SecureCode
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get-secretA | Get a secret by name. By default, injects the value into a local file so it never appears in the AI conversation. Use reveal:true to see the raw value (audited as conscious action). Use cleanup:true to remove all injected secrets from disk. |
| list-secretsA | List all available secrets with their tags and expiration status. Returns names and metadata, never values. |
| create-secretB | Create a new secret. Secrets with the same name can coexist if they have different env tags. |
| renew-secretA | Renew an expired secret or change its TTL. Use this to reactivate expired secrets or extend expiration. |
| delete-secretA | Delete a secret (soft delete, can be recovered) |
| update-secretC | Update an existing secret's value, description, tags, or domain. Only provided fields are changed. |
| import-envA | Import secrets from .env files into SecureCode. For security, .env import must be done through the web interface — the AI agent never sees secret values during import. This tool provides the link to the import page. |
| export-envC | Export all secrets as .env or CSV format. Returns the full content with decrypted values. |
| get-statusA | Get your SecureCodeHQ account status: plan, usage limits, secrets count, and MCP server version. Useful to check remaining capacity and verify the server is up to date. |
| wake-sessionB | Wake (unlock) the session to start accessing secrets. Optionally restrict access to specific tag scope and set auto-sleep timer. |
| sleep-sessionA | Lock the session immediately. All secret access will be blocked until you wake it again. Use this when you finish working. |
| session-statusA | Check the current session status: active or sleeping, scope restrictions, and time remaining before auto-sleep. |
| byebyeA | End your work session. Locks the session, cleans up all injected secrets from disk, and says goodbye. Use this when you finish working for the day. |
| get-active-rulesA | List active MCP access rules. Read-only — rules can only be created or modified from the dashboard. Use this to understand why access to a secret was blocked. |
| onboardA | Start or continue the SecureCode onboarding. Guides the user through signup, .env import, API key creation, MCP configuration, and optional SDK setup — all from Claude Code. Call this tool multiple times to progress through the steps. |
| security-checkA | Analyze the project for security issues after SecureCode setup. Returns a list of actions the agent MUST execute to protect secrets. Call this after SDK installation. |
| helpB | Get SecureCode documentation: available tools, usage patterns, SDK setup, and common workflows. Use this to understand how to help the user with SecureCode. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Most tools have distinct purposes, but some potential confusion exists between 'byebye' and 'sleep-session' (both end sessions) and 'get-secret' and 'list-secrets' (both retrieve secret info). Descriptions help clarify differences, but overlap in session management and secret retrieval could cause misselection.
Tools follow a consistent verb-noun pattern (e.g., create-secret, delete-secret, update-secret) with clear, descriptive names. Minor deviations include 'byebye' (informal) and 'onboard' (single word), but overall naming is predictable and readable.
17 tools is slightly high but reasonable for a secrets management domain, covering operations like CRUD for secrets, session control, onboarding, and security checks. It feels comprehensive without being overly bloated, though some tools like 'help' and 'get-status' might be borderline essential.
The toolset provides complete coverage for secrets management: full CRUD (create, get, list, update, delete, renew), session lifecycle (sleep, wake, status), onboarding, import/export, security analysis, and documentation. No obvious gaps exist for the stated purpose, enabling agents to handle end-to-end workflows.