aarifmms/keyblind

Overview Schema Source Related Servers Discussions Admin

resolve_secret

Resolve secrets by name from a configured vault, 1Password, Bitwarden, or environment variables at runtime, returning decrypted values just-in-time without exposing them in the LLM transcript.

Instructions

Resolve a secret by name using the configured backend (local vault, 1Password, Bitwarden, or env vars). Returns the decrypted value at runtime. The secret value is never visible in the LLM conversation transcript — it is resolved just-in-time for the current operation.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>"
    },
    "name": "resolve_secret"
  }
}

Input Schema

Name	Required	Description
`exp`	No	Expiry epoch seconds bound into the signature (required with agentId)
`name`	Yes	The name of the secret to resolve (e.g., OPENAI_API_KEY, DATABASE_URL)
`nonce`	No	Single-use nonce bound into the signature (required with agentId)
`token`	No	Org-issued short-lived access token (alternative to agentId)
`agentId`	No	Agent ID for signed, scope-enforced access (optional)
`signature`	No	Ed25519 signature over 'read:<name>:<nonce>:<exp>' in base64 (optional)

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedv0.9.2Oct 27, 2026

addedInput schema / properties / agentId

Added value: +{
+  "description": "Agent ID for signed, scope-enforced access (optional)",
+  "type": "string"
+}

addedInput schema / properties / exp

Added value: +{
+  "description": "Expiry epoch seconds bound into the signature (required with agentId)",
+  "type": "number"
+}

addedInput schema / properties / nonce

Added value: +{
+  "description": "Single-use nonce bound into the signature (required with agentId)",
+  "type": "string"
+}

addedInput schema / properties / signature

Added value: +{
+  "description": "Ed25519 signature over 'read:<name>:<nonce>:<exp>' in base64 (optional)",
+  "type": "string"
+}

addedInput schema / properties / token

Added value: +{
+  "description": "Org-issued short-lived access token (alternative to agentId)",
+  "type": "string"
+}

First observedv0.1.4May 27, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and discloses important behavior: it returns a decrypted value at runtime and asserts that the value is never visible in the LLM conversation transcript. It does not cover authentication requirements, audit behavior, or failure modes, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences with the core action front-loaded and no wasted language. Each sentence contributes either purpose, return behavior, or the security-relevant transcript guarantee.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter, security-sensitive resolution tool with no output schema and no annotations, the description explains the high-level return and secrecy behavior but omits how token/agentId/signature authentication modes interact. The rich schema mitigates this, but the description is only minimally complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains parameters such as token, agentId, signature, nonce, and exp. The description only reinforces the "name" parameter and adds no meaningful semantics beyond the schema, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ("Resolve a secret by name") and identifies supported backends, making the core purpose clear. It does not explicitly distinguish this tool from siblings such as list_secrets or team_resolve, so it stops short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies runtime use by saying the secret is "resolved just-in-time for the current operation," but it gives no explicit when-to-use guidance, exclusions, or comparison against alternatives like list_secrets or team_resolve. Usage is inferable but not directly specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.