secrets-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SECRETS_MCP_VAULT | No | Override the vault path. Default vault location is %APPDATA%\secrets-mcp\vault.json. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| stage_secretA | Store any secrets in Use this the moment a user pastes an API key, token, or private key. The returned text is safe to repeat; the original was written to an encrypted local vault and is not returned. Args: text: the raw text containing the secret(s). name: optional handle to force, e.g. "stripe" -> {{stripe}}. |
| list_secretsA | List stored handles with fingerprints. Never returns secret values. |
| request_with_secretA | Call an API, substituting {{handle}} with the real secret server-side. Use this instead of writing the key into a shell command or curl. The key is injected here, outside the conversation, and the response is scrubbed before it comes back. Args: method: GET, POST, PUT, PATCH, DELETE. url: full URL; {{handle}} is allowed in the path or query. headers: e.g. {"Authorization": "Bearer {{stripe}}"}. body: request body; {{handle}} is substituted. |
| revoke_secretB | Delete a stored handle. The real secret is destroyed locally. |
| vault_infoB | Where the vault lives and how many handles it holds. No values. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose: store, list, use, delete, or inspect metadata. There is no overlap between staging, listing, requesting, revoking, and vault info.
Most tools follow a verb_noun pattern (stage_secret, list_secrets, revoke_secret), but request_with_secret includes an extra preposition and vault_info is noun-only. The deviations are minor and readability remains high.
Five tools is well-scoped for a secrets vault: create, list, use, delete, and inspect. Each tool earns its place without redundancy.
The surface covers the core lifecycle: stage, list, use in requests, revoke, and vault info. A minor gap is the lack of an explicit update or rotate operation, though stage_secret may overwrite handles implicitly.