MCP Tools Reference

The MCP server exposes 16 tools. Each tool is grouped by domain (secrets, machines, projects, etc.) and dispatches on an action parameter so the AI client picks the operation by name. This page is the authoritative reference for what's available.

For the call-time contract (auth, plaintext, audit) see the Security Model. For setup and registration see Setup.

Action dispatch

Every tool takes an action argument plus action-specific arguments. The tool's JSON schema uses a discriminated oneOf so each action declares its own required fields. AI clients see this and surface only the relevant fields per action.

Example call shape:

{
  "name": "manage_secrets",
  "arguments": {
    "action": "list",
    "projectId": "proj_abc123"
  }
}

The action is always required. Per-action requirements are listed in the tables below.

manage_secrets

Manage secrets within a project. The agent never sees plaintext secret values: rotate / create / update_value take inputs but don't echo them back, and reads return only metadata.

manage_temporary_secrets

One-shot self-destructing share links. Server-encrypts the value, hashes the passphrase with Argon2id, destroys on first reveal (right or wrong) or expiry.

manage_projects

manage_policies

Access policies are layered constraints (time window, IP allowlist, rate cap, co-sign, TTL, rotate-after-N) that apply on top of the base six-requirement gate.

manage_canaries

Defensive trip-wires. A canary is a secret whose unauthorized read freezes the project (and optionally related projects) so the attacker still gets a response but cannot take any further action.

manage_machines

Machines are secret consumers (SDK / CLI). This tool manages the machine identities; per-project attachment and grants live in manage_project_machines.

manage_ai_agents

Lifecycle of AI agents on the vault. Scope-set and project-allowlist mutation are deliberately not exposed (privilege escalation), and remain dashboard-only.

manage_project_machines

Per-project machine membership and per-secret grants.

manage_enrollment

Bootstrap tokens for ephemeral machines (CI/CD runners, auto-scaling workers).

manage_team

Team members on the vault. Does not expose external-vault membership (membership in someone else's vault).

manage_alerts

Which audit actions trigger alert dispatch (email + webhook).

manage_webhooks

Outbound delivery channels for alerts. Each webhook subscribes to a subset of audit actions; SikkerKey signs and POSTs the payload via HMAC-SHA256.

manage_ipallowlist

Machine-auth IP allowlist (gates the runtime SDK / CLI surface, not dashboard sessions).

manage_trash

Soft-deleted secrets sit in trash for 30 days before automatic hard-delete.

read_audit

Audit log, activity feed, and usage stats.

support

Support tickets. Read access is implicit with write — there's no flow where an agent can create tickets but not see the ticket it just opened.