list_secrets
Discover secret keys and their quantum metadata without exposing values. Use to scan scopes before reading, inspecting, or analyzing secrets.
Instructions
[secrets] List secret keys and quantum metadata in the requested scope, never the values. Use to discover what secrets exist before reading or writing; pair with inspect_secret for full metadata on one key, analyze_secrets for usage trends, or health_check for decay/anomaly summaries. Read-only; safe to call repeatedly. Returns JSON { ok, data: { entries: [...] } } where each entry has scope, key, stateKeys (env names if superposed), expired, stale, lifetimePercent, timeRemaining, entangledCount, accessCount.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Return only secrets that include this exact tag (case-sensitive). Example: 'production'. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| stale | No | If true, return only secrets in the stale window (lifetimePercent >= 75 and not yet expired). | |
| filter | No | Glob pattern matched against the key name. Supports `*` and `?`. Examples: 'API_*', 'STRIPE_?_KEY'. | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| expired | No | If true, return only secrets whose decay TTL has elapsed (lifetimePercent >= 100). | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |