teleport_unpack
Decrypt a bundle and import secrets into your keyring. Preview with dryRun=true to check contents before writing.
Instructions
[teleport] Decrypt a bundle produced by teleport_pack and import each contained secret into the local keyring. Use on the receiving machine after a packer hands you the bundle and passphrase out-of-band; prefer dryRun=true first to preview what will be written. When dryRun is false this mutates the keyring (one 'write' event per imported secret) at the requested scope. Bad passphrase or tampered bundle returns JSON { ok: false, error: { message } } with isError: true. On success returns 'Imported N secret(s) from teleport bundle'; in dryRun mode returns 'Would import N secrets:' followed by a KEY [scope] listing.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| orgId | No | Organization identifier for org-scoped secrets. Required only when scope='org'. Example: 'acme-corp'. | |
| scope | No | Where the secret lives. 'global' = user keyring (default if omitted on reads), 'project' = scoped to projectPath, 'team' = team-shared (needs teamId), 'org' = org-shared (needs orgId). | global |
| bundle | Yes | Base64-encoded ciphertext returned by `teleport_pack`. Pass through whitespace untouched if possible. | |
| dryRun | No | If true, decrypt and report what would be written but do not mutate the keyring. Useful for verifying bundle contents before commit. | |
| teamId | No | Team identifier for team-scoped secrets. Required only when scope='team'. Example: 'acme-platform'. | |
| passphrase | Yes | The same passphrase that was used to pack this bundle. Bad passphrases return an authentication error rather than wrong plaintext. | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |