export_secrets
Render selected secrets as a single .env or JSON document for export or piping. Filter by keys, tags, environment, and scope.
Instructions
[secrets] Render multiple secrets as a single .env or JSON document for piping into another tool or file. Use to materialize secrets for a one-off export or copy; prefer env_generate when you want output driven by the project's .q-ring.json manifest, and teleport_pack for an encrypted bundle to share between machines. Reads values (collapses superposition for the requested env) and writes one 'export' event per included secret to the audit log. Returns the rendered text directly (no JSON wrapper). Returns an error if no secrets matched the filters. Values are surfaced in plaintext — handle with care.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment slug used to collapse superposition when a secret has multiple per-env states. Examples: 'dev', 'staging', 'prod'. If omitted, the secret's defaultEnv is used. | |
| keys | No | Whitelist of exact key names to include. If omitted, every key in scope is considered (subject to `tags`). | |
| tags | No | Include only secrets tagged with at least one of these tags. Combined with `keys` as an AND filter when both are supplied. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| format | No | 'env' renders KEY="value" lines suitable for a .env file; 'json' renders an object keyed by secret name. Defaults to 'env'. | env |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |