seekrit — secrets for agents

by seekrit.dev · remote · no sign-in to list tools · v0.1.0 · published by dev.seekrit

Encrypted store for API keys and database URLs your code needs. Use them without reading them.

Deletes · 11Final · 1Changes · 81 high finding

Compare Registry entry

40 tools: 11 can delete or cancel things, 1 do something that can't be undone, 8 change things and 20 only read.

Scanned Oct 21, 2026

Deletes or cancels11Claude Code: deny: see these tools
Can't be undone1Claude Code: ask: see these tools
Changes things8Claude Code: ask: see these tools
Only reads20Claude Code: allow: see these tools

50 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http remote https://mcp.seekrit.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 high5 warn44 info

Highsetup_local_crypto
The description refers to ".mcp.json".
Matched text
description: "...seekrit-proxy), including a copy-paste .mcp.json that reuses this session's credential...."
What this check looks for
Warnsignup
The description contains "every other tool", wording about other tools or servers.
Matched text
description: "...inds the credential to this session, so every other tool works on your next call with no config..."
What this check looks for
Warnlist_orgs
The description contains "every other tool", wording about other tools or servers.
Matched text
description: "...n access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want t..."
What this check looks for
Warncreate_app
The input schema at properties.slug.description contains "every other tool", wording about other tools or servers.
Matched text
inputSchema.properties.slug.description: "URL-safe identifier used by every other tool to refer to this app: lowercase letters..."
What this check looks for
Warnuncompose_group
The server marks "uncompose_group" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "remove": a word for removing or ending something.
What this check looks for
Warnrename_app
The description contains "every other tool", wording about other tools or servers.
Matched text
description: "...s display name. The slug is immutable — every other tool refers to the app by slug, so a rename..."
What this check looks for

Show 44 more findings

Infosignup
The description mentions "credential".
Matched text
description: "...seekrit workspace and your own machine credential — one call, no human, no browser. Binds..."
What this check looks for
Infosignup
The input schema at properties.clientName.description mentions "credential".
Matched text
inputSchema.properties.clientName.description: "Optional label for this machine credential (defaults to <slug>-agent)."
What this check looks for
Infosetup_local_crypto
The description mentions "credential".
Matched text
description: "...te .mcp.json that reuses this session's credential. Takes no arguments and returns prose p..."
What this check looks for
Infowhoami
The description mentions "credential".
Matched text
description: "...ccess. Call this first: it confirms the credential works and tells you which org slug to p..."
What this check looks for
Infolist_orgs
The description mentions "credential".
Matched text
description: "List the organizations this credential can access. Use it to find the `org` sl..."
What this check looks for
Infolist_apps
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_envs
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_branches
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_groups
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_group_envs
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_env_groups
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_members
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_secrets
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_secret_versions
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_tokens
The description mentions "credentials".
Matched text
description: "...ation's service tokens — the long-lived credentials that let a deployed workload fetch secr..."
What this check looks for
Infolist_tokens
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_invites
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infokms_list_keys
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_lease_targets
The description mentions "credentials".
Matched text
description: "...es, MySQL, …) against which short-lived credentials can be minted on demand instead of stor..."
What this check looks for
Infolist_lease_targets
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infolist_leases
The description mentions "credential".
Matched text
description: "...d — the ledger of who got a short-lived credential against which target and until when. Ne..."
What this check looks for
Infolist_leases
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infoaudit
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infobilling
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infocreate_app
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infocreate_group
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infocompose_group
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infouncompose_group
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infoinvite_member
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Inforename_app
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Inforename_group
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Inforestore_secret
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infodelete_secret
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Inforevoke_token
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Inforevoke_invite
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Inforevoke_lease
The description mentions "credential".
Matched text
description: "...for it to expire — the leased database credential is dropped at the target immediately, s..."
What this check looks for
Inforevoke_lease
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infokms_disable_key
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infokms_revoke_grant
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infokms_revoke_grant
The input schema at properties.principalType.description mentions "credential".
Matched text
inputSchema.properties.principalType.description: "...mbers) or "service_token" for a machine credential (list_tokens)."
What this check looks for
Infodelete_app
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infodelete_group
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infodelete_env
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for
Infodelete_branch
The input schema at properties.org.description mentions "credential".
Matched text
inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

40 tools

Deletes or cancels 11Removes, cancels or revokes something.Claude Code: deny

delete_appDelete an application together with all of its environments and their secrets, discarding the ciphertext.1 finding
Why it is in this group
- The name "delete_app" says "delete": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is the widest-blast-radius tool here; prefer delete_env for a single environment, or rename_app if the name is the only problem. Confirm intent with a human before calling. Returns { ok, app }.
Annotations the server declares
- title: delete_app
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_branchTear down an ephemeral branch config and every value it overrode.1 finding
Why it is in this group
- The name "delete_branch" says "delete": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this the routine cleanup when a PR merges. Irreversible; creating a branch mints a data key, so create_branch stays on the local crypto plane. Find the slug with list_branches. Returns { ok, branch }.
Annotations the server declares
- title: delete_branch
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_envDelete one application environment and the secrets it owns, discarding the ciphertext.1 finding
Why it is in this group
- The name "delete_env" says "delete": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating the environment means setting every value again on the local crypto plane. Sibling environments and the application itself are untouched; use delete_app to remove all of them. Confirm intent before calling. Returns { ok, env }.
Annotations the server declares
- title: delete_env
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_groupDelete a shared group together with its environments and their secrets, discarding the ciphertext.1 finding
Why it is in this group
- The name "delete_group" says "delete": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed this group loses those names — check list_env_groups (or use uncompose_group) before deciding the group is unused. Confirm intent before calling. Returns { ok, group }.
Annotations the server declares
- title: delete_group
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_secretDelete a secret from an environment, discarding its ciphertext and every version.1 finding
Why it is in this group
- The name "delete_secret" says "delete": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back within a surviving secret's history), and re-creating it means setting the value again on the local crypto plane. Prefer restore_secret to undo a bad write. Confirm intent before calling. Returns { ok, name } — or { ok, queued: true, changeRequestId } if the environment requires approval, in which case NOTHING was deleted until a human approves.
Annotations the server declares
- title: delete_secret
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
kms_disable_keyDisable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees.1 finding
Why it is in this group
- The name "kms_disable_key" says "disable": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Reversible only by an operator re-enabling the key — there is no enable tool here. Use kms_revoke_grant instead to cut off ONE principal while the key stays in service. Find the id with kms_list_keys. Returns the updated key, with `disabledAt` now set.
Annotations the server declares
- title: kms_disable_key
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
kms_revoke_grantRevoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps working.2 findings
Why it is in this group
- The name "kms_revoke_grant" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
- Info
  The input schema at properties.principalType.description mentions "credential".
  Matched text
  inputSchema.properties.principalType.description: "...mbers) or "service_token" for a machine credential (list_tokens)."
  What this check looks for
Description, as the server wrote it
Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps working. Use kms_disable_key instead to stop the key entirely. Removing a grant needs no key material, which is why it runs here. Returns { ok, keyId, principalId }.
Annotations the server declares
- title: kms_revoke_grant
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
revoke_inviteCancel a pending organization invitation before it is accepted.1 finding
Why it is in this group
- The name "revoke_invite" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no longer applies. Find the id with list_invites. Returns { ok, inviteId }.
Annotations the server declares
- title: revoke_invite
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
revoke_leaseRevoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still holding it fails on…2 findings
Why it is in this group
- The name "revoke_lease" says "revoke": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...for it to expire — the leased database credential is dropped at the target immediately, s..."
  What this check looks for
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still holding it fails on its next connection. Irreversible: a new lease must be minted on the local crypto plane. Check list_leases first, since an already-expired lease needs no revoking. Returns { ok, leaseId }.
Annotations the server declares
- title: revoke_lease
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
revoke_tokenRevoke a service token by id.1 finding
Why it is in this group
- The name "revoke_token" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may have cached the key already, also rotate the environment on the local crypto plane — revocation alone does not re-encrypt anything. Find the id with list_tokens. Returns { ok, tokenId }.
Annotations the server declares
- title: revoke_token
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
uncompose_groupRemove a composed group from an application environment.2 findings
Why it is in this group
- The description's first verb is "remove": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
- Warn
  The server marks "uncompose_group" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "remove": a word for removing or ending something.
  What this check looks for
Description, as the server wrote it
Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolving every name it inherited from that group, which will break a workload still reading one. Check list_env_groups first, and use delete_group to destroy the group itself. Safe to repeat. Returns { ok: true }.
Annotations the server declares
- title: uncompose_group
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

invite_memberInvite a human to the organization by email (admin only).1 finding
Why it is in this group
- The name "invite_member" says "invite": a word for sending, and what is sent cannot be taken back.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant them decryption with `grant_env` on the LOCAL crypto plane, since an invite alone conveys no ability to read values. Returns the pending { id, orgId, email, role, invitedById, createdAt }; revoke_invite cancels it.
Annotations the server declares
- title: invite_member
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 8Creates or changes something that can be changed back.Claude Code: ask

compose_groupCompose a shared group into an application environment, so that environment resolves the group's secrets as well as its own.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an already-composed group just updates its position. Use uncompose_group to undo, and list_env_groups to see the current order. No key material involved, so it runs here. Returns the composed { groupId, slug, name, position }.
Annotations the server declares
- title: compose_group
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_appCreate an application — the container that will own environments and secrets.2 findings
Why it is in this group
- The name "create_app" says "create": a word for a change.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
- Warn
  The input schema at properties.slug.description contains "every other tool", wording about other tools or servers.
  Matched text
  inputSchema.properties.slug.description: "URL-safe identifier used by every other tool to refer to this app: lowercase letters..."
  What this check looks for
Description, as the server wrote it
Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does NOT: create_env mints a data key and lives on the local crypto plane (call setup_local_crypto). Returns the new { id, orgId, name, slug, createdAt }.
Annotations the server declares
- title: create_app
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_groupCreate a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping a copy.1 finding
Why it is in this group
- The name "create_group" says "create": a word for a change.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping a copy. Use create_app instead for a deployable service. No key material involved, so it runs here; the group's environments are minted locally by create_group_env. Returns the new { id, orgId, name, slug, createdAt }.
Annotations the server declares
- title: create_group
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
local_tool_forLook up how to perform one crypto-plane operation locally — the targeted answer for "the tool I expected is not on this server".No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Look up how to perform one crypto-plane operation locally — the targeted answer for "the tool I expected is not on this server". Returns { operation, where, how } for a known operation, or a note explaining the plane boundary for an unrecognised one. Use setup_local_crypto instead when you need the whole local setup rather than one command.
Annotations the server declares
- title: local_tool_for
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
rename_appChange an application's display name.2 findings
Why it is in this group
- The name "rename_app" says "rename": a word for a change.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
- Warn
  The description contains "every other tool", wording about other tools or servers.
  Matched text
  description: "...s display name. The slug is immutable — every other tool refers to the app by slug, so a rename..."
  What this check looks for
Description, as the server wrote it
Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_app only if the slug itself must change. Returns the updated { id, orgId, name, slug, createdAt }.
Annotations the server declares
- title: rename_app
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
rename_groupChange a shared group's display name.1 finding
Why it is in this group
- The name "rename_group" says "rename": a word for a change.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated { id, orgId, name, slug, createdAt }.
Annotations the server declares
- title: rename_group
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
restore_secretRoll a secret back to an earlier version — the undo for a bad write.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing is overwritten. Read list_secret_versions first to choose the version. No decryption happens, which is why this works here and not only on the local crypto plane. Returns { ok, name, restoredFrom, version } where `version` is the new head.
Annotations the server declares
- title: restore_secret
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
signupCreate a seekrit workspace and your own machine credential — one call, no human, no browser.3 findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...seekrit workspace and your own machine credential — one call, no human, no browser. Binds..."
  What this check looks for
- Info
  The input schema at properties.clientName.description mentions "credential".
  Matched text
  inputSchema.properties.clientName.description: "Optional label for this machine credential (defaults to <slug>-agent)."
  What this check looks for
- Warn
  The description contains "every other tool", wording about other tools or servers.
  Matched text
  description: "...inds the credential to this session, so every other tool works on your next call with no config..."
  What this check looks for
Description, as the server wrote it
Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on your next call with no config change and no reconnect. Returns { org, credential: { clientId, clientSecret }, sessionBound, next }. Save the clientId + clientSecret: the secret is shown once, is not retrievable, and is how you reconnect later. Call this if a tool says you have no credential.
Annotations the server declares
- title: signup
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Only reads 20Looks things up and changes nothing.Claude Code: allow

auditRead the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens.1 finding
Why it is in this group
- The description's first verb is "read": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer "what changed and who did it"; for one secret's history specifically, list_secret_versions is narrower and cheaper. Returns [{ id, action, actorType, actorId, resourceType, resourceId, metadata, ipAddress, createdAt }].
Annotations the server declares
- title: audit
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
billingShow the org's plan, effective entitlements, current usage, and which upgrade actions are available.1 finding
Why it is in this group
- The description's first verb is "show": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit — it names the limit you hit and how to lift it. Returns { plan, subscription, promo, entitlements, usage, overrides, enforced, manage } — `enforced: false` means plan limits are not currently applied, and `manage` carries the upgrade paths.
Annotations the server declares
- title: billing
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_startedRead the recommended first-project recipe end to end: which steps run here and which need the local crypto plane.No findings
Why it is in this group
- The name "get_started" says "get": a word for reading.
Description, as the server wrote it
Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthrough. Call this before provisioning anything — it is cheaper than discovering the plane boundary one failed tool at a time.
Annotations the server declares
- title: get_started
- readOnlyHint: true
- openWorldHint: false
kms_list_keysList the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store.1 finding
Why it is in this group
- The name "kms_list_keys" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: key material is fetched and used on the local crypto plane (kms_encrypt / kms_decrypt / kms_sign live there, not here). Use it to find a `keyId` for kms_disable_key or kms_revoke_grant. Returns [{ id, name, purpose, spec, currentVersion, applicationId, groupId, disabledAt, createdAt }] — a non-null `disabledAt` means the key is already disabled.
Annotations the server declares
- title: kms_list_keys
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_appsList the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets.1 finding
Why it is in this group
- The name "list_apps" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know the org but not the app slug the other tools need. Returns [{ id, orgId, name, slug, createdAt }]; use list_envs next to descend into one.
Annotations the server declares
- title: list_apps
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_branchesList ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment.1 finding
Why it is in this group
- The name "list_branches" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only — never values. Use it before delete_branch to find a branch slug, or to spot branches that have already expired. Returns Environment rows with `parentEnvironmentId` set: [{ id, name, slug, parentEnvironmentId, expiresAt, createdAt }] — `expiresAt` is null for a branch with no TTL.
Annotations the server declares
- title: list_branches
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_env_groupsList the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash).1 finding
Why it is in this group
- The name "list_env_groups" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret name actually comes from, or to pick the next `position` for compose_group. The inverse direction of list_group_envs. Returns [{ groupId, slug, name, position }], highest position last.
Annotations the server declares
- title: list_env_groups
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_envsList the environments an application owns (production, staging, …).1 finding
Why it is in this group
- The name "list_envs" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and the delete/restore tools take. Returns [{ id, name, slug, applicationId, groupId, parentEnvironmentId, expiresAt, createdAt }]. Not to be confused with list_env_groups (which groups feed INTO an app environment) or list_group_envs (the environments of a shared GROUP).
Annotations the server declares
- title: list_envs
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_group_envsList the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`.1 finding
Why it is in this group
- The name "list_group_envs" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when you already have a group and want its own environments; use list_envs for an application's, and list_env_groups to see which groups an application environment pulls from. Returns Environment rows with `groupId` set: [{ id, name, slug, groupId, createdAt }].
Annotations the server declares
- title: list_group_envs
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_groupsList the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can compose in rather tha…1 finding
Why it is in this group
- The name "list_groups" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can compose in rather than duplicating. Use it to find the `group` slug compose_group and list_group_envs take. Returns [{ id, orgId, name, slug, createdAt }]; not paginated.
Annotations the server declares
- title: list_groups
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_invitesList invitations to the organization that have been sent but not yet accepted.1 finding
Why it is in this group
- The name "list_invites" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revoke_invite. Accepted invitations become members — see list_members. Returns [{ id, orgId, email, role, invitedById, createdAt }].
Annotations the server declares
- title: list_invites
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_lease_targetsList the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of storing a standing passwo…2 findings
Why it is in this group
- The name "list_lease_targets" says "list": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...es, MySQL, …) against which short-lived credentials can be minted on demand instead of stor..."
  What this check looks for
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of storing a standing password. Use it to see what can be leased before minting one (create_pg_lease / create_mysql_lease run on the LOCAL crypto plane), and see list_leases for what has actually been issued. Returns [{ id, orgId, provider, name, config, createdAt }], where `provider` names the kind of target (postgres, mysql, …) and `config` is non-secret connection settings.
Annotations the server declares
- title: list_lease_targets
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_leasesList temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when.2 findings
Why it is in this group
- The name "list_leases" says "list": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...d — the ledger of who got a short-lived credential against which target and until when. Ne..."
  What this check looks for
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the credential itself. Use it to find a `leaseId` for revoke_lease, or to check whether a lease has already expired before revoking it; list_lease_targets shows what CAN be leased. Returns [{ id, targetId, provider, status, principalType, principalId, expiresAt, endedAt, endedReason, createdAt }] — only `status: "active"` leases are worth revoking.
Annotations the server declares
- title: list_leases
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_membersList organization members with their public keys.1 finding
Why it is in this group
- The name "list_members" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decrypt — so call this when handing a project off to a person. Returns [{ userId, email, name, role, publicKeyJwk }]; `publicKeyJwk` is null for a member who has not finished key setup, and such a member cannot be granted decryption yet.
Annotations the server declares
- title: list_members
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_orgsList the organizations this credential can access.2 findings
Why it is in this group
- The name "list_orgs" says "list": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "List the organizations this credential can access. Use it to find the `org` sl..."
  What this check looks for
- Warn
  The description contains "every other tool", wording about other tools or servers.
  Matched text
  description: "...n access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want t..."
  What this check looks for
Description, as the server wrote it
List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client you are. Returns [{ id, name, slug, role, createdAt }].
Annotations the server declares
- title: list_orgs
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_secret_versionsList one secret's version history: who wrote each version, when, and which ones were restores.1 finding
Why it is in this group
- The name "list_secret_versions" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a bad write: read the history here, then pass the version number you want back. Returns { currentVersion, versions: [{ version, createdAt, createdBy, restoredFromVersion }] }, newest first.
Annotations the server declares
- title: list_secret_versions
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_secretsList the secret NAMES and versions in an environment.1 finding
Why it is in this group
- The name "list_secrets" says "list": a word for reading.
Findings
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing them; to read a value, run the local crypto plane (see setup_local_crypto) — no tool here will ever return one. Returns [{ name, version, updatedAt }].
Annotations the server declares
- title: list_secrets
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_tokensList an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets.2 findings
Why it is in this group
- The name "list_tokens" says "list": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ation's service tokens — the long-lived credentials that let a deployed workload fetch secr..."
  What this check looks for
- Info
  The input schema at properties.org.description mentions "credential".
  Matched text
  inputSchema.properties.org.description: "...ganization slug or id. Omit it when the credential can reach exactly one org — that org is..."
  What this check looks for
Description, as the server wrote it
List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once at creation (on the local crypto plane) and are never retrievable here. Use it to find a `tokenId` for revoke_token, or to audit what still has access. Returns [{ id, name, role, environmentId, expiresAt, lastUsedAt, revokedAt, createdAt }] — `environmentId` is null for an org-admin token, and a non-null `revokedAt` means it is already revoked.
Annotations the server declares
- title: list_tokens
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
setup_local_cryptoGet the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-paste .mcp.json that…2 findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Findings
- High
  The description refers to ".mcp.json".
  Matched text
  description: "...seekrit-proxy), including a copy-paste .mcp.json that reuses this session's credential...."
  What this check looks for
- Info
  The description mentions "credential".
  Matched text
  description: "...te .mcp.json that reuses this session's credential. Takes no arguments and returns prose p..."
  What this check looks for
Description, as the server wrote it
Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-paste .mcp.json that reuses this session's credential. Takes no arguments and returns prose plus config. Call this the moment you need to SET or READ a secret value — no tool on this server will ever return one. Use local_tool_for instead when you want the single command for one named operation.
Annotations the server declares
- title: setup_local_crypto
- readOnlyHint: true
- openWorldHint: false
whoamiShow the authenticated machine client and the org it can access.1 finding
Why it is in this group
- The name "whoami" says "whoami": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...ccess. Call this first: it confirms the credential works and tells you which org slug to p..."
  What this check looks for
Description, as the server wrote it
Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that you can omit `org` entirely). Returns { kind, clientId, orgs: [{ id, name, slug, role, createdAt }] }.
Annotations the server declares
- title: whoami
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http remote https://mcp.seekrit.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__remote__get_started",
      "mcp__remote__setup_local_crypto",
      "mcp__remote__whoami",
      "mcp__remote__list_orgs",
      "mcp__remote__list_apps",
      "mcp__remote__list_envs",
      "mcp__remote__list_branches",
      "mcp__remote__list_groups",
      "mcp__remote__list_group_envs",
      "mcp__remote__list_env_groups",
      "mcp__remote__list_members",
      "mcp__remote__list_secrets",
      "mcp__remote__list_secret_versions",
      "mcp__remote__list_tokens",
      "mcp__remote__list_invites",
      "mcp__remote__kms_list_keys",
      "mcp__remote__list_lease_targets",
      "mcp__remote__list_leases",
      "mcp__remote__audit",
      "mcp__remote__billing"
    ],
    "ask": [
      "mcp__remote__signup",
      "mcp__remote__local_tool_for",
      "mcp__remote__create_app",
      "mcp__remote__create_group",
      "mcp__remote__compose_group",
      "mcp__remote__invite_member",
      "mcp__remote__rename_app",
      "mcp__remote__rename_group",
      "mcp__remote__restore_secret"
    ],
    "deny": [
      "mcp__remote__uncompose_group",
      "mcp__remote__delete_secret",
      "mcp__remote__revoke_token",
      "mcp__remote__revoke_invite",
      "mcp__remote__revoke_lease",
      "mcp__remote__kms_disable_key",
      "mcp__remote__kms_revoke_grant",
      "mcp__remote__delete_app",
      "mcp__remote__delete_group",
      "mcp__remote__delete_env",
      "mcp__remote__delete_branch"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as remote. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.seekrit/remote-mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

20 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:12 UTC.

For agents: Markdown · JSON · report this listing