exec_with_secrets
Run shell commands with project secrets injected as environment variables; leaked secrets are redacted from stdout/stderr before output is returned.
Instructions
[exec] Run a child shell command with project secrets injected as environment variables and any leaked secret values redacted from captured stdout/stderr before they return to the agent. Use to let an agent run a script that needs credentials (npm run db:migrate, terraform plan, vercel deploy) without ever putting plaintext values in the chat; prefer env_generate if you need to write a .env file to disk and validate_secret for upstream liveness checks. Spawns a real child process — has whatever side effects the command itself causes (writes, network, exec). Subject to BOTH tool policy and exec policy (allowlist/denylist). Returns a text body with Exit code: N then STDOUT: and STDERR: blocks; both streams are scrubbed against the secret values that were injected.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | Positional arguments passed to `command`. Example: ['run', 'db:migrate']. Each element is passed verbatim with no extra shell parsing. | |
| keys | No | Whitelist of exact key names to inject. Omit to inject every secret in scope (subject to `tags`). | |
| tags | No | Inject only secrets carrying at least one of these tags. Combinable with `keys` as an AND filter. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| command | Yes | Executable name or full command to run. Example: 'pnpm', 'node', '/usr/bin/env'. Must be allowed by exec policy. | |
| profile | No | Exec sandbox profile. 'restricted' (default) limits PATH and inheritable env vars; 'ci' is restricted plus CI-friendly defaults (no TTY); 'unrestricted' inherits the full server environment — only pick this when you understand the leak risk. | restricted |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |