256-GCM bundle

teleport_unpack

Decrypt a teleport bundle and import each secret (with optional dry-run)

Validation Tools

Tool

Description

validate_secret

Hit the upstream service (OpenAI/Stripe/GitHub/AWS/HTTP) to confirm a single key is still live

list_providers

Enumerate built-in validation providers and their auto-detect prefixes

Hook Tools

Tool

Description

register_hook

Register a shell/HTTP/signal side-effect that fires on write/delete/rotate

list_hooks

Show every registered hook with match criteria, type, and enabled flag

remove_hook

Detach a single hook by ID without touching any secrets

Execution & Scanning Tools

Tool

Description

exec_with_secrets

Run a child command with secrets injected as env vars and any leaked values redacted from output

scan_codebase_for_secrets

Walk a directory tree and flag hardcoded secrets via regex + entropy heuristics

lint_files

Inspect a specific file list for hardcoded secrets with optional auto-fix to process.env.KEY

AI Agent Tools

Tool

Description

get_project_context

Single redacted snapshot of secrets, env, manifest, hooks, and recent audit activity

agent_remember

Persist a non-secret note in encrypted agent memory across sessions

agent_recall

Read a memory value, or list every stored key when no key is supplied

agent_forget

Permanently delete a key from agent memory

analyze_secrets

Usage profile: most-accessed, stale, never-accessed, no-rotation candidates

Observer & Health Tools

Tool

Description

audit_log

Query the tamper-evident audit log filtered by key, action, and limit

detect_anomalies

Surface burst-read and off-hours findings from audit history

verify_audit_chain

Recompute the audit hash chain and report the first break point if tampered

export_audit

Export audit events as jsonl, json, or csv for archival/SIEM

health_check

Read-only scope sweep: decay/stale/expired counts plus current anomalies

status_dashboard

Start a local SSE dashboard with live KPIs, secrets, hooks, and audit feed (returns a token-gated 127.0.0.1 URL)

agent_scan

Multi-project health pass with optional autoRotate for expired secrets

Governance & Policy Tools

Tool

Description

check_policy

Dry-run a tool/key/exec action against .q-ring.json policy without performing it

get_policy_summary

High-level overview of policy rule counts and approval/rotation requirements

rotate_secret

Ask the upstream provider to issue a new credential and store it back in the keyring

ci_validate_secrets

Batch-validate every accessible secret in scope and return a structured pass/fail report

Cursor / Kiro Configuration

Add to .cursor/mcp.json or .kiro/mcp.json:

If q-ring is installed globally (e.g. pnpm add -g @i4ctime/q-ring):

{
  "mcpServers": {
    "q-ring": {
      "command": "qring-mcp"
    }
  }
}

If using a local clone:

{
  "mcpServers": {
    "q-ring": {
      "command": "node",
      "args": ["/path/to/q-ring/dist/mcp.js"]
    }
  }
}

Claude Code Configuration

Add to ~/.claude/claude_desktop_config.json:

Global install:

{
  "mcpServers": {
    "q-ring": {
      "command": "qring-mcp"
    }
  }
}

Local clone:

{
  "mcpServers": {
    "q-ring": {
      "command": "node",
      "args": ["/path/to/q-ring/dist/mcp.js"]
    }
  }
}

VS Code Configuration

VS Code speaks MCP natively — add to .vscode/mcp.json (note the servers key, not mcpServers):

{
  "servers": {
    "q-ring": {
      "command": "qring-mcp"
    }
  }
}

qring setup does not write this file yet — VS Code is config-only (no first-party plugin bundle).

Editor Plugins

The q-ring repo ships three first-party editor packs — each one adds rules/steering, agents, commands, skills, hooks, and the MCP connector to its host editor.

Plugin

Editor

Highlights

cursor-plugin/

Cursor

3 rules, 5 skills, 2 agents, 8 slash commands, 3 hooks, MCP autoconnect

kiro-plugin/

Kiro

Official Power layout: POWER.md, root mcp.json, steering/, hooks/; or flatten with plugin:sync:kiro

claude-code-plugin/

Claude Code

CLAUDE.md memory, project .mcp.json, 2 subagents, 8 slash commands, 5 skills, 3 hook scripts

Cursor Plugin

The q-ring Cursor Plugin brings quantum secret management directly into your IDE with rules, skills, agents, commands, hooks, and a built-in MCP connector.

Component

What it does

3 Rules

Always-on guidance: never hardcode secrets, use q-ring for all ops, warn about .env files

5 Skills

Auto-triggered by context: secret management, scanning, rotation, project onboarding, exec-with-secrets

2 Agents

security-auditor (proactive monitoring) and secret-ops (day-to-day assistant)

8 Commands

/qring:scan-secrets, /qring:health-check, /qring:rotate-expired, /qring:setup-project, /qring:teleport-secrets, /qring:dashboard, /qring:exec-safe, /qring:analyze

3 Hooks

afterFileEdit (lint scan), sessionStart (project context), beforeShellExecution (.env guard)

MCP Connector

Auto-connects to qring-mcp via stdio — all 44 tools available

Install from the Cursor marketplace or see cursor-plugin/README.md for manual setup.

Kiro Plugin (Power)

The kiro-plugin/ directory is a Kiro Power per Create powers: POWER.md (metadata, onboarding, steering map), root mcp.json (MCP server must match the server name referenced in the power), and steering/ for workflows. Install from Kiro → PowersAdd power from Local Path and select kiro-plugin, or publish the folder on GitHub and use Add power from GitHub.

Always-on steering blocks hardcoded secrets and routes everything through q-ring; manual steering files act as agent personas (#qring-secret-ops, #qring-security-auditor), skill packs, and slash-style commands (#qring-cmd-scan-secrets, etc.). Optional hooks live in hooks/ for copy into .kiro/hooks/.

# Alternative: flatten into ~/.kiro (settings + steering + hooks)
pnpm run plugin:sync:kiro

# Or scope to a single project
pnpm run plugin:sync:kiro -- /path/to/your/project/.kiro

See kiro-plugin/README.md for the full breakdown.

Claude Code Plugin

For Claude Code, q-ring ships a CLAUDE.md memory file, a project-scoped .mcp.json, two subagents (secret-ops, security-auditor), eight slash commands (/qring-scan-secrets, /qring-health-check, …), five skills, and three hooks (post-edit lint reminder, pre-Bash .env guard, session-start context primer).

# Install into the current project ($PWD)
pnpm run plugin:sync:claude

# Install agents/commands/skills/hooks at user scope (~/.claude)
pnpm run plugin:sync:claude -- --user

# Or target a specific project
pnpm run plugin:sync:claude -- /path/to/your/project

Existing CLAUDE.md, .mcp.json, or .claude/settings.json files are never silently overwritten — the script writes a <filename>.qring-template next to them so you can merge by hand. Pass --force to overwrite.

See claude-code-plugin/README.md for the full breakdown.

Architecture

qring CLI ─────┐
               ├──▶ Core Engine ──▶ @napi-rs/keyring ──▶ OS Keyring
MCP Server ────┘       │
                       ├── Envelope (quantum metadata)
                       ├── Scope Resolver (global / project / team / org)
                       ├── Collapse (env detection + branchMap globs)
                       ├── Observer (tamper-evident audit chain)
                       ├── Policy (governance-as-code engine)
                       ├── Noise (secret generation)
                       ├── Entanglement (cross-secret linking)
                       ├── Validate (provider-based liveness + rotation)
                       ├── Hooks (shell/HTTP/signal callbacks)
                       ├── Import (.env file ingestion)
                       ├── Exec (profile-restricted injection + redaction)
                       ├── Scan (codebase entropy heuristics)
                       ├── Provision (JIT ephemeral credentials)
                       ├── Approval (HMAC-verified zero-trust tokens)
                       ├── Context (safe redacted project view)
                       ├── Linter (secret-aware code scanning)
                       ├── Memory (encrypted agent persistence)
                       ├── Tunnel (ephemeral in-memory)
                       ├── Teleport (encrypted sharing)
                       ├── Agent (autonomous monitor + rotation)
                       └── Dashboard (live status via SSE)

Project Config (.q-ring.json)

Optional per-project configuration:

{
  "env": "dev",
  "defaultEnv": "dev",
  "branchMap": {
    "main": "prod",
    "develop": "dev",
    "staging": "staging",
    "release/*": "staging",
    "feature/*": "dev"
  },
  "secrets": {
    "OPENAI_API_KEY": { "required": true, "description": "OpenAI API key", "format": "api-key", "prefix": "sk-", "provider": "openai" },
    "DATABASE_URL": { "required": true, "description": "Postgres connection string", "validationUrl": "https://api.example.com/health" },
    "SENTRY_DSN": { "required": false, "description": "Sentry error tracking" }
  },
  "policy": {
    "mcp": {
      "denyTools": ["delete_secret"],
      "deniedKeys": ["PROD_DB_PASSWORD"],
      "deniedTags": ["production"]
    },
    "exec": {
      "denyCommands": ["curl", "wget"],
      "maxRuntimeSeconds": 60
    }
  }
}
  • branchMap supports glob patterns with * wildcards (e.g., release/* matches release/v1.0)

  • secrets declares the project's required secrets — use qring check to validate, qring env:generate to produce a .env file

  • provider associates a liveness validation provider with a secret (e.g., "openai", "stripe", "github") — use qring validate to test

  • validationUrl configures the generic HTTP provider's endpoint for custom validation

  • policy defines governance rules for MCP tool gating, key access restrictions, exec allowlists, and secret lifecycle requirements

📚 Docs

Contributing

See CONTRIBUTING.md for the full guide (dev environment, conventions, files to keep in sync). The short version:

  • Run pnpm run lint, pnpm run typecheck, and pnpm run test:ci before opening a PR.

  • Tests or sandboxes can point the audit log elsewhere with QRING_AUDIT_DIR (directory is created if missing); default is ~/.config/q-ring/audit.jsonl.

  • Optional local pre-commit: qring hook:install (uses this package’s precommit hook when qring is on your PATH).

  • After changing one of the editor plugins:

    • Cursor: pnpm run plugin:sync copies cursor-plugin/ to ~/.cursor/plugins/local/my-plugin (or pass a custom path).

    • Kiro: pnpm run plugin:sync:kiro copies kiro-plugin/mcp.json~/.kiro/settings/mcp.json, plus steering/ and hooks/ (or pass a project .kiro path). Prefer adding kiro-plugin/ as a Power from the Powers panel instead.

    • Claude Code: pnpm run plugin:sync:claude copies claude-code-plugin/ into the current directory (or pass a project path; add --user to install at ~/.claude/).

  • See also docs/cli-mcp-parity.md.

🔒 Security

  • Local-first. Core storage is your OS keychain — there is no q-ring cloud and no account. The MCP surface, audit log, and agent memory live on your machine (audit and memory files are written owner-only, 0600).

  • Written-down threat model. What q-ring protects, what it doesn't, and where the residual risk lives — including an honest answer to the agent-exfiltration question — in docs/threat-model.md.

  • Hardened by adversarial review. v0.14.0 shipped the results of an internal adversarial audit — policy-bypass, approval-scoping, and exec-profile findings all fixed, each with regression tests. Details are in the CHANGELOG Security sections (house style since 0.12.0: fix first, then disclose there).

  • Reporting a vulnerability. Use GitHub private vulnerability reporting — see SECURITY.md for the supported-versions table and response commitments (48-hour acknowledgement, 7-day assessment).

📜 License

AGPL-3.0 - Free to use, modify, and share. Any derivative work or hosted service must release its source code under the same license.

Available Tools

44 tools
agent_forgetA

[agent] Permanently delete a single key from encrypted agent memory. Use to retract obsolete or misremembered context; prefer overwriting via agent_remember when you just want to update the value, and use delete_secret for actual credentials (which never live in agent memory). Destructive: there is no recycle bin. Returns 'Forgot "KEY"' on success or a not-found error if the key was already absent.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesMemory key to delete.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden. It clearly discloses that the action is destructive, permanent (no recycle bin), and returns a specific success message or not-found error.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences: the first states the core function and condition, the second provides alternatives and consequences. No unnecessary words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple deletion tool with one parameter and no output schema, the description covers all essential aspects: purpose, usage context, side effects, and error handling. It is fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% as there is only one parameter 'key' with a description. The description does not add extra meaning beyond the schema, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Permanently delete a single key from encrypted agent memory.' It uses a specific verb-action ('delete') and resource ('key from encrypted agent memory'), and distinguishes from sibling tools like agent_remember (overwrite) and delete_secret (for credentials).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly guides when to use the tool ('retract obsolete or misremembered context') and when not to ('prefer overwriting via agent_remember' for updates, use delete_secret for credentials). It also warns of destructive behavior with no recycle bin.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_recallA

[agent] Read a value from encrypted agent memory, or list every stored key when no specific key is supplied. Use at the start of an agent loop to rehydrate prior context, or to look up a single remembered fact; prefer get_project_context for a redacted overview of secrets and get_secret for actual credential values. Read-only. With a key argument: returns JSON { ok, data: { key, value } } or a not-found error. Without key: returns a JSON listing of every stored key (no values), or 'Agent memory is empty'.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoMemory key to read. Omit to list every stored key (without values).

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses read-only nature and describes return formats for both with and without key, including error cases. No annotations provided, so description carries full burden; adequately transparent but could add more about idempotency or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise, front-loaded with core action, no unnecessary words. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for a read-only tool with one optional parameter. Covers usage, alternatives, return formats, and edge cases (empty memory, not-found). No output schema, so description adequately explains returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single parameter 'key' with clear description that explains behavior when omitted (list keys) and when provided (read value). Schema coverage is 100%, and description adds value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it reads a value or lists keys from encrypted agent memory. Distinguishes from siblings by referencing get_project_context and get_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises when to use (start of agent loop, rehydration, single fact lookup) and when to prefer alternatives like get_project_context and get_secret.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_rememberA

[agent] Persist a non-secret key/value note in encrypted, on-disk agent memory that survives across MCP sessions. Use to record stable agent context — last rotation date for a key, the user's deployment preferences, decisions taken in earlier sessions; do NOT use this to store secrets (use set_secret instead) and prefer chat scratchpad for purely transient state. Mutates the encrypted memory store. Idempotent: rewriting the same key with a new value simply overwrites. Returns 'Remembered "KEY"' on success.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesMemory key (free-form string). Convention: lowercase dotted namespaces, e.g. 'project.lastDeploy'.
valueYesPlain-string value to store. JSON-stringify structured data on the caller side if needed.

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses mutation, idempotency, and return value format. With no annotations, the description covers key behavioral traits, though it could mention failure modes or rate limits. Still, it is above average.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three efficient sentences: first states purpose and persistence, second gives usage guidance, third covers behavior and idempotency. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given simple tool with 2 fully-described parameters and no output schema, the description covers purpose, usage, behavior, parameter conventions, and return value. Sufficient for effective invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds meaning beyond schema: suggests naming convention for keys (lowercase dotted namespaces) and advises JSON-stringifying structured values. This is valuable guidance for correct usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (persist) and resource (non-secret key/value note in encrypted, on-disk agent memory). It also distinguishes from siblings by explicitly warning against using for secrets (use set_secret) and transient state (use chat scratchpad).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use examples (recording stable agent context) and when-not-to-use (secrets, transient state) with named alternatives (set_secret, chat scratchpad).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_scanA

[agent] Run a multi-project health pass that gathers decay status, audit anomalies, and .q-ring.json manifest gaps across one or more project paths and (optionally) auto-rotates expired secrets with freshly generated values. Use as the canonical 'agent maintenance loop' across a portfolio of repos; prefer health_check for a single read-only scope, detect_anomalies for audit-only triage, and check_project for a single-project manifest check. With autoRotate=false (default) this is read-only. With autoRotate=true it OVERWRITES expired secret values in the keyring with generated replacements — credential changes that may break upstream integrations until they are propagated. Subject to tool policy. Returns a JSON report of per-project findings and any rotations performed.

ParametersJSON Schema
NameRequiredDescriptionDefault
autoRotateNoIf true, replace expired secrets with newly generated values (using each secret's `rotationFormat`/`rotationPrefix`). Only enable when intentional rotation is desired — this is destructive on the upstream side.
projectPathsNoList of absolute project roots to scan. Defaults to `[server.cwd]` when omitted.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses read-only mode by default, destructive behavior when autoRotate=true (overwrites secrets, may break integrations), and mentions tool policy and return format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single concise paragraph that front-loads the main action. Each sentence adds value, though slightly longer than necessary. No redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description states it returns a JSON report of per-project findings and rotations. Covers all key aspects of behavior, including optional destructive action, for a multi-project tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. The description adds valuable context beyond schema: explains default for projectPaths (server.cwd), and warns about destructive nature of autoRotate. This extra guidance justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool runs a multi-project health pass gathering decay status, audit anomalies, and manifest gaps, with optional auto-rotation of expired secrets. It distinguishes from siblings by naming health_check, detect_anomalies, and check_project.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool as the 'canonical agent maintenance loop' and when to prefer alternatives like health_check (single read-only), detect_anomalies (audit-only), or check_project (single-project manifest check).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_secretsA

[agent] Cross-reference the secrets in scope with recent audit events to produce a usage profile and rotation/retirement suggestions. Use as a quarterly hygiene check or as input to a planner that decides what to rotate or delete; prefer health_check for decay-only triage and audit_log to inspect access timelines for one key. Read-only; uses the most recent ~500 audit events. Returns JSON { total, expired, stale, neverAccessed: [...], noRotationFormat: [...], mostAccessed: [{ key, reads }] }. neverAccessed and noRotationFormat are good candidates for cleanup or for adding rotation hints.

ParametersJSON Schema
NameRequiredDescriptionDefault
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool is read-only and uses the most recent ~500 audit events. Since no annotations are provided, this carries the full burden. It doesn't mention potential side effects (likely none) and is sufficiently transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded, stating the core function first, followed by usage, behavioral note, and output format. It is efficient but includes useful elaborations that could be slightly condensed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides the return format (JSON structure) and actionable hints (candidates for cleanup). It covers behavior, usage, and output. However, it lacks details on prerequisites like permissions or error conditions. With no annotations or output schema, it is mostly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description does not add extra semantics beyond the schema, such as how parameters affect the analysis. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool cross-references secrets with audit events to produce a usage profile and suggestions. It distinguishes from siblings by explicitly mentioning that health_check is for decay-only triage and audit_log for inspecting a single key timeline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: use as a quarterly hygiene check or input to a planner. It also gives clear alternatives: prefer health_check for decay-only triage and audit_log for single key timeline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

audit_logA

[audit] Query the q-ring audit log — a tamper-evident record of every read/write/delete touching a secret. Use to investigate 'who accessed KEY recently?' or to feed an agent the access timeline for a specific credential; prefer detect_anomalies for automated unusual-pattern detection and health_check for decay-state-plus-anomalies in one call. Read-only. Returns one line per event in chronological order, formatted timestamp | action | key | [scope] | env:NAME | detail. Returns 'No audit events found' when the filter matches nothing.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoLimit to events touching this exact key. Omit for the full log.
limitNoMaximum events to return, newest first. Defaults to 20. Increase for deeper investigations.
actionNoLimit to a single action verb (e.g. 'read' to see only reads). Omit for all actions.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the read-only nature, the output format (one line per event, formatted with timestamp/action/key/scope/env/detail), and the behavior when no events match ('No audit events found'). It does not cover rate limits or auth requirements, but for a query tool this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is about five sentences, front-loaded with the purpose and usage guidelines, and every sentence adds value. It is concise and well-structured, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, 3 parameters, and no output schema, the description covers purpose, usage, output format, and edge case. It could clarify the order of events (chronological vs. newest-first limit) but is otherwise complete. The output format is explicitly described, compensating for the lack of output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add new meaning beyond the schema for the parameters themselves; it mostly repeats what the schema already says (e.g., 'limit to events touching this exact key', 'Maximum events to return, newest first'). The description adds overall output context but not parameter-specific semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries the audit log, a tamper-evident record of secret accesses. It specifies the verb ('Query') and resource ('q-ring audit log'), and distinguishes from siblings by explicitly naming `detect_anomalies` and `health_check` as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use scenarios ('investigate who accessed KEY recently?', feed an agent an access timeline) and when-not-to-use alternatives ('prefer detect_anomalies for automated unusual-pattern detection and health_check for decay-state-plus-anomalies'). It also declares the tool is read-only.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_policyA

[policy] Ask whether a single intended action would be allowed by the project's .q-ring.json policy without actually performing it. Use as a dry-run before calling a potentially-blocked tool, attempting to read a sensitive key, or invoking exec_with_secrets with a non-trivial command; prefer get_policy_summary for a one-shot overview of the entire policy. Read-only. Returns JSON { allowed, reason?, policySource } describing the decision. Returns an error 'Missing required parameter for the selected action type' if the matching argument for the chosen action is not supplied.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoSecret key name to evaluate. Required when `action` is 'key_read'.
actionYesWhich policy surface to query. 'tool' = MCP tool gate (needs `toolName`); 'key_read' = secret read gate (needs `key`); 'exec' = exec_with_secrets command gate (needs `command`).
commandNoCommand to evaluate against the exec allowlist/denylist. Required when `action` is 'exec'.
toolNameNoTool id to evaluate, e.g. 'rotate_secret'. Required when `action` is 'tool'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description declares 'Read-only', specifies return JSON structure and error condition, which is thorough given no annotations. Slight lack of detail on potential side effects, but 'Read-only' suffices.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with front-loaded purpose, but includes a run-on sentence; all content is relevant and useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, return format, error case, and relation to sibling. Adequate for a moderately complex tool with 5 parameters and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with descriptions; description adds error context for missing params but does not substantially enhance parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states the tool asks whether an action is allowed by policy, which is a specific verb+resource. It distinguishes from sibling 'get_policy_summary' by noting it checks single actions vs. whole-policy overview.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (as dry-run before blocked calls) and when not to ('prefer get_policy_summary for a one-shot overview'), providing clear context and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_projectA

[project] Compare the keys declared in the project's .q-ring.json manifest against what is actually present in the keyring. Use as the canonical 'is this project ready to run' gate before starting a dev server, deploying, or onboarding a teammate; prefer health_check for a scope-wide decay sweep (no manifest), and agent_scan for multi-project scans with optional auto-rotation. Read-only; does not mutate the keyring or audit log materially beyond a 'list' read. Returns JSON { total, present, missing, expired, stale, ready, secrets: [...] } where ready is true only when nothing is missing or expired. Errors with 'No secrets manifest found in .q-ring.json' if the project has no manifest.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full transparency burden and does so well. It explicitly states read-only behavior, notes the minimally invasive audit effect, details the JSON return shape including the meaning of 'ready', and gives the exact error when no manifest exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense sentences cover purpose, when to use, read-only safety, return format, and error behavior with no fluff. Information is front-loaded and every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one optional parameter and no output schema, the description supplies all necessary context: usage, alternatives, safety profile, exact return fields, readiness semantics, and failure mode. Nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the single optional parameter, including its absolute-path requirement and default behavior. The description adds project-level context but does not materially enhance parameter understanding beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action: compare manifest-declared keys against actual keyring contents. It also frames the tool as the canonical 'is this project ready to run' gate, which distinguishes it from broader or multi-project sibling tools like health_check and agent_scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage scenarios are given: before starting a dev server, deploying, or onboarding a teammate. It also names alternatives and when to prefer them: health_check for scope-wide decay without a manifest, and agent_scan for multi-project scans with auto-rotation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ci_validate_secretsA

[validation] Validate every accessible secret in the requested scope against its detected provider in a single batch and return a structured pass/fail report. Use as a CI gate ('do all our credentials still work before deploy?') or as a pre-rotation health pass; prefer validate_secret for a single key. Side effects: one outbound request per validatable secret (cost scales with N). Reads each secret value (records 'read' audit events). Returns JSON { total, valid, invalid, results: [...] } listing per-key status, provider, and error messages where applicable. Returns 'No secrets to validate' if nothing in scope has a provider mapping.

ParametersJSON Schema
NameRequiredDescriptionDefault
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses side effects (outbound requests per secret, read audit events), return structure, and a special case ('No secrets to validate'). It lacks explicit mention of error handling or timeouts but is otherwise transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (6 sentences) and well-structured, front-loading purpose, then usage, side effects, and return format. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description provides a clear outline of the return JSON. It covers side effects and usage scenarios. However, it does not mention required permissions or dependencies, which would be helpful for a batch operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents parameters thoroughly. The description adds minimal additional meaning, only implicitly referencing scope in the purpose. Thus baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource combination ('Validate every accessible secret') and distinguishes from sibling `validate_secret` by emphasizing batch operation and scope. It clearly defines what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (CI gate, pre-rotation health pass) and when to use the alternative (`validate_secret` for a single key). This provides clear guidance for the AI agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_secretA

[secrets] Permanently remove a secret value (and all its env states) from the keyring for the given scope. Use when a credential is being retired or was created in error; prefer disentangle_secrets to break a sync link without erasing values, remove_hook to detach lifecycle callbacks, and tunnel_destroy for ephemeral tunnels. Destructive and not undoable from q-ring (no built-in trash). Writes a 'delete' event to the audit log and fires matching hooks. Returns 'Deleted "KEY"' on success or a not-found error if the key did not exist in the requested scope. Subject to tool policy.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesExact secret key name to delete. Example: 'OLD_API_KEY'.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses destructive nature, no built-in trash, writes audit log, fires hooks, and returns success or not-found error. This is comprehensive given no annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single paragraph with dense information; front-loaded with main action. Slightly unstructured but efficient; every sentence contributes value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, side effects, and return value. Lacks details on dependency handling but is adequate for a destructive tool with 5 params and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds an example for 'key' but does not significantly extend meaning beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it permanently removes a secret value and all its env states. It distinguishes from siblings like disentangle_secrets, remove_hook, and tunnel_destroy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use (credential retired or created in error) and lists alternative tools for different scenarios. Also notes it is not undoable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_anomaliesA

[audit] Scan the audit history for suspicious access patterns — burst reads of the same key, off-hours access, and other heuristics. Use as a quick triage signal when investigating a single key or before letting an agent rotate credentials; prefer health_check for a scope-wide decay+anomaly summary, and agent_scan for multi-project JSON reports with optional auto-rotation. Read-only; never mutates secrets or the audit log. Returns one line per finding formatted [type] description, or 'No anomalies detected' when the log looks clean.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoIf provided, narrow the scan to this exact key. Omit to scan across every key in the audit log.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description states 'Read-only; never mutates secrets or the audit log' and describes the output format: 'Returns one line per finding formatted `[type] description`, or "No anomalies detected"'. This adequately discloses behavioral traits for a read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (4 sentences) and front-loaded with purpose. Each sentence adds distinct value: purpose, usage guidance, safety, and output format. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool (1 optional parameter, no output schema, no annotations), the description provides everything needed: purpose, usage, safety, and return format. It is complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% coverage for the single parameter `key` with a clear description. The description reiterates the parameter's purpose but does not add new meaning beyond the schema, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Scan', the resource 'audit history', and specific behaviors like 'burst reads of the same key, off-hours access'. It distinguishes the tool from siblings by naming alternatives (`health_check`, `agent_scan`) and their use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance: 'Use as a quick triage signal when investigating a single key or before letting an agent rotate credentials; prefer `health_check` for a scope-wide decay+anomaly summary, and `agent_scan` for multi-project JSON reports with optional auto-rotation.' This clearly states when to use and when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_environmentA

[project] Resolve which environment slug (e.g. 'dev', 'staging', 'prod') the current invocation should collapse to. Use before reading secrets when you want to mirror the same env q-ring would auto-pick (e.g. to log it, or to pass through to another tool); prefer passing an explicit env to get_secret/env_generate when you already know which env you want. Read-only; checks the QRING_ENV env var, NODE_ENV, the project's .q-ring.json, and the current git branch in priority order. Returns JSON { env, source } (e.g. { env: 'dev', source: 'NODE_ENV' }), or a plain message indicating that no env could be detected.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description discloses read-only nature, priority order of checks, and return format. Annotations are absent, so description carries full burden; it provides good but not exhaustive detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose. Every sentence adds essential information without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one optional parameter and no output schema, description fully explains return format and resolution priority. Complete for a simple detection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with descriptions. Description adds value by noting default behavior of projectPath, which is not in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool resolves an environment slug, using the verb 'Resolve' and specifying the resource. It distinguishes from siblings like get_secret by noting when to prefer explicit env.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (before reading secrets to mirror auto-picked env) and when not to (when env is already known, prefer passing explicit env). Also mentions use for logging or passing through.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

disentangle_secretsA

[secrets] Break the sync link between two previously entangled keys so future rotations no longer propagate. Use when one of the keys is being retired or should diverge intentionally; pair with delete_secret if you also want to erase one of the values, and use entangle_secrets to recreate the link. Mutates only metadata; the current values remain untouched. Safe and idempotent — running on a pair that was never linked returns success without effect. Subject to tool policy. Returns 'Disentangled: SOURCE </> TARGET'.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceKeyYesFirst key in the previously linked pair.
targetKeyYesSecond key in the previously linked pair.
sourceScopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
targetScopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
sourceProjectPathNoProject root for sourceKey when sourceScope='project'.
targetProjectPathNoProject root for targetKey when targetScope='project'.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description discloses that it mutates only metadata, is safe and idempotent, and returns a specific message. Also mentions subject to tool policy. No annotations provided, so description fully covers behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise with three sentences: purpose, usage, behavior, and return format. No unnecessary words, front-loaded with the main action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description covers when to use, how it works, safety, idempotency, return value, and policy note. Given no output schema, it adequately explains what the agent can expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 6 parameters. The description does not add significant new meaning beyond the schema; it only restates that sourceKey and targetKey are the previously linked pair.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it breaks the sync link between two previously entangled keys. This is a specific verb and resource, and it distinguishes from sibling tools like entangle_secrets and delete_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use (when a key is being retired or should diverge) and pairs with delete_secret for erasure, or entangle_secrets to recreate the link. Provides clear guidance on alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

entangle_secretsA

[secrets] Link two keys (across the same or different scopes) so future writes/rotations of either propagate the same value to the other. Use when one logical credential lives under multiple names (e.g. STRIPE_SECRET_KEY global and project) and should never drift; prefer set_secret for unrelated values, and reverse the link with disentangle_secrets (does not delete values). Mutates only the metadata of both envelopes — the values themselves are not changed by this call. Idempotent: re-running on an already-entangled pair is a no-op. Subject to tool policy. Returns a short confirmation: 'Entangled: SOURCE <-> TARGET'.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceKeyYesFirst secret key in the pair. Example: 'STRIPE_SECRET_KEY'.
targetKeyYesSecond secret key to keep in lockstep with the source.
sourceScopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
targetScopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
sourceProjectPathNoProject root for sourceKey when sourceScope='project'. Defaults to the server cwd.
targetProjectPathNoProject root for targetKey when targetScope='project'. Defaults to the server cwd.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description fully discloses behavior: only mutates metadata, values unchanged, idempotent, subject to tool policy, returns short confirmation. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise, front-loaded with purpose, each sentence adds value (use case, alternatives, behavior, return format). No unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, behavioral traits, return format, and idempotency. No missing critical info given tool complexity (6 params, scopes, no output schema).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds value by explaining high-level semantics (linking across scopes, default scopes, project paths default to cwd). Provides example STRIPE_SECRET_KEY.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it links two keys across scopes so future writes propagate the same value, with specific use case example (STRIPE_SECRET_KEY). It distinguishes from siblings like set_secret and disentangle_secrets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use (prevent drift for same logical credential), when not to use (prefer set_secret for unrelated values), and alternative tool (disentangle_secrets to reverse). Also notes idempotency.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

env_generateA

[project] Render a complete .env file body from the project's .q-ring.json manifest, resolving each declared key from the keyring. Use when a build step or local runtime needs a real .env materialized on disk and you want exactly the keys the manifest declares; prefer export_secrets when you want every key in scope (manifest-agnostic) and exec_with_secrets to inject secrets into a child process without writing them to a file. Reads values (records 'read' audit events) and collapses superposition for the requested env. Returns the raw .env text, with # MISSING (required): KEY / # EXPIRED: KEY / # STALE: KEY warnings appended as comments. Missing keys appear as commented-out # KEY= placeholders so the file remains a valid drop-in.

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoEnvironment slug used to collapse superposition when a secret has multiple per-env states. Examples: 'dev', 'staging', 'prod'. If omitted, the secret's defaultEnv is used.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool reads values (records 'read' audit events), collapses superposition, returns raw .env text with warnings for missing/expired/stale keys, and handles missing keys as commented-out placeholders. This is thorough behavioral disclosure beyond the input schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single well-structured paragraph, front-loaded with purpose, followed by usage guidelines and behavioral details. Every sentence earns its place with no redundancy or wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description explains the return value and format comprehensively (raw text with warnings). It covers key aspects like audit events and superposition. A 5 would require explicit format specification, but the description suffices for most use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (both parameters described). The description adds marginal value by mentioning defaultEnv in context, but does not provide additional meaning beyond the schema's descriptions. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Render a complete .env file body from the project's .q-ring.json manifest, resolving each declared key from the keyring.' It uses a specific verb (render) and resource (.env file body), and distinguishes itself from sibling tools like export_secrets and exec_with_secrets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides when to use this tool ('Use when a build step or local runtime needs a real .env materialized on disk and you want exactly the keys the manifest declares') and when to prefer alternatives ('prefer export_secrets when you want every key in scope' and 'exec_with_secrets to inject secrets'). This offers clear context and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

exec_with_secretsA

[exec] Run a child shell command with project secrets injected as environment variables and any leaked secret values redacted from captured stdout/stderr before they return to the agent. Use to let an agent run a script that needs credentials (npm run db:migrate, terraform plan, vercel deploy) without ever putting plaintext values in the chat; prefer env_generate if you need to write a .env file to disk and validate_secret for upstream liveness checks. Spawns a real child process — has whatever side effects the command itself causes (writes, network, exec). Subject to BOTH tool policy and exec policy (allowlist/denylist). Returns a text body with Exit code: N then STDOUT: and STDERR: blocks; both streams are scrubbed against the secret values that were injected.

ParametersJSON Schema
NameRequiredDescriptionDefault
argsNoPositional arguments passed to `command`. Example: ['run', 'db:migrate']. Each element is passed verbatim with no extra shell parsing.
keysNoWhitelist of exact key names to inject. Omit to inject every secret in scope (subject to `tags`).
tagsNoInject only secrets carrying at least one of these tags. Combinable with `keys` as an AND filter.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
commandYesExecutable name or full command to run. Example: 'pnpm', 'node', '/usr/bin/env'. Must be allowed by exec policy.
profileNoExec sandbox profile. 'restricted' (default) denies network-tool binaries (curl, wget, ssh, scp, nc, netcat, ncat) AND common interpreters/shells (python, node, deno, bun, perl, ruby, php, sh, bash, zsh) — since those could otherwise egress the injected secrets — strips proxy env vars, and caps runtime at 30s. It still is NOT a real OS sandbox (it does not restrict PATH, and some allowed binary could in principle make network calls); for genuinely untrusted commands use OS-level isolation (containers, network namespaces). 'ci' allows network and interpreters with a 300s cap and blocks a few destructive commands; 'unrestricted' inherits the full server environment. Define a custom profile in .q-ring.json to allow specific interpreters with secrets.restricted
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and delivers richly. It discloses that it spawns a real child process with arbitrary side effects ('writes, network, exec'), that output is scrubbed against injected secrets, that both tool and exec policies gate usage, and details the return format ('Exit code: N' then STDOUT/STDERR blocks). The profile parameter description adds critical caveats (restricted is NOT a real OS sandbox, PATH not restricted).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two substantial sentences, front-loaded with the verb+action and distinguishing features. The second sentence adds essential caveats. It's dense but every clause earns its place — the only minor deduction is that it's fairly long and the redaction/return-format details could arguably be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-complexity tool (9 params, multiple security modes, side effects, policies, output scrubbing) with no annotations and no output schema, the description is remarkably complete. It covers return format, behavioral caveats, policy constraints, and sibling differentiation entirely in text. Nothing critical is left unexplained for an agent to safely invoke this dangerous tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by reinforcing the 'prefer env_generate/validate_secret' distinction and explaining the exec-policy gating on `command`. However, it does not enumerate parameter-specific semantics beyond what the schema already states (e.g., it doesn't detail the profile tradeoffs in the main body — those live only in the schema's profile description). Slightly above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with '[exec] Run a child shell command with project secrets injected as environment variables and any leaked secret values redacted from captured stdout/stderr' — a specific verb (Run), explicit resource (child shell command with secrets injected), and the defining behavioral trait (secret redaction). It clearly distinguishes from siblings like env_generate (write .env to disk), validate_secret (liveness checks), and get_secret/list_secrets (read-only access), naming alternatives directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use ('let an agent run a script that needs credentials... without ever putting plaintext values in the chat'), explicit prefer-alternatives ('prefer env_generate if you need to write a .env file to disk and validate_secret for upstream liveness checks'), and clear exclusions ('Subject to BOTH tool policy and exec policy'). This is textbook usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_auditA

[audit] Export the audit log as a portable text artifact suitable for archiving or feeding into another SIEM/analyzer. Use for compliance exports, after-the-fact investigations, or to hand the trail to a non-MCP consumer; prefer audit_log for an in-conversation tail and verify_audit_chain to confirm integrity before exporting. Read-only. Returns the rendered text directly (no JSON wrapper). 'jsonl' is one event per line; 'json' is a single array; 'csv' is a header row plus events. Time filters are applied to the event timestamps before formatting.

ParametersJSON Schema
NameRequiredDescriptionDefault
sinceNoInclusive lower bound on event timestamp, ISO 8601. Example: '2026-04-01T00:00:00Z'. Omit for no lower bound.
untilNoInclusive upper bound on event timestamp, ISO 8601. Omit for now/no upper bound.
formatNoOutput format. 'jsonl' (default) is most stream-friendly; 'json' is a single array; 'csv' is spreadsheet-friendly.jsonl

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description discloses read-only nature, direct text return (no JSON wrapper), format behaviors (jsonl one per line, json array, csv header+rows), and time filter application. Lacks mention of size limits or error handling, which is acceptable given tool simplicity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise (5 sentences), front-loaded with purpose, then usage guidance, then format details. No redundant or filler content. Each sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an export tool with no output schema, description fully explains return format, parameter behavior, and usage context. Includes sibling references and typical workflows, making it comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions, but the description adds meaningful context: explains format nuances (stream-friendly jsonl, spreadsheet-friendly csv) and states 'Time filters are applied to event timestamps before formatting,' which clarifies processing order beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it exports audit log as portable text artifact for archiving or SIEM feeding, and distinguishes from sibling tools: `audit_log` for in-conversation tail and `verify_audit_chain` for integrity check before export.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists use cases (compliance exports, after-the-fact investigations, non-MCP consumer hand-off) and when alternatives are better (prefer `audit_log` for tail, `verify_audit_chain` before exporting).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_secretsA

[secrets] Render multiple secrets as a single .env or JSON document for piping into another tool or file. Use to materialize secrets for a one-off export or copy; prefer env_generate when you want output driven by the project's .q-ring.json manifest, and teleport_pack for an encrypted bundle to share between machines. Reads values (collapses superposition for the requested env) and writes one 'export' event per included secret to the audit log. Returns the rendered text directly (no JSON wrapper). Returns an error if no secrets matched the filters. Values are surfaced in plaintext — handle with care.

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoEnvironment slug used to collapse superposition when a secret has multiple per-env states. Examples: 'dev', 'staging', 'prod'. If omitted, the secret's defaultEnv is used.
keysNoWhitelist of exact key names to include. If omitted, every key in scope is considered (subject to `tags`).
tagsNoInclude only secrets tagged with at least one of these tags. Combined with `keys` as an AND filter when both are supplied.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
formatNo'env' renders KEY="value" lines suitable for a .env file; 'json' renders an object keyed by secret name. Defaults to 'env'.env
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, describes key behaviors: collapses superposition for env, writes audit events, returns raw text (no JSON wrapper), errors on no matches, and warns about plaintext. This fully compensates for missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single paragraph, ~100 words, well-structured: purpose first, then usage guidance, then behavioral details. Every sentence adds value with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all essential aspects for an export tool: input filters (keys, tags, scope), output format, error handling, audit logging, and security. No output schema required since returns raw text, and description clarifies that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds minimal parameter-specific info beyond the schema (e.g., 'collapses superposition' for env, output format options already in schema). No extra semantics for other parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool renders multiple secrets as .env or JSON, with specific verb 'Render' and resource 'secrets'. It distinguishes from siblings env_generate and teleport_pack by naming them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use ('one-off export or copy') and when-not-to-use scenarios (prefer env_generate for manifest-driven output, teleport_pack for encrypted bundles). This guides the AI agent to select the right tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_secretA

[secrets] Generate a cryptographically random secret using Node's CSPRNG and optionally store it in the keyring in one step. Use to create new credentials that you control (signing keys, internal tokens, passwords); for issuer-issued credentials (Stripe/OpenAI etc.) use rotate_secret to ask the upstream provider for a fresh key, and use set_secret for values you already have in hand. If saveAs is provided this mutates the keyring (one 'write' event) and returns a summary like 'Generated and saved as "KEY" (FORMAT, ~N bits entropy)'. Without saveAs the call is read-only and returns JSON { ok, data: { value } } containing the freshly generated string.

ParametersJSON Schema
NameRequiredDescriptionDefault
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
formatNoOutput shape. 'hex' / 'base64' / 'alphanumeric' = raw random string of `length` characters; 'uuid' = RFC4122 v4; 'api-key' / 'token' = random alphanumeric with optional `prefix`; 'password' = mixed-case alphanumeric with symbols. Defaults to 'api-key'.api-key
lengthNoNumber of characters (or bytes for hex/base64) to generate. Ignored for 'uuid'. Defaults to a sensible per-format value (e.g. 32 for api-key).
prefixNoLiteral prefix prepended to the random portion. Only meaningful for 'api-key' and 'token'. Example: 'sk-' or 'svc_'.
saveAsNoIf provided, store the generated value at this key name in the keyring (one mutation). Omit to just return the value without persisting.
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description elaborates on cryptographic randomness, side effects (one write event when saveAs is provided), and return formats. However, it lacks details on error handling or security permissions needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that efficiently conveys purpose, usage, and behavioral details without waste. It could be slightly more structured but remains clear and compact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 8 parameters, no output schema, and no annotations, the description covers generation, storage, format variations, and return values. It lacks error scenarios and rate limits but is otherwise thorough for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by grouping parameters and explaining conditional behavior (e.g., scope requirements, saveAs effect), but does not introduce new parameter details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool generates a cryptographically random secret using Node's CSPRNG and optionally stores it. It explicitly distinguishes from sibling tools rotate_secret and set_secret by specifying use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: 'Use to create new credentials that you control' versus 'rotate_secret' for issuer-issued credentials and 'set_secret' for existing values. It also clarifies the read-only vs mutating behavior based on whether saveAs is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_policy_summaryA

[policy] Return a high-level summary of the project's .q-ring.json governance policy — counts of allow/deny rules for tools, key reads, exec commands, plus approval and rotation requirements. Use to orient an agent (or the user) on what guardrails are active before attempting policy-restricted actions; prefer check_policy for a precise per-action verdict. Read-only. Returns pretty-printed JSON; missing policy file returns an empty/default summary rather than an error so callers can branch on the counts.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with no annotations provided, the description discloses key behavioral traits: it is read-only, returns pretty-printed JSON, and handles a missing policy file by returning an empty/default summary instead of throwing an error. This gives callers confidence in side-effect-free operation and predictable failure behavior, going well beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each earning its place: purpose and content, usage guidance with alternative, and behavioral notes. It is front-loaded with the core purpose and contains no redundant or vague wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, the description covers all essential aspects: what it returns (counts and requirements), how to use it, safety (read-only), output format, and error behavior. It is complete enough for an agent to invoke correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single projectPath parameter, so the baseline is 3. The description does not add extra parameter-specific semantics beyond referencing the governance policy file, but it doesn't need to since the schema already explains the parameter's purpose and default behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a high-level summary of the project's .q-ring.json governance policy, listing specific content such as counts of allow/deny rules, key reads, exec commands, and approval/rotation requirements. It distinguishes itself from the sibling check_policy by explicitly noting to prefer that tool for precise per-action verdicts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: to orient an agent on active guardrails before attempting policy-restricted actions. It names the alternative tool (check_policy) and clarifies the division of labor, which is exactly the kind of usage guidance needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_project_contextA

[agent] Return a single redacted snapshot of everything an AI agent typically wants to know about this project: secrets present (keys + metadata only), detected env, manifest declarations, configured providers, registered hooks, and recent audit activity. Use this as the very first call in a session to orient the agent before it asks for any individual secret; prefer list_secrets for a flat key listing, check_project for manifest-vs-keyring drift, and audit_log for a deeper access trail. Read-only and value-safe — no plaintext secret values are ever included. Returns a single pretty-printed JSON document; shape is intentionally broad and may grow over time, so read defensively.

ParametersJSON Schema
NameRequiredDescriptionDefault
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. States 'Read-only and value-safe — no plaintext secret values are ever included.' and warns shape may grow, read defensively. Lacks details on rate limits or errors but covers key safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single paragraph with clear front-loading of purpose, then alternatives, safety, and growth note. Every sentence is necessary and adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters all documented in schema and no output schema, description explains output contents adequately and warns about evolving shape. Slightly missing specifics on pagination or size limits, but sufficient for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. Description does not add meaning beyond schema for parameters; it focuses on output. No extra parameter context provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool returns a 'redacted snapshot' of project context, listing specific items (secrets, env, manifest, etc.). It distinguishes from siblings by naming alternatives: list_secrets, check_project, audit_log.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use this as the very first call to orient the agent, and provides when-not-to-use guidance by preferring listed alternatives for specific needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_secretA

[secrets] Read the plaintext value of a single secret from the q-ring keyring. Use when an agent needs the actual credential to call an external API or inject into a runtime; prefer inspect_secret to see metadata only, has_secret for presence-only checks, and exec_with_secrets to run a command without exposing the value to chat. Side effects: collapses superposition (selects the per-env state) and writes a 'read' event to the audit log (observer effect). Subject to project tool/key policy and may be denied with a 'Policy Denied' message. Returns JSON { ok, data: { key, value } } on success or an error message if missing/blocked.

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoEnvironment slug used to collapse superposition when a secret has multiple per-env states. Examples: 'dev', 'staging', 'prod'. If omitted, the secret's defaultEnv is used.
keyYesExact secret key name as stored in the keyring (case-sensitive). Example: 'OPENAI_API_KEY'.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses side effects: collapses superposition, writes audit log event, and potential policy denial. It lacks explicit mention of idempotency or rate limits, but for a read operation these are less critical. The disclosure is thorough and adds value beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph but front-loads purpose and usage, then covers side effects and return format. It is concise with no redundant sentences. A slight structure improvement (e.g., bullet points) would elevate it, but it's already clear and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no annotations, no output schema, and many siblings, the description covers: purpose, usage guidance, side effects, return format (`{ ok, data: { key, value } }`), and error handling. Completely fills the gaps left by structured fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter is already well-documented. The description adds minimal new parameter information (e.g., the concept of 'collapse superposition' for env is partly in schema). Baseline 3 is appropriate since the description does not significantly enhance parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Read the plaintext value of a single secret' using a specific verb and resource. Distinguishes from siblings like inspect_secret, has_secret, and exec_with_secrets by naming them and contrasting their use cases. No ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use when an agent needs the actual credential' and provides three alternatives with clear reasons to prefer each. Also mentions policy denial as a possible outcome, giving complete usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

has_secretA

[secrets] Check whether a secret exists in the requested scope without reading the value. Use as a cheap precondition before reading or writing — for example, to skip prompting the user for a key that is already configured. Prefer inspect_secret when you also need metadata. Read-only; does not record a 'read' in the audit log. Decay-aware: returns 'false' for expired secrets even though the value is still in the store. Returns the literal text 'true' or 'false'.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesExact secret key name. Example: 'GITHUB_TOKEN'.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses read-only nature, no audit log recording, decay-awareness (returns false for expired secrets), and exact return format ('true' or 'false'). Since no annotations provided, description carries full burden and meets it excellently.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with front-loaded purpose, usage guidance, alternative suggestion, behavioral notes, and return format. Each sentence adds unique value, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters (1 required) and no output schema, the description covers core behavior, return type, audit implications, decay-awareness, and usage scenario, making it fully informative for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds context but no new parameter details beyond schema. The example of 'GITHUB_TOKEN' and explanation of scope are present in schema already.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks secret existence without reading the value, specifying the verb 'check' and resource 'secret existence'. It distinguishes from sibling `inspect_secret`, which provides metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly recommends use as a cheap precondition before read/write, with an example of skipping prompts. Also suggests preferring `inspect_secret` when metadata is needed. Lacks explicit when-not-to-use, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

health_checkA

[health] Run a single read-only sweep over every secret in the requested scope and report counts of healthy/stale/expired secrets plus any current audit anomalies. Use as the default 'is everything OK?' command for an agent or operator; prefer check_project to validate manifest compliance specifically, detect_anomalies for audit-only triage, and agent_scan for multi-project JSON output or optional auto-rotation. Read-only — never writes. Returns a multi-line text summary: header counts (Total / Healthy / Stale / Expired / No decay / Anomalies), then per-secret EXPIRED: / STALE: issue lines, then per-anomaly [type] description lines.

ParametersJSON Schema
NameRequiredDescriptionDefault
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries full burden. It explicitly declares 'Read-only — never writes,' and describes the return format in detail (header counts, issue lines, anomaly lines). This gives full transparency on behavior and output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with purpose first, then usage guidance, then behavioral note, then output format. Every sentence adds value, though slightly verbose. Could be trimmed slightly but earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 optional parameters, no required, and no output schema, the description adequately explains the tool's function and return format. It covers the main use case and output structure. Lacks error/edge case details but is sufficient for a health check tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description does not add extra meaning beyond the schema's parameter descriptions. It uses the parameter concepts implicitly (scope) but does not elaborate on syntax or format beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's verb ('Run a single read-only sweep'), resource ('every secret in the requested scope'), and output ('counts of healthy/stale/expired secrets plus any current audit anomalies'). It distinguishes from siblings by naming `check_project`, `detect_anomalies`, and `agent_scan`, giving specific differentiators.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use as default 'is everything OK?' command and provides clear when-not-to-use: prefer `check_project` for manifest compliance, `detect_anomalies` for audit-only, `agent_scan` for multi-project JSON. This provides strong guidance on alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

import_dotenvA

[secrets] Parse standard dotenv-formatted text and store each key/value pair into the keyring in one batch. Use when migrating an existing .env file into q-ring or onboarding a new project; prefer set_secret for a single key, and teleport_unpack to import an encrypted bundle. Mutates the keyring (one write per parsed key) and emits a 'write' audit event for each. Supports comments, single/double quotes, and \n escapes. Returns a multiline summary listing imported keys and any skipped (existing) keys; in dryRun mode no writes happen and the same summary is produced for review.

ParametersJSON Schema
NameRequiredDescriptionDefault
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
dryRunNoIf true, parse and report what would happen but do not write to the keyring. Useful for previewing imports before committing.
contentYesRaw .env file content as a single string (newline-separated KEY=VALUE lines, comments allowed).
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.
skipExistingNoIf true, leave already-present keys untouched and add them to the 'skipped' list instead of overwriting.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavioral traits: mutates keyring, emits audit events per write, supports dotenv syntax, dry-run mode, and return summary. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise and well-structured; each sentence adds value. Slightly long but appropriately detailed for a batch import tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, behavior, return format, and dry-run mode. Missing error handling for malformed input, but otherwise comprehensive given no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed per-parameter descriptions. The tool description adds overall context but does not significantly enhance individual parameter meaning beyond what the schema provides, so baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Parse... and store') and resource ('dotenv-formatted text... into the keyring'), and distinguishes from siblings by naming set_secret for single keys and teleport_unpack for encrypted bundles.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use ('migrating an existing .env file or onboarding') and when not ('prefer set_secret... teleport_unpack'), providing direct alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_secretA

[secrets] Show full metadata for a single secret — env states, decay window, entanglement links, access counters — without ever revealing the value. Use when you need to understand the shape of a key before reading it or to debug 'why is this expired/stale'; prefer get_secret for the actual value, list_secrets for a many-key overview, and audit_log for the full access timeline. Read-only; does not write a 'read' event since the value is not exposed. Returns pretty-printed JSON with fields: key, scope, type ('superposition'|'collapsed'), created, updated, accessCount, lastAccessed, environments, defaultEnv, decay { expired, stale, lifetimePercent, timeRemaining }, entangled, description, tags. Errors with not-found if the key is absent.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesExact secret key name to inspect. Example: 'OPENAI_API_KEY'.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description fully discloses read-only nature, that it does not create a read event, and describes error behavior (not-found). It also lists all return fields, providing complete transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, well-formatted sentence packs purpose, usage, behavior, and return format without redundancy. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, but the description enumerates all return fields. Given parameter richness (schema covers all) and lack of annotations, the description is complete and self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds minimal meaning beyond schema descriptions (e.g., reiterating that orgId is required only when scope='org'). It does not provide new parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool shows full metadata for a single secret without revealing the value. It uses specific verbs ('Show full metadata') and explicitly distinguishes from siblings like get_secret, list_secrets, and audit_log.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use this tool (understand shape before reading, debug expiration/staleness) and when not (prefer get_secret for value, list_secrets for overview, audit_log for timeline).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lint_filesA

[scan] Inspect a specific list of files for hardcoded secrets and, when fix is true, replace each finding with process.env.KEY while storing the extracted value into the keyring. Use to migrate a known set of files (e.g. just-changed files in a pre-commit hook) into q-ring; prefer scan_codebase_for_secrets for a whole-tree audit and import_dotenv to ingest an existing .env. With fix: false this is read-only. With fix: true this MUTATES the listed source files in place (review with git diff!) and writes one new secret per finding to the keyring. Returns a JSON array of { file, line, key, value, kind } findings, or 'No hardcoded secrets found in the specified files.'.

ParametersJSON Schema
NameRequiredDescriptionDefault
fixNoIf true, rewrite the source files to read `process.env.KEY` and store the extracted value in the keyring. If false (default), only report findings.
filesYesAbsolute or relative paths to lint. Non-existent paths surface as scan errors.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description clearly discloses that with fix:true it mutates files and writes to keyring, warns to review with git diff, and describes read-only vs mutation. Lacks authorization details but is still strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is dense yet clear, front-loaded with purpose, each sentence adds value, and uses line breaks for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers return format, different fix behaviors, sibling tool references, and parameter nuances. Missing error handling or performance details, but adequate for a 6-param tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (baseline 3), but description adds context like 'Non-existent paths surface as scan errors' and clarifies scope defaults and requirements, going beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb 'Inspect' and resource 'a specific list of files for hardcoded secrets', and explicitly distinguishes from siblings like scan_codebase_for_secrets and import_dotenv.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool ('migrate a known set of files') and when to prefer alternatives ('whole-tree audit', 'ingest an existing .env'), including the condition for fix mode.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_hooksA

[hooks] Enumerate every registered lifecycle hook with its match criteria, delivery type, enabled flag, and description. Use to find a hook's id before calling remove_hook, audit what side effects are wired up, or diagnose why a hook did not fire. Read-only. Returns pretty-printed JSON array of hook entries, or 'No hooks registered' when the registry is empty.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: it is read-only, returns a pretty-printed JSON array of hook entries or 'No hooks registered' when empty. This gives the agent a clear expectation of side effects and output format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (three sentences) and front-loaded with the verb 'Enumerate'. Every sentence adds value: purpose, usage, output format. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a no-parameter listing tool. It explains the action, returned fields, output format, and edge case (empty registry). No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so the description need not add param details. It correctly implies no inputs are needed. Baseline 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Enumerate every registered lifecycle hook' and specifies the fields returned (match criteria, delivery type, enabled flag, description), making the tool's purpose explicit. It also distinguishes from siblings like `remove_hook` by mentioning finding the hook's `id` before removal.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage scenarios: 'Use to find a hook's `id` before calling `remove_hook`, audit what side effects are wired up, or diagnose why a hook did not fire.' This clearly guides when to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_providersA

[validation] Enumerate the secret-validation providers q-ring knows how to call (OpenAI, Stripe, GitHub, …) along with their auto-detect prefixes. Use to discover what provider string to pass to validate_secret/rotate_secret, or to check whether your custom provider is registered. Read-only. Returns JSON array of { name, description, prefixes } objects. prefixes are the literal key-value prefixes (e.g. 'sk-' for OpenAI) used for auto-detection.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses read-only nature and return structure (JSON array of objects with name, description, prefixes). Could add details about auth or performance but sufficient for a simple list tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with purpose, then usage, then return format. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless listing tool with no output schema, the description fully covers behavior, return structure, and usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters, schema coverage 100%. Baseline 4 applies as description doesn't need to add parameter info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it enumerates secret-validation providers, provides examples, and distinguishes from sibling tools like validate_secret and rotate_secret by stating its role in discovering provider strings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use this tool: to discover provider strings for validate_secret/rotate_secret or to check custom provider registration. No exclusions needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_secretsA

[secrets] List secret keys and quantum metadata in the requested scope, never the values. Use to discover what secrets exist before reading or writing; pair with inspect_secret for full metadata on one key, analyze_secrets for usage trends, or health_check for decay/anomaly summaries. Read-only; safe to call repeatedly. Returns JSON { ok, data: { entries: [...] } } where each entry has scope, key, stateKeys (env names if superposed), expired, stale, lifetimePercent, timeRemaining, entangledCount, accessCount.

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNoReturn only secrets that include this exact tag (case-sensitive). Example: 'production'.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
staleNoIf true, return only secrets in the stale window (lifetimePercent >= 75 and not yet expired).
filterNoGlob pattern matched against the key name. Supports `*` and `?`. Examples: 'API_*', 'STRIPE_?_KEY'.
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
expiredNoIf true, return only secrets whose decay TTL has elapsed (lifetimePercent >= 100).
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description fully discloses behavior: it returns metadata only ('never the values'), is read-only, and is safe to call repeatedly. Return format and fields are detailed, leaving no ambiguity about side effects or data exposure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the purpose, then provide usage guidance and return format. No unnecessary words, well-structured for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 8 parameters and no output schema, the description covers purpose, usage, return structure, and field meanings. It lacks only minor details like pagination or error conditions, which are often handled by the schema or assumed for list operations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description does not add extra parameter-level meaning beyond what's in the schema. It effectively explains the overall behavior but does not deepen parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List secret keys and quantum metadata in the requested scope, never the values.' It distinguishes from sibling tools like inspect_secret, analyze_secrets, and health_check, making its unique purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance: 'Use to discover what secrets exist before reading or writing' and pairs with alternative tools for different needs. States 'Read-only; safe to call repeatedly,' providing clear context for when to invoke.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

register_hookA

[hooks] Register a side-effect (shell command, HTTP webhook, or process signal) that fires automatically when a matching secret is written, deleted, or rotated. Use to keep external systems in sync (restart a service after rotation, post to Slack on delete, kick a build); prefer agent_remember for storing facts an agent should recall later, and register_hook is not the right tool for time-based scheduled rotation (use agent_scan for that). Mutates the hook registry on disk. At least one match criterion (key, keyPattern, or tag) is required — calls without any return an error. Returns JSON of the registered hook entry including its assigned id (use that id with remove_hook).

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoTrigger only on this exact key name. Pick at most one of `key` / `keyPattern` / `tag` (or combine for stricter matching).
tagNoTrigger on any secret carrying this exact tag. Combinable with key/keyPattern as an AND filter.
urlNoRequired when type='http'. Full URL to POST a JSON body `{ id, key, scope, action, timestamp }` to (the value itself is never sent).
typeYesHook delivery mechanism. 'shell' runs a local command, 'http' POSTs JSON to a URL, 'signal' sends an OS signal to a named process.
scopeNoRestrict the hook to secrets in this scope. Omit to fire across both global and project secrets.
actionsNoWhich lifecycle actions trigger this hook. Defaults to all three.
commandNoRequired when type='shell'. The literal shell command to run; q-ring exposes the matching key as $QRING_HOOK_KEY and action as $QRING_HOOK_ACTION.
keyPatternNoTrigger on any key matching this glob pattern. Examples: 'DB_*', 'STRIPE_*'.
signalNameNoSignal name to send (e.g. 'SIGHUP', 'SIGUSR1'). Defaults to SIGHUP, which most daemons treat as 'reload config'.SIGHUP
descriptionNoFree-text human-readable description, surfaced by `list_hooks` and the dashboard.
signalTargetNoRequired when type='signal'. Either a numeric PID or a process name resolvable via `ps`.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description fully discloses mutation side-effect ('Mutates the hook registry on disk'), return value ('Returns JSON...including its assigned `id`'), and error behavior. Explains trigger mechanism and delivery details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured: starts with purpose, then usage guidelines, then behavioral details. No redundant sentences; each sentence adds value. Appropriate length given tool complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema or annotations, the description covers purpose, behavior, error conditions, return value, and parameter relationships. Complete for a complex tool with 11 parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed descriptions, so baseline is 3. The description adds extra context by explaining conditional requirements (e.g., 'Pick at most one of...') and combining filters, justifying a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool registers a side-effect hook that fires on secret lifecycle events. It distinguishes from siblings like `agent_remember` and `agent_scan` by specifying different use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance on when to use this tool vs alternatives (e.g., 'prefer `agent_remember` for storing facts...'). Also notes the requirement for at least one match criterion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

remove_hookA

[hooks] Detach a single lifecycle hook by its registry id so it stops firing. Use to retire a specific webhook/command without touching any secrets; prefer delete_secret to remove a credential and tunnel_destroy for ephemeral tunnels. Mutates the hook registry only — does not touch secret values, audit log, or env states. Idempotent in spirit: removing an already-absent id returns a not-found error rather than partial work. Returns 'Removed hook ID' on success.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesHook id returned by `register_hook` or visible in `list_hooks` (opaque string).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully bears the transparency burden. It discloses that the tool only mutates the hook registry, does not affect secrets or audit logs, is idempotent in spirit (returns error on absent id), and specifies the success output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct, uses clear terminology, and is structured with the key action at the start, followed by usage context and behavioral details. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no annotations, no output schema), the description covers all necessary aspects: purpose, usage, behavior, limitations, and return indication. It is fully adequate for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter, and the description merely repeats the schema's description. No additional semantic value is provided beyond what the schema already offers, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Detach') and resource ('single lifecycle hook'), clearly distinguishing the tool's purpose. It also differentiates from sibling tools by mentioning alternatives like `delete_secret` and `tunnel_destroy`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('to retire a specific webhook/command without touching any secrets') and provides clear alternatives for other operations, making it easy for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rotate_secretA

[validation] Ask the upstream provider to issue a fresh credential for this secret and store the new value back into the keyring. Use when a secret is expiring, leaked, or part of a scheduled rotation; prefer generate_secret for self-managed values you fully control, and agent_scan --autoRotate for sweep-style rotation across multiple expired keys. Mutates the keyring with the newly-issued value if rotation succeeds (one 'write' audit event), and makes outbound network requests against the provider's rotation API. Returns JSON { rotated, newValue?, message?, ... }. If rotated is false, the existing value is left untouched.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesExact key to rotate. Must already exist in the keyring.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
providerNoForce a specific provider id (see `list_providers`). Omit to auto-detect from the current value or the secret's stored provider hint.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool mutates the keyring with a new value (one write audit event), makes outbound network requests to the provider's rotation API, and returns a specific JSON format. It also notes that if rotated is false, the existing value is left untouched. Could mention error handling more explicitly, but overall transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph but well-structured: begins with a [validation] tag, then action, usage guidelines, behavioral notes, and return format. Every sentence adds value, but the structure could be slightly improved with separation of concerns.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description provides the return JSON structure. It covers usage, alternatives, behavioral impacts, and return format. All 6 parameters are documented in the schema. Minor gap: does not explicitly mention prerequisites like needing a configured provider, but that is implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal additional context beyond what is in the schema (e.g., mentioning provider auto-detection). Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Ask the upstream provider to issue a fresh credential... and store the new value back into the keyring.' It distinguishes from siblings by referencing generate_secret for self-managed values and agent_scan for sweep-style rotation, providing clear differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: 'when a secret is expiring, leaked, or part of a scheduled rotation.' It also provides alternatives: 'prefer generate_secret for self-managed values you fully control, and agent_scan --autoRotate for sweep-style rotation across multiple expired keys.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_codebase_for_secretsA

[scan] Walk a directory tree and flag plausible hardcoded secrets using regex heuristics plus Shannon-entropy scoring on string literals. Use as a one-shot 'is anything leaking in this repo?' audit before commit/release; prefer lint_files when you already know the specific files to check (and want optional auto-fix). Read-only — never modifies source files. Honors .gitignore. Returns JSON array of { file, line, key, value, kind } findings, or 'No hardcoded secrets found in the specified directory.' when clean. False positives are possible — review before treating as ground truth.

ParametersJSON Schema
NameRequiredDescriptionDefault
dirPathYesDirectory to scan, absolute or relative to the server cwd. The scan recurses into subdirectories.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description fully covers behavioral traits: read-only, honors .gitignore, returns JSON array or clean string, mentions false positives. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a verb and purpose, and each sentence contributes necessary detail. Slightly long but efficient; could be tightened slightly without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description fully explains input, behavior, output format, and caveats. Completely sufficient for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter dirPath, but the description adds meaningful context: absolute/relative to cwd, recursion, and a link to .gitignore. This adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a directory tree for hardcoded secrets using regex heuristics and entropy scoring. It distinctively separates from sibling tool `lint_files` by specifying its one-shot audit nature and when to use each.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use (before commit/release audit) and when to prefer `lint_files` (specific files, optional auto-fix). Provides clear context and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_secretA

[secrets] Create or overwrite a single secret value, optionally with TTL/decay, per-env superposition, description, tags, and rotation hints. Use to add or update one key at a time; prefer import_dotenv for bulk .env ingest, generate_secret (with saveAs) to generate-and-store in one step, and entangle_secrets instead of duplicating the same value under two keys. Mutates the keyring (overwrites any existing value at the same key/scope), writes a 'write' event to the audit log, and triggers any matching hooks. Subject to tool policy. Returns a short confirmation text like '[scope] KEY saved' (or '[scope] KEY set for env:NAME' when env is provided).

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoIf set, writes this value to the named per-env state (superposition) instead of the default slot. Existing default value is preserved as state 'default'. Example: 'prod'.
keyYesSecret key name (UPPER_SNAKE_CASE recommended). Example: 'STRIPE_SECRET_KEY'.
tagsNoTag list for filtering and hook matching. Example: ['production', 'payments'].
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
valueYesThe secret value to store. Stored as-is; never logged or echoed. May be empty only when `env` is provided to register a new env without a default.
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
ttlSecondsNoQuantum decay window in seconds. After this many seconds the secret is marked expired (still readable, but `has_secret` returns false and `health_check` flags it). Omit for no decay.
descriptionNoFree-text human-readable description shown in `inspect_secret` and the dashboard.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.
rotationFormatNoFormat used by `agent_scan --autoRotate` and `rotate_secret` when this secret expires. Pick the format that matches the upstream service's accepted shape.
rotationPrefixNoLiteral prefix prepended on auto-rotation (only used with rotationFormat 'api-key' or 'token'). Example: 'sk-'.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and discloses mutation (overwrites), audit log writes, hook triggering, and policy subject. It lacks details on error handling or idempotency, but covers core behavioral traits well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph of about 4-5 sentences, covering purpose, alternatives, effects, and return format without redundancy. Slightly dense but concise and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 12 parameters, no output schema, and no annotations, the description is fairly complete but could elaborate on error scenarios and return value format further. Still provides a solid overview.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline 3. The description adds value by explaining per-env superposition and rotation hints beyond schema, justifying a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates or overwrites a single secret value with multiple options (TTL, per-env, etc.), and explicitly distinguishes from sibling tools like import_dotenv, generate_secret, and entangle_secrets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use and when-not-to-use guidance, referencing specific alternatives for bulk import, generation, and duplication, and mentions side effects like mutation, audit logging, and hooks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

status_dashboardA

[dashboard] Start a local web dashboard (http://127.0.0.1:PORT) that streams live KPIs, secret tables, manifest gaps, hooks, audit events, and anomalies via Server-Sent Events. Use when an operator (or an agent on behalf of one) wants a richer visual surface than chat output; prefer health_check / analyze_secrets for one-shot text summaries inside the conversation. Side effect: binds an HTTP server on the requested port (one process-wide instance — re-running returns the existing URL instead of starting a second server). Never exposes secret values. Returns the URL string to open in a browser.

ParametersJSON Schema
NameRequiredDescriptionDefault
portNoTCP port to listen on (default 9876). Pick another port if 9876 is already in use; the call fails if binding errors.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses key behaviors: binds HTTP server, one process-wide instance (re-running returns existing URL), never exposes secret values, returns URL string. Also notes failure on port binding errors. No annotations exist, so description carries full burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise yet comprehensive, with a clear front-loaded purpose followed by usage guidelines and behavior notes. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description explains the return value (URL string). It covers the tool's behavior, side effect, and safety (no secret exposure). Context signals like sibling tools and parameter count align with a complete definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'port'. The description adds context beyond the schema by noting to pick another port if 9876 is in use and that binding errors cause failure, which the schema description does not mention.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb 'Start' and specifies the resource as a local web dashboard streaming live data. It distinguishes from siblings by contrasting one-shot text summaries (health_check/analyze_secrets) with the richer visual surface.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance: use when an operator wants a richer visual surface, and prefer health_check/analyze_secrets for one-shot text summaries. Also mentions side effects like singleton server and port binding behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

teleport_packA

[teleport] Encrypt one or more secrets into a single AES-256-GCM bundle string that can be safely transferred between machines. Use to hand off a curated set of credentials to another developer or environment; prefer export_secrets for plaintext .env output (single machine, trusted) and tunnel_create for ephemeral one-shot delivery on the same machine. Reads each secret value (records 'export' audit events) and produces a base64-encoded ciphertext. The bundle is unreadable without the same passphrase via teleport_unpack. Returns the bundle string directly. Errors with 'No secrets to pack' if the filter matched zero secrets.

ParametersJSON Schema
NameRequiredDescriptionDefault
keysNoWhitelist of exact key names to include. Omit to pack every secret in the requested scope.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
passphraseYesSymmetric passphrase used to derive the AES-256-GCM key. The receiver must supply the same string to `teleport_unpack`. Pick something high-entropy and share it out-of-band.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses that each secret value is read (audit event recorded), bundle is base64-encoded ciphertext, requires same passphrase to unpack via teleport_unpack, and returns bundle string directly. Also mentions error message. No annotations present, so description carries full burden and meets it well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is a single paragraph that covers all needed information without excess. Could be slightly more structured (e.g., bullet points), but it is front-loaded with purpose and alternatives.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, behavior, return format, and error conditions. No output schema, but tool returns a simple string so not needed. Missing examples or deeper clarification on scope interaction, but overall complete for the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds minimal extra value beyond schema: mainly reinforces that passphrase must be shared out-of-band and that omitting keys includes all secrets. No significant additional semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly describes the tool as encrypting secrets into an AES-256-GCM bundle for transfer between machines. Distinguishes from siblings export_secrets and tunnel_create with specific use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (hand off curated credentials to another developer or environment) and when not to use (prefer export_secrets for .env output, tunnel_create for ephemeral delivery). Also mentions error condition when no secrets match.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

teleport_unpackA

[teleport] Decrypt a bundle produced by teleport_pack and import each contained secret into the local keyring. Use on the receiving machine after a packer hands you the bundle and passphrase out-of-band; prefer dryRun=true first to preview what will be written. When dryRun is false this mutates the keyring (one 'write' event per imported secret) at the requested scope. Bad passphrase or tampered bundle returns JSON { ok: false, error: { message } } with isError: true. On success returns 'Imported N secret(s) from teleport bundle'; in dryRun mode returns 'Would import N secrets:' followed by a KEY [scope] listing.

ParametersJSON Schema
NameRequiredDescriptionDefault
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).global
bundleYesBase64-encoded ciphertext returned by `teleport_pack`. Pass through whitespace untouched if possible.
dryRunNoIf true, decrypt and report what would be written but do not mutate the keyring. Useful for verifying bundle contents before commit.
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
passphraseYesThe same passphrase that was used to pack this bundle. Bad passphrases return an authentication error rather than wrong plaintext.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses keyring mutation (unless dryRun), error handling for bad passphrase/tampered bundle, and output format. It also mentions 'one write event per imported secret' but could further clarify isError behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise (two sentences) and front-loaded with purpose. The second sentence is dense but informative. Minor room for structuring into bullet points for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description covers return values for success, dryRun, and errors. Parameter descriptions are complete. It explains the workflow and keyring mutation. Adequate for a complex tool with 7 parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing thorough parameter descriptions. The description adds minor extra context (e.g., whitespace handling for bundle) but largely duplicates schema info. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it decrypts a bundle and imports secrets into the local keyring, using specific verb 'Decrypt' and resource 'bundle produced by teleport_pack'. It distinguishes from the packing counterpart teleport_pack.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage guidance: use on the receiving machine after out-of-band passphrase exchange, and prefer dryRun=true first. It implicitly defines when not to commit blindly but does not explicitly exclude other sibling tools like 'set_secret' or 'import_dotenv'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tunnel_createA

[tunnel] Stash a one-shot or short-lived secret in the q-ring server's process memory and return an ID that can be used to read it back. Use for handing a one-time value to another tool/process without persisting it (npm OTP codes, magic-link tokens, copy/paste between machines via a relay); prefer set_secret with ttlSeconds when you actually want a tracked, auditable secret. Mutates only in-memory state — the value never touches disk and is lost on server restart. Subject to tool policy. Returns JSON { ok, data: { id } } where id is an opaque string to pass to tunnel_read/tunnel_destroy.

ParametersJSON Schema
NameRequiredDescriptionDefault
valueYesThe plaintext value to tunnel. Held only in process memory; never logged.
maxReadsNoSelf-destruct after this many successful `tunnel_read` calls. Use 1 for true one-shot delivery.
ttlSecondsNoAuto-destroy the tunnel after this many seconds. Omit for no time limit (then a `maxReads` is highly recommended).

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries full burden. It fully discloses in-memory storage, no disk persistence, restart loss, tool policy subjection, and return format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense paragraph, efficiently packed with information. Could be slightly more structured, but no waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-param tool with no output schema or annotations, description covers purpose, usage, behavior, parameters, and return value completely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of params, but description adds context: explains maxReads for one-shot, ttlSeconds for auto-destroy, and value never logged. Adds meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb (stash), resource (secret in process memory), and action (return ID). Differentiates from sibling set_secret by specifying one-shot/short-lived use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use this tool vs set_secret, and provides context for one-time values, magic links, etc. Also notes constraints like in-memory only and lost on restart.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tunnel_destroyA

[tunnel] Immediately remove a tunnel from memory, regardless of remaining reads or TTL. Use when a tunneled value should be cancelled before delivery (e.g. wrong recipient, secret already rotated); prefer letting maxReads/TTL handle cleanup for normal flows. Mutates in-memory state only. Returns 'Destroyed ID' on success or a not-found error if the ID is unknown or already gone.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe opaque tunnel ID to destroy.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses key traits: immediate removal regardless of remaining reads/TTL, in-memory mutation, and return values including error for unknown or already destroyed IDs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise with three front-loaded sentences that convey the action, usage, and behavior without extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage, behavior, and return values. It does not mention how to obtain the tunnel ID, but that is a minor gap given the one-parameter simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the 'id' parameter with a suitable description. The tool description adds no extra semantics beyond what the schema provides, so it meets the baseline for 100% coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool immediately removes a tunnel from memory, specifying the resource and verb. It distinguishes from sibling tools like tunnel_read and tunnel_create by noting the cancellation use case and preferring normal cleanup via maxReads/TTL.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises when to use the tool (cancel before delivery, e.g., wrong recipient) and when to avoid it (let maxReads/TTL handle normal flows), providing clear context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tunnel_listA

[tunnel] Enumerate all currently-active tunnels in the q-ring server with their remaining read budget and time-to-live. Use to audit what is still in memory or to look up an ID you forgot; values are never included in the output. Read-only. Returns one line per tunnel formatted as id | reads:N | max:N | expires:Ns, or the literal text 'No active tunnels' when the list is empty.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and excels: it explicitly labels the operation as 'Read-only', describes the exact output format ('id | reads:N | max:N | expires:Ns'), handles the empty case ('the literal text 'No active tunnels''), and discloses a key behavioral constraint ('values are never included'). This goes beyond any schema info since the schema is empty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the core action and result, the second gives usage scenarios and an important exclusion, and the third provides the exact output format and empty response. No sentence is wasted, and the structure aids quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, parameterless list tool with no output schema, the description is complete: it specifies the operation, the data fields returned, the formatting, the empty case, and the read-only nature. It leaves no ambiguity about what the agent will receive or how to interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema covers all of them (vacuously at 100%). Per the rubric, a baseline of 4 is appropriate when there are no parameters; the description adds no parameter-specific details because none are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Enumerate'), a specific resource ('all currently-active tunnels in the q-ring server'), and the exact data returned ('remaining read budget and time-to-live'). It distinguishes itself from siblings like tunnel_read by explicitly noting 'values are never included in the output', making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage contexts: 'Use to audit what is still in memory or to look up an ID you forgot.' It also implicitly warns against using this for value retrieval ('values are never included'), but it does not explicitly name an alternative tool like tunnel_read. This is clear context without a formal when-not-to-use list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tunnel_readA

[tunnel] Fetch the value stashed by a prior tunnel_create call by its ID. Use exactly once per intended consumer; the value is destructive-by-design and may self-delete after this call. Increments the read counter and may auto-destroy the tunnel if maxReads was set. Returns JSON { ok, data: { id, value } } on success, or an error 'Tunnel "..." not found or expired' if the tunnel has been destroyed, hit its TTL, or never existed.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe opaque tunnel ID returned by `tunnel_create`. Case-sensitive.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Fully discloses destructive behavior, increments read counter, may auto-destroy based on maxReads, and lists error conditions (not found/expired). No annotations provided, so description carries full burden and meets it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, first states purpose, second covers usage and return. No fluff, every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, description provides complete return format and error messages. Covers all relevant aspects for a simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and description adds minimal extra beyond schema's parameter description (only error format). Baseline of 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'Fetch' and resource 'value by ID', distinguishes from siblings like tunnel_create and tunnel_destroy, and mentions exactly-once usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly specifies 'Use exactly once per intended consumer', explains destructive-by-design nature, and describes conditions for auto-destruction. Provides error cases and return format.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_secretA

[validation] Test whether a stored secret is still accepted by its upstream service (OpenAI, Stripe, GitHub, AWS, generic HTTP, etc.) by making a minimal authenticated request. Use to confirm liveness before relying on a credential or as the verification step after rotate_secret; prefer ci_validate_secrets for a batch run across every key in scope. Side effects: makes one outbound network request per call (may incur tiny provider-side rate-limit cost). Records 'read' for the underlying secret value in the audit log; the value itself is never logged. Returns JSON { valid, provider, status?, message?, rateLimit?, ... } (provider-specific shape).

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe exact key whose value should be tested upstream. Example: 'OPENAI_API_KEY'.
orgIdNoOrganization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'.
scopeNoWhere the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId).
teamIdNoTeam identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'.
providerNoForce a specific provider id. Built-ins include 'openai', 'stripe', 'github', 'aws', 'http'. Omit to auto-detect from the value's prefix or the secret's stored provider hint.
projectPathNoAbsolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description fully carries the burden. It discloses side effects: outbound network request, potential rate-limit cost, audit logging of 'read' without logging the secret value. Sufficient for safe usage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a leading category tag [validation] and uses clear sentence breaks. It is concise given the amount of useful information, though slightly verbose in listing return fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 6 parameters, 100% schema coverage, no output schema, the description provides return shape (JSON with fields), side effects, usage guidance, and behavioral notes. Everything an agent needs is included.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema already provides 100% parameter descriptions, but the description adds practical guidance (e.g., 'Force a specific provider id' and auto-detection behavior). This enhances understanding beyond the schema, though not drastically.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action: testing whether a stored secret is accepted by its upstream service. The specific verb 'validate' and resource 'secret' are unambiguous, and the description distinguishes from sibling tools like 'ci_validate_secrets' and 'rotate_secret'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use (confirm liveness, verify after rotation) and when to prefer an alternative (batch run via 'ci_validate_secrets'). This provides clear context for appropriate invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_audit_chainA

[audit] Recompute the SHA-256 hash chain over the audit log and confirm no event has been mutated, deleted, or reordered. Use periodically as a tamper-evidence check, or whenever you suspect the audit log has been touched outside q-ring; the result is informational — this tool does not repair the chain if it is broken. Read-only. Returns JSON { ok, valid, brokenAt? } where valid is true for an intact chain and brokenAt (when present) names the first event whose hash did not match.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully bears the burden of behavioral disclosure. It states the tool is read-only, informational, does not repair, and describes the exact return format including fields and meanings. No contradictions or gaps are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with each sentence adding value: it states purpose, usage context, limitations, and return format. No extraneous content or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, and zero parameters, the description is complete. It covers what the tool does, when to use it, its behavioral traits, and the return structure, leaving no critical gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and schema coverage is 100% (empty). Per guidelines, baseline is 4. The description adds no parameter details because none exist, which is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool verifies the SHA-256 hash chain over the audit log to detect tampering. It specifies the action ('Recompute' and 'confirm') and the resource ('audit chain'), and distinguishes from sibling tools like 'audit_log' and 'export_audit' by focusing on integrity verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly suggests when to use the tool ('periodically as a tamper-evidence check' or 'whenever you suspect the audit log has been touched'). It also states what the tool does not do ('does not repair the chain'), implying when not to rely on it for repair. However, it does not mention alternative tools or explicitly state alternative actions, missing a point for full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4.3/5.0
Disambiguation4/5

Each tool has a clearly defined purpose with detailed descriptions that differentiate it from others, even in similar categories like health checks (health_check, check_project, agent_scan) or secret output (export_secrets, env_generate). Very few tools could be confused.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern with underscores, e.g., agent_forget, list_secrets, validate_secret. No mixing of conventions like camelCase, making it predictable for agents.

Tool Count2/5

With 44 tools, the set is significantly larger than the recommended range (3-15) and crosses the 'too many' threshold (>25). Although the domain is broad, the count is likely to overwhelm agents and increase selection errors.

Completeness4/5

The tool surface covers CRUD for secrets, audit, policy, project management, tunnels, teleport, scanning, validation, and hooks. Minor gaps exist (e.g., batch metadata update, secret search), but core workflows are well-supported.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Provides Claude Code with access to personal secrets and notes stored in a local Markdown file. It enables users to list, search, retrieve, and update secret sections through natural language commands.
    5
    13
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Local AES-256-GCM encrypted vault for AI agents. Resolve {{PLACEHOLDER}} secrets in prompts at runtime — LLMs never see real API keys. Argon2id key derivation, zero cloud.
    2
    84
    2
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Encrypted secrets vault that blinds AI agents to API keys. Stores secrets in AES-256-GCM encrypted SQLite vault, resolves them at runtime via MCP values never appear in LLM conversation transcripts. Sandbox .env files with deterministic fakes.
    7
    73
    3
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/I4cTime/q-ring'

If you have feedback or need assistance with the MCP directory API, please join our Discord server