teleport_pack
Encrypt selected secrets into an AES-256-GCM bundle using a passphrase. The base64 ciphertext can be safely transferred and decrypted by the recipient with the same passphrase.
Instructions
[teleport] Encrypt one or more secrets into a single AES-256-GCM bundle string that can be safely transferred between machines. Use to hand off a curated set of credentials to another developer or environment; prefer export_secrets for plaintext .env output (single machine, trusted) and tunnel_create for ephemeral one-shot delivery on the same machine. Reads each secret value (records 'export' audit events) and produces a base64-encoded ciphertext. The bundle is unreadable without the same passphrase via teleport_unpack. Returns the bundle string directly. Errors with 'No secrets to pack' if the filter matched zero secrets.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| keys | No | Whitelist of exact key names to include. Omit to pack every secret in the requested scope. | |
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| passphrase | Yes | Symmetric passphrase used to derive the AES-256-GCM key. The receiver must supply the same string to `teleport_unpack`. Pick something high-entropy and share it out-of-band. | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |