seekrit — secrets for agents
dev.seekrit/remote-mcp
Tools
Exactly what the server advertised in the scan completed . Effects and capabilities are classified by Squatch from each tool's metadata. Squatch never runs tools. Compared with the previous scan: 0 new, 1 changed.
- Effect: Read 19
- Effect: Write 10
- Effect: Delete 5
- Effect: Admin 6
Showing 40 of 40 tools
| Details | ||
|---|---|---|
| invite_member Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to … | Effect: Admin | |
| kms_revoke_grant Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while ev… | Effect: Admin | |
| revoke_invite Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a… | Effect: Admin | |
| revoke_lease Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediate… | Effect: Admin | |
| revoke_token Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next re… | Effect: Admin | |
| uncompose_group Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the envir… | Effect: Admin | |
| delete_app Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo a… | Effect: Delete | |
| delete_branch Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go … | Effect: Delete | |
| delete_env Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes wi… | Effect: Delete | |
| delete_group Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environm… | Effect: Delete | |
| delete_secret Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that … | Effect: Delete | |
| billing Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refus… | Effect: Write | |
| compose_groupChanged Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat… | Effect: Write | |
| create_app Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating it… | Effect: Write | |
| create_group Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rath… | Effect: Write | |
| kms_disable_key Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by exis… | Effect: Write | |
| rename_app Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use d… | Effect: Write | |
| rename_group Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing… | Effect: Write | |
| restore_secret Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is appe… | Effect: Write | |
| setup_local_crypto Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-prox… | Effect: Write | |
| signup Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every… | Effect: Write | |
| audit Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens… | Effect: Read | |
| get_started Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and re… | Effect: Read | |
| kms_list_keys List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret st… | Effect: Read | |
| list_apps List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Sta… | Effect: Read | |
| list_branches List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, pare… | Effect: Read | |
| list_env_groups List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to exp… | Effect: Read | |
| list_envs List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug th… | Effect: Read | |
| list_group_envs List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `st… | Effect: Read | |
| list_groups List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many applicati… | Effect: Read | |
| list_invites List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find a… | Effect: Read | |
| list_lease_targets List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on de… | Effect: Read | |
| list_leases List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Ne… | Effect: Read | |
| list_members List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a huma… | Effect: Read | |
| list_orgs List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to … | Effect: Read | |
| list_secret_versions List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with rest… | Effect: Read | |
| list_secrets List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exis… | Effect: Read | |
| list_tokens List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token str… | Effect: Read | |
| local_tool_for Look up how to perform one crypto-plane operation locally — the targeted answer for "the tool I expected is not on this server". Returns { … | Effect: Read | |
| whoami Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org … | Effect: Read |