Run a command with a Stillvault secret
stillvault_runRun a local command, resolving stillvault:// secret references after a human approves the release. The secret is injected into the child process and never returned to you.
Instructions
PREFERRED way to use a secret. Runs a local command, resolving any stillvault://<path> references after a named human approves the release. The secret is injected into the child process and is NEVER returned to you or shown in this conversation — you get only the command's output. The call blocks until a human approves on their device (or times out). Examples: run psql with stillvault://db/prod/dsn as an argument, or curl an API with a key in a header. Prefer this over stillvault_reveal whenever you just need to use the secret rather than read its value.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | The executable to run, e.g. "psql", "curl", or "./deploy.sh". | |
| args | No | Arguments to pass. Any `stillvault://<path>` here is replaced with the secret value after approval. To embed a reference inside a longer string, wrap it: `{{stillvault://<path>}}` (e.g. `url={{stillvault://api/base}}/v1`). Ignored for substitution when `secret_env` is used. | |
| secret_env | No | Environment variables for the child whose VALUES contain `stillvault://<path>` references (e.g. {"DATABASE_URL": "stillvault://db/prod/dsn"}). Using this switches to the safer mode where secrets go in the child's environment, not its command line. In this mode, references in `args` are passed through literally. |