delete_secret
Permanently remove a secret and all its environment states from the keyring. Use when a credential is retired or was created in error, as this action is destructive and irreversible.
Instructions
[secrets] Permanently remove a secret value (and all its env states) from the keyring for the given scope. Use when a credential is being retired or was created in error; prefer disentangle_secrets to break a sync link without erasing values, remove_hook to detach lifecycle callbacks, and tunnel_destroy for ephemeral tunnels. Destructive and not undoable from q-ring (no built-in trash). Writes a 'delete' event to the audit log and fires matching hooks. Returns 'Deleted "KEY"' on success or a not-found error if the key did not exist in the requested scope. Subject to tool policy.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Exact secret key name to delete. Example: 'OLD_API_KEY'. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |