> For the complete documentation index, see [llms.txt](https://docs.apolo.us/index/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apolo.us/index/apolo-mcp/capabilities/tools/secrets.md).

# Secrets

[Back to the MCP tool reference](/index/apolo-mcp/capabilities/tools.md).

## `list_secrets`

List names, owners, and context only; never retrieve secret values.

**Operation type:** read-only

**Annotations:** read-only `true`, destructive `false`, idempotent `true`, open-world `true`

**Input schema:**

```json
{
  "properties": {
    "cluster": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Cluster"
    },
    "limit": {
      "default": 50,
      "title": "Limit",
      "type": "integer"
    },
    "org": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Org"
    },
    "project": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Project"
    }
  },
  "title": "list_secretsArguments",
  "type": "object"
}
```

**Output schema:**

```json
{
  "additionalProperties": true,
  "title": "list_secretsDictOutput",
  "type": "object"
}
```

## `get_secret_to_file`

Write a secret to a new mode-0600 workspace file; never return its value.

**Operation type:** write

**Annotations:** read-only `false`, destructive `false`, idempotent `false`, open-world `true`

**Input schema:**

```json
{
  "properties": {
    "approved": {
      "default": false,
      "title": "Approved",
      "type": "boolean"
    },
    "cluster": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Cluster"
    },
    "destination_file": {
      "title": "Destination File",
      "type": "string"
    },
    "key": {
      "title": "Key",
      "type": "string"
    },
    "org": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Org"
    },
    "project": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Project"
    }
  },
  "required": [
    "key",
    "destination_file"
  ],
  "title": "get_secret_to_fileArguments",
  "type": "object"
}
```

**Output schema:**

```json
{
  "additionalProperties": true,
  "title": "get_secret_to_fileDictOutput",
  "type": "object"
}
```

## `create_secret_from_source`

Create a secret without accepting or returning its value.

**Operation type:** write

**Annotations:** read-only `false`, destructive `false`, idempotent `false`, open-world `true`

**Input schema:**

```json
{
  "properties": {
    "approved": {
      "default": false,
      "title": "Approved",
      "type": "boolean"
    },
    "cluster": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Cluster"
    },
    "key": {
      "title": "Key",
      "type": "string"
    },
    "org": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Org"
    },
    "project": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Project"
    },
    "source_name": {
      "title": "Source Name",
      "type": "string"
    },
    "source_type": {
      "enum": [
        "env",
        "file",
        "secret"
      ],
      "title": "Source Type",
      "type": "string"
    }
  },
  "required": [
    "key",
    "source_type",
    "source_name"
  ],
  "title": "create_secret_from_sourceArguments",
  "type": "object"
}
```

**Output schema:**

```json
{
  "additionalProperties": true,
  "title": "create_secret_from_sourceDictOutput",
  "type": "object"
}
```

## `delete_secret`

Delete one exact secret key after policy and client approval.

**Operation type:** destructive

**Annotations:** read-only `false`, destructive `true`, idempotent `true`, open-world `true`

**Input schema:**

```json
{
  "properties": {
    "approved": {
      "default": false,
      "title": "Approved",
      "type": "boolean"
    },
    "cluster": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Cluster"
    },
    "key": {
      "title": "Key",
      "type": "string"
    },
    "org": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Org"
    },
    "project": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Project"
    }
  },
  "required": [
    "key"
  ],
  "title": "delete_secretArguments",
  "type": "object"
}
```

**Output schema:**

```json
{
  "additionalProperties": true,
  "title": "delete_secretDictOutput",
  "type": "object"
}
```