{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_9mejq8yt2had","handle":"seekrit-secrets-for-agents","url":"https://wellknown.network/agents/seekrit-secrets-for-agents","links":{"self":"https://wellknown.network/agents/seekrit-secrets-for-agents/record.json","html":"https://wellknown.network/agents/seekrit-secrets-for-agents","markdown":"https://wellknown.network/agents/seekrit-secrets-for-agents/record.md","api":"https://wellknown.network/api/v1/agents/seekrit-secrets-for-agents","status":"https://wellknown.network/api/v1/agents/seekrit-secrets-for-agents/status","claim":"https://wellknown.network/agents/seekrit-secrets-for-agents/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/seekrit-secrets-for-agents/claim.json","badge":"https://wellknown.network/agents/seekrit-secrets-for-agents/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/seekrit-secrets-for-agents/history","tools":"https://wellknown.network/api/v1/agents/seekrit-secrets-for-agents/tools"},"ard":{"identifier":"urn:air:mcp.seekrit.dev:server:seekrit-secrets-for-agents","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"seekrit — secrets for agents","summary":"Encrypted store for API keys and database URLs your code needs. Use them without reading them.","description":"Encrypted store for API keys and database URLs your code needs. Use them without reading them.","publisher":{"name":"dev.seekrit","url":null},"homepage":null,"repository":"https://github.com/mileszim/seekrit","version":"0.1.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://mcp.seekrit.dev/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-07-30T05:37:59.98447Z","publishedAt":"2026-07-30T05:37:59.98447Z","registryName":"dev.seekrit/remote-mcp"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"data.database","name":"Databases","confidence":1,"provenance":"derived"},{"slug":"security.secrets","name":"Secrets Management","confidence":1,"provenance":"derived"},{"slug":"commerce.ecommerce","name":"E-commerce Operations","confidence":0.859,"provenance":"derived"},{"slug":"dev.docs-lookup","name":"Documentation Lookup","confidence":0.54,"provenance":"derived"},{"slug":"infra.browser-automation","name":"Browser Automation","confidence":0.51,"provenance":"derived"}],"categories":["commerce","data","dev","infra","security"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 6h ago.","lastOkAt":"2026-10-09T19:26:42.468Z","lastProbedAt":"2026-10-09T19:26:42.468Z","statusComputedAt":"2026-10-09T19:28:21.158Z","reliability30d":{"probes":46,"successRate":1,"p50Ms":696,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":46,"ok":46,"authBoundaryOk":0,"serviceOk":46,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-09T19:26:42.468Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":937,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-09T13:29:42.458Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":612,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-09T06:20:51.361Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":848,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-08T23:21:58.402Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":482,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-08T16:29:06.283Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":717,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-08T10:24:44.764Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":1041,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-08T04:24:58.237Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":727,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-07T21:28:28.411Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":699,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-07T14:30:09.820Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":756,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}},{"at":"2026-10-07T07:27:33.200Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":726,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"toolsHash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}}],"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"package":null,"toolSurface":{"id":"ts_757sk4ckk9pc","endpointId":"ep_wqct26uy9mpw","hash":"32d3f186ee78757c3563bec8ce4770cf3a9a5e2caf2fb6cc6abe970391efb14f","toolCount":40,"serverName":"seekrit","serverVersion":"0.0.1","protocolVersion":"2025-06-18","firstSeenAt":"2026-09-21T09:28:41.546Z","lastSeenAt":"2026-10-09T19:26:42.464Z","observations":69,"toolNames":["signup","get_started","setup_local_crypto","local_tool_for","whoami","list_orgs","list_apps","list_envs","list_branches","list_groups","list_group_envs","list_env_groups","list_members","list_secrets","list_secret_versions","list_tokens","list_invites","kms_list_keys","list_lease_targets","list_leases","audit","billing","create_app","create_group","compose_group","uncompose_group","invite_member","rename_app","rename_group","restore_secret","delete_secret","revoke_token","revoke_invite","revoke_lease","kms_disable_key","kms_revoke_grant","delete_app","delete_group","delete_env","delete_branch"],"distinctSurfaces":3},"endpointFacts":[{"id":"ep_wqct26uy9mpw","url":"https://mcp.seekrit.dev/mcp","type":"mcp_streamable_http","factsCheckedAt":"2026-10-08T23:21:58.411Z","auth":{"observedAt":"2026-10-08T23:21:58.799Z","authRequired":false,"scheme":null,"resourceMetadata":null,"authorizationServer":null,"conformance":{"dpop":false,"rfc8414":false,"rfc9728":false,"pkceS256":false,"clientIdMetadataDocument":false,"dynamicClientRegistration":false}},"tls":{"observedAt":"2026-10-08T23:21:58.820Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"seekrit.dev","issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validFrom":"2026-09-17T03:15:28.000Z","validTo":"2026-12-16T04:15:22.000Z","daysToExpiry":67,"sanCount":3,"fingerprint256":"75:CD:DF:35:EF:18:4C:FC:17:3F:43:A3:0A:F3:06:9C:A3:2C:EF:07:8D:67:04:96:E5:0B:46:73:8F:2D:68:5B"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"dev.seekrit/remote-mcp","url":"https://registry.modelcontextprotocol.io/v0/servers/dev.seekrit%2Fremote-mcp","firstSeenAt":"2026-09-05T23:20:58.367Z","fetchedAt":"2026-10-09T14:21:14.943Z","normalizedAt":"2026-10-09T14:21:14.943Z"}]},"firstSeenAt":"2026-09-05T23:20:58.367Z","updatedAt":"2026-10-09T19:29:17.772Z"}