check_secret
Verify secret availability and inspect metadata without consuming reads. Check status, read counts, and expiry before fetching from the Sirr vault.
Instructions
Check whether a secret exists and inspect its metadata — WITHOUT consuming a read. Use this to verify a secret is still available before fetching it, or to inspect read counts and expiry. Returns status (active/sealed), reads used/remaining, and expiry. A 'sealed' secret has exhausted its max_reads; it still exists but cannot be read.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Secret key name. Accepts 'sirr:KEYNAME', 'KEYNAME#id', or bare key name. |
Implementation Reference
- src/index.ts:614-643 (handler)The handler logic for the 'check_secret' tool, which performs a HEAD request to check the status of a secret without consuming it.
case "check_secret": { const rawKey = (args as { key: string }).key; const key = parseKeyRef(rawKey); const res = await fetchWithTimeout( `${SIRR_SERVER}${secretsPath(encodeURIComponent(key))}`, { method: "HEAD", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } }, ); if (res.status === 404) { return { content: [{ type: "text" as const, text: `Secret '${key}' not found or expired.` }] }; } const status = res.headers.get("X-Sirr-Status") ?? (res.status === 410 ? "sealed" : "active"); const readCount = res.headers.get("X-Sirr-Read-Count") ?? "?"; const readsRemaining = res.headers.get("X-Sirr-Reads-Remaining") ?? "unlimited"; const expiresAt = res.headers.get("X-Sirr-Expires-At"); const expiry = expiresAt ? formatTtl(parseInt(expiresAt, 10)) : "no expiry"; if (status === "sealed") { return { content: [{ type: "text" as const, text: `Secret '${key}' is sealed — all reads exhausted.\n Reads used: ${readCount}\n Expires: ${expiry}` }] }; } return { content: [{ type: "text" as const, text: `Secret '${key}' is active.\n Reads used: ${readCount}\n Reads remaining: ${readsRemaining}\n Expires: ${expiry}`, }], }; } - src/index.ts:152-168 (schema)Registration and input schema definition for the 'check_secret' tool.
name: "check_secret", description: "Check whether a secret exists and inspect its metadata — WITHOUT consuming a read. " + "Use this to verify a secret is still available before fetching it, or to inspect read counts and expiry. " + "Returns status (active/sealed), reads used/remaining, and expiry. " + "A 'sealed' secret has exhausted its max_reads; it still exists but cannot be read.", inputSchema: { type: "object" as const, properties: { key: { type: "string", description: "Secret key name. Accepts 'sirr:KEYNAME', 'KEYNAME#id', or bare key name.", }, }, required: ["key"], }, },