sm_rotate_secret
Rotate a secret in IBM Cloud Secrets Manager to replace its value with a new one, maintaining security posture.
Instructions
Rotate a secret
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | ||
| secret_id | Yes | ||
| payload | No | New value (for arbitrary) | |
| region | No |
Implementation Reference
- src/tools/security/index.ts:43-48 (registration)Registration of the sm_rotate_secret tool with schema and handler on the MCP server.
server.tool("sm_rotate_secret", "Rotate a secret", { instance_id: z.string(), secret_id: z.string(), payload: z.string().optional().describe("New value (for arbitrary)"), region: z.string().optional(), }, async (p) => safeTool(async () => { w(); return client.post(`${sm(p.instance_id,p.region)}/secrets/${p.secret_id}/rotate`, p.payload?{payload:p.payload}:{}); })); - src/tools/security/index.ts:44-46 (schema)Zod schema defining input parameters: instance_id, secret_id, optional payload, optional region.
instance_id: z.string(), secret_id: z.string(), payload: z.string().optional().describe("New value (for arbitrary)"), region: z.string().optional(), }, async (p) => safeTool(async () => { w(); - src/tools/security/index.ts:46-48 (handler)Handler function that asserts write permission and POSTs to the Secrets Manager rotate endpoint with optional payload.
}, async (p) => safeTool(async () => { w(); return client.post(`${sm(p.instance_id,p.region)}/secrets/${p.secret_id}/rotate`, p.payload?{payload:p.payload}:{}); })); - src/lib/utils.ts:10-14 (helper)Helper utility 'assertWriteAllowed' called via w() in the handler to guard write operations.
/** * Check if write operations are allowed, throw if not. */ export function assertWriteAllowed(allowWrite: boolean): void { - src/lib/utils.ts:70-77 (helper)Helper utility 'safeTool' that wraps the handler execution with error handling for MCP responses.
export async function safeTool<T>(fn: () => Promise<T>): Promise<ReturnType<typeof successContent> | ReturnType<typeof errorContent>> { try { const result = await fn(); return successContent(result); } catch (error) { return errorContent(error); } }