List all available passkey entries.

Returns the names of all secret entries stored in the system keychain. Each entry can contain multiple key-value secret pairs.

Returns: List of entry names (e.g., ["slack", "github", "aws"])

List field names in a passkey entry (without revealing values).

Returns the names of secret fields stored in the specified entry. This allows discovering what secrets are available without exposing the actual secret values.

Args: entry_name: Name of the passkey entry (e.g., "slack")

Returns: List of field names (e.g., ["SLACK_TOKEN", "SLACK_COOKIE"])

Raises: Exception: If entry not found or keychain access fails

Show security status of MCP servers across all detected tools.

Analyzes configs for Claude, Gemini, VS Code, Cursor, OpenCode, Windsurf, Cline, and Zed to identify which MCP servers have their secrets secured via passkey and which still have credentials exposed in plaintext.

Returns: Dictionary with per-tool server status and summary counts

Run diagnostics on passkey and MCP configurations.

Checks for common issues including:

• Config file existence and validity for all detected tools

• Passkey command availability in PATH

• Keychain access permissions

• MCP servers with missing passkey entries

• MCP servers with exposed secrets

• (deep=True) entry age analysis and bundle file permissions

Args: deep: Include extended checks (entry age, bundle permissions)

Returns: Dictionary with diagnostic results

Update MCP config files to use passkey wrapper for a server.

Prerequisites: Entry must already exist in passkey keychain.

Args: server_name: Name of the server (must match passkey entry) config_paths: Config files to update (default: all detected configs)

Returns: - configs_updated: List of updated config paths - configs_skipped: List of configs where server not found - errors: Any errors encountered