inspect_modal_secret
Lists key names inside a Modal secret without exposing values. Starts a short-lived container to read environment variable names, filtering out runtime defaults, so only secret-defined keys remain.
Instructions
List the KEY NAMES inside a Modal secret — never the values.
Modal exposes no API for this: neither the CLI, the SDK, nor the gRPC layer can read
a secret's contents, by design. The only way to see which keys a secret defines is to
mount it in a container and look at the environment variable names. So this tool
starts a short-lived container (`modal shell --secret ...`), prints the variable NAMES
only, and subtracts the ones the image and the Modal runtime would have set anyway.
That means, unlike every other read in this server, a call here **starts remote
compute and costs a few cents** (and takes tens of seconds — longer on the first run
for a given image, which has to be built). It is not a free lookup: use
list_modal_resources(resource="secrets") to see which secrets exist, and reach for
this only when you need to know what is inside one.
Values never leave the container: the probe is `compgen -e`, a bash builtin that
prints exported variable NAMES only, so no value is ever printed or read.
Args:
secret_name: Name of the secret, from list_modal_resources(resource="secrets").
env: Modal environment the secret lives in.
image: Optional container image. Omit it to use Modal's default image, which is
built to match this server's Python — that is the most reliable choice. Pass one
(e.g. "python:3.12-slim") if the workspace's image builder rejects that Python.
timeout_seconds: Max seconds to wait, including image build. Default 300.
Returns: {keys: [...names...], all_env_names: [...], filtered_out: n}. `all_env_names`
is the unfiltered list, so a key that looks like a runtime variable (e.g. one
literally named "PATH") is still visible rather than silently dropped.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | ||
| image | No | ||
| secret_name | Yes | ||
| timeout_seconds | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |