entangle_secrets
Link two secrets so updates to one automatically update the other. Prevents credential drift across different names or scopes.
Instructions
[secrets] Link two keys (across the same or different scopes) so future writes/rotations of either propagate the same value to the other. Use when one logical credential lives under multiple names (e.g. STRIPE_SECRET_KEY global and project) and should never drift; prefer set_secret for unrelated values, and reverse the link with disentangle_secrets (does not delete values). Mutates only the metadata of both envelopes — the values themselves are not changed by this call. Idempotent: re-running on an already-entangled pair is a no-op. Subject to tool policy. Returns a short confirmation: 'Entangled: SOURCE <-> TARGET'.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sourceKey | Yes | First secret key in the pair. Example: 'STRIPE_SECRET_KEY'. | |
| targetKey | Yes | Second secret key to keep in lockstep with the source. | |
| sourceScope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | global |
| targetScope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | global |
| sourceProjectPath | No | Project root for sourceKey when sourceScope='project'. Defaults to the server cwd. | |
| targetProjectPath | No | Project root for targetKey when targetScope='project'. Defaults to the server cwd. |