@ferrvault/mcp 10.13.0 → 11.0.0

package/dist/api.d.ts

@@ -0,0 +1,19 @@
+interface VaultRequestOptions {
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    body?: unknown;
+    token: string;
+}
+export declare function vaultRequest<T>(path: string, options: VaultRequestOptions): Promise<T>;
+export interface SecretTarget {
+    vault: string;
+    environment: string;
+}
+export declare function vaultPath(vault: string): string;
+export declare function secretsPath({ vault, environment }: SecretTarget): string;
+export declare function secretPath(target: SecretTarget, name: string): string;
+export declare function secretRequestsPath({ vault, environment }: SecretTarget): string;
+export declare function archiveSecretRequestPath(target: SecretTarget, id: string): string;
+export declare function serviceTokensPath({ vault, environment }: SecretTarget): string;
+export declare function serviceTokenPath(target: SecretTarget, id: string): string;
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAWA,UAAU,mBAAmB;IAC3B,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAMtF;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,YAAY,GAAG,MAAM,CAExE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,kBAAkB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,YAAY,GAAG,MAAM,CAE/E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,iBAAiB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,YAAY,GAAG,MAAM,CAE9E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/dist/api.js

@@ -0,0 +1,32 @@
+import { apiRequest } from '@ferrlabs/mcp-core';
+const API_VERSION_HEADER = 'x-ferrvault-api-version';
+const FERRVAULT_API_URL = (process.env.FERRVAULT_API_URL ?? 'https://api.ferrvault.com').replace(/\/+$/, '');
+const FERRVAULT_API_VERSION = process.env.FERRVAULT_API_VERSION ?? '2026-08-04';
+export function vaultRequest(path, options) {
+    return apiRequest(path, {
+        ...options,
+        baseUrl: FERRVAULT_API_URL,
+        headers: { [API_VERSION_HEADER]: FERRVAULT_API_VERSION },
+    });
+}
+export function vaultPath(vault) {
+    return `/vaults/${encodeURIComponent(vault)}`;
+}
+export function secretsPath({ vault, environment }) {
+    return `${vaultPath(vault)}/environments/${encodeURIComponent(environment)}/secrets`;
+}
+export function secretPath(target, name) {
+    return `${secretsPath(target)}/${encodeURIComponent(name)}`;
+}
+export function secretRequestsPath({ vault, environment }) {
+    return `${vaultPath(vault)}/environments/${encodeURIComponent(environment)}/secret-requests`;
+}
+export function archiveSecretRequestPath(target, id) {
+    return `${secretRequestsPath(target)}/${encodeURIComponent(id)}/archive`;
+}
+export function serviceTokensPath({ vault, environment }) {
+    return `${vaultPath(vault)}/environments/${encodeURIComponent(environment)}/operator/tokens`;
+}
+export function serviceTokenPath(target, id) {
+    return `${serviceTokensPath(target)}/${encodeURIComponent(id)}`;
+}

package/dist/generate.d.ts

@@ -0,0 +1,9 @@
+export declare const CHARSETS: {
+    readonly alphanumeric: string;
+    readonly hex: string;
+    readonly base64url: string;
+    readonly ascii: string;
+};
+export type Charset = keyof typeof CHARSETS;
+export declare function generateValue(length: number, charset: Charset): string;
+//# sourceMappingURL=generate.d.ts.map

package/dist/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../src/generate.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,QAAQ;aACnB,YAAY;aACZ,GAAG;aACH,SAAS;aACT,KAAK;CACG,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC;AAE5C,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAGtE"}

package/dist/generate.js

@@ -0,0 +1,14 @@
+import { randomInt } from 'node:crypto';
+const LOWER = 'abcdefghijklmnopqrstuvwxyz';
+const UPPER = LOWER.toUpperCase();
+const DIGITS = '0123456789';
+export const CHARSETS = {
+    alphanumeric: LOWER + UPPER + DIGITS,
+    hex: DIGITS + 'abcdef',
+    base64url: LOWER + UPPER + DIGITS + '-_',
+    ascii: LOWER + UPPER + DIGITS + '!#$%&()*+,-./:;<=>?@[]^_{|}~',
+};
+export function generateValue(length, charset) {
+    const alphabet = CHARSETS[charset];
+    return Array.from({ length }, () => alphabet[randomInt(alphabet.length)]).join('');
+}

package/dist/register.js

@@ -1,14 +1,14 @@
-import { registerVaultDetailsTool } from './tools/vault-details.js';
-import { registerSecretTools } from './tools/secrets.js';
-import { registerVaultAuditTools } from './tools/audit.js';
-import { registerVaultMutationTools } from './tools/vaults.js';
-import { registerSecretMutationTools } from './tools/secret-mutations.js';
-import { registerVaultResources } from './resources/vaults.js';
+import { registerVaultTools } from './tools/vaults.js';
+import { registerSecretReadTools } from './tools/secrets.js';
+import { registerSecretWriteTools } from './tools/secret-writes.js';
+import { registerSecretRequestTools } from './tools/secret-requests.js';
+import { registerSecretCopyTools } from './tools/secret-copy.js';
+import { registerServiceTokenTools } from './tools/service-tokens.js';
 export function register(server) {
-    registerVaultDetailsTool(server);
-    registerSecretTools(server);
-    registerVaultAuditTools(server);
-    registerVaultMutationTools(server);
-    registerSecretMutationTools(server);
-    registerVaultResources(server);
+    registerVaultTools(server);
+    registerSecretReadTools(server);
+    registerSecretWriteTools(server);
+    registerSecretRequestTools(server);
+    registerSecretCopyTools(server);
+    registerServiceTokenTools(server);
 }

package/dist/results.d.ts

@@ -0,0 +1,13 @@
+export interface ToolResult {
+    [key: string]: unknown;
+    content: [{
+        type: 'text';
+        text: string;
+    }];
+    isError?: true;
+}
+export type Redact = (secret: string) => void;
+export declare function textResult(value: unknown): ToolResult;
+export declare function describeError(err: unknown, secrets?: readonly string[]): string;
+export declare function guarded(run: (redactLater: Redact) => Promise<ToolResult>, secret?: string): Promise<ToolResult>;
+//# sourceMappingURL=results.d.ts.map

package/dist/results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../src/results.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;AAE9C,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAErD;AAMD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAOnF;AASD,wBAAsB,OAAO,CAC3B,GAAG,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CASrB"}

package/dist/results.js

@@ -0,0 +1,33 @@
+import { ApiRequestError, toToolText } from '@ferrlabs/mcp-core';
+export function textResult(value) {
+    return { content: [{ type: 'text', text: toToolText(value) }] };
+}
+function redact(message, secrets) {
+    return secrets.reduce((text, secret) => text.split(secret).join('[redacted]'), message);
+}
+export function describeError(err, secrets = []) {
+    const message = redact(err instanceof Error ? err.message : String(err), secrets);
+    if (err instanceof ApiRequestError) {
+        const code = err.code ? ` ${err.code}` : '';
+        return `FerrVault API error (HTTP ${err.status}${code}): ${message}`;
+    }
+    return message;
+}
+function errorResult(err, secrets) {
+    return {
+        isError: true,
+        content: [{ type: 'text', text: describeError(err, secrets) }],
+    };
+}
+export async function guarded(run, secret) {
+    const secrets = secret ? [secret] : [];
+    try {
+        return await run((later) => {
+            if (later)
+                secrets.push(later);
+        });
+    }
+    catch (err) {
+        return errorResult(err, secrets);
+    }
+}

package/dist/schemas.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+export declare const vaultSlug: z.ZodString;
+export declare const environmentSlug: z.ZodString;
+export declare const newVaultSlug: z.ZodString;
+export declare const newEnvironmentSlug: z.ZodString;
+export declare const displayName: z.ZodString;
+export declare const secretName: z.ZodString;
+export declare const secretRequestId: z.ZodUUID;
+export declare const requestedName: z.ZodString;
+export declare const serviceTokenId: z.ZodUUID;
+export declare const serviceTokenName: z.ZodString;
+export declare const vaultRole: z.ZodEnum<{
+    admin: "admin";
+    viewer: "viewer";
+    writer: "writer";
+}>;
+export declare const expiresAt: z.ZodISODateTime;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,SAAS,aAAkE,CAAC;AAEzF,eAAO,MAAM,eAAe,aAE3B,CAAC;AAIF,eAAO,MAAM,YAAY,aAExB,CAAC;AAEF,eAAO,MAAM,kBAAkB,aAE9B,CAAC;AAEF,eAAO,MAAM,WAAW,aAAqE,CAAC;AAE9F,eAAO,MAAM,UAAU,aAQyB,CAAC;AAEjD,eAAO,MAAM,eAAe,WAEiD,CAAC;AAE9E,eAAO,MAAM,aAAa,aAIgE,CAAC;AAE3F,eAAO,MAAM,cAAc,WAEgD,CAAC;AAE5E,eAAO,MAAM,gBAAgB,aAIiD,CAAC;AAE/E,eAAO,MAAM,SAAS;;;;EAE0C,CAAC;AAEjE,eAAO,MAAM,SAAS,kBAEiE,CAAC"}

package/dist/schemas.js

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+const slug = z
+    .string()
+    .min(1)
+    .max(40)
+    .regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, 'must be a lowercase slug (letters, digits, hyphens)');
+export const vaultSlug = slug.describe('Vault slug, as listed by list_ferrvault_vaults');
+export const environmentSlug = slug.describe('Environment slug inside the vault, as listed by list_ferrvault_environments (e.g. prod)');
+const newSlug = slug.min(2);
+export const newVaultSlug = newSlug.describe('Slug of the new vault, unique in the organization (e.g. ferrlabs-infra)');
+export const newEnvironmentSlug = newSlug.describe('Slug of the new environment, unique in the vault (e.g. staging)');
+export const displayName = z.string().min(1).max(100).describe('Display name (e.g. Staging)');
+export const secretName = z
+    .string()
+    .min(1)
+    .max(200)
+    .regex(/^[A-Za-z_][A-Za-z0-9_.]*$/, 'must start with a letter or underscore, then letters, digits, underscores or dots')
+    .describe('Secret name (e.g. STRIPE_API_KEY)');
+export const secretRequestId = z
+    .uuid()
+    .describe('Secret request id, as listed by list_ferrvault_secret_requests');
+export const requestedName = z
+    .string()
+    .min(1)
+    .max(200)
+    .describe('Secret name a client requested, as listed by list_ferrvault_secret_requests');
+export const serviceTokenId = z
+    .uuid()
+    .describe('Service token id, as listed by list_ferrvault_service_tokens');
+export const serviceTokenName = z
+    .string()
+    .min(1)
+    .max(100)
+    .describe('Label shown for the token in FerrVault (e.g. k8s-operator-prod)');
+export const vaultRole = z
+    .enum(['viewer', 'writer', 'admin'])
+    .describe('Role the token acts with on its vault environment');
+export const expiresAt = z.iso
+    .datetime({ offset: true })
+    .describe('ISO-8601 instant after which the token stops working; omit for no expiry');

package/dist/secret.d.ts

@@ -0,0 +1,18 @@
+export interface SecretMetadata {
+    id: string;
+    name: string;
+    current_version: number;
+    tags: string[];
+    expires_at: string | null;
+    expiry_action: 'notify' | 'disable';
+    expired: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface RevealedSecret extends SecretMetadata {
+    value: string;
+}
+export declare function withoutValue(secret: SecretMetadata & {
+    value?: unknown;
+}): SecretMetadata;
+//# sourceMappingURL=secret.d.ts.map

package/dist/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,cAAc,CAGzF"}

package/dist/secret.js

@@ -0,0 +1,4 @@
+export function withoutValue(secret) {
+    const { value: _value, ...metadata } = secret;
+    return metadata;
+}

package/dist/tools/secret-copy.d.ts

@@ -0,0 +1,3 @@
+import { type McpServer } from '@ferrlabs/mcp-core';
+export declare function registerSecretCopyTools(server: McpServer): void;
+//# sourceMappingURL=secret-copy.d.ts.map

package/dist/tools/secret-copy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-copy.d.ts","sourceRoot":"","sources":["../../src/tools/secret-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAqB9D,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+B/D"}

package/dist/tools/secret-copy.js

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+import { getToken } from '@ferrlabs/mcp-core';
+import { secretPath, vaultRequest } from '../api.js';
+import { guarded, textResult } from '../results.js';
+import { environmentSlug, secretName, vaultSlug } from '../schemas.js';
+import { upsertSecret, outcome } from '../upsert.js';
+const source = z
+    .object({ vault: vaultSlug, environment: environmentSlug, name: secretName })
+    .describe('Secret to copy from');
+const target = z
+    .object({ vault: vaultSlug, environment: environmentSlug, name: secretName.optional() })
+    .describe('Where to store the copy; name defaults to the source name');
+function sameSecret(a, b) {
+    return a.vault === b.vault && a.environment === b.environment && a.name === b.name;
+}
+export function registerSecretCopyTools(server) {
+    server.tool('copy_ferrvault_secret', 'Copy the current value of a secret to another vault, environment or name, creating the target or storing a new version of it. The value is read and written inside the MCP server and never returned, so it never enters the conversation. The read is audit-logged by FerrVault.', { source, target }, ({ source: from, target: to }) => guarded(async (redactLater) => {
+        const dest = { ...to, name: to.name ?? from.name };
+        if (sameSecret(from, dest)) {
+            throw new Error('source and target are the same secret');
+        }
+        const token = await getToken();
+        const revealed = await vaultRequest(secretPath({ vault: from.vault, environment: from.environment }, from.name), { token });
+        redactLater(revealed.value);
+        const written = await upsertSecret(token, { vault: dest.vault, environment: dest.environment }, dest.name, revealed.value);
+        return textResult({
+            outcome: outcome(written, 'versioned'),
+            target: dest,
+            source_version: revealed.current_version,
+            target_version: written.secret.current_version,
+        });
+    }));
+}

package/dist/tools/secret-requests.d.ts

@@ -0,0 +1,3 @@
+import { type McpServer } from '@ferrlabs/mcp-core';
+export declare function registerSecretRequestTools(server: McpServer): void;
+//# sourceMappingURL=secret-requests.d.ts.map

package/dist/tools/secret-requests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-requests.d.ts","sourceRoot":"","sources":["../../src/tools/secret-requests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA2E9D,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkClE"}

package/dist/tools/secret-requests.js

@@ -0,0 +1,58 @@
+import { getToken } from '@ferrlabs/mcp-core';
+import { archiveSecretRequestPath, secretRequestsPath, vaultRequest, } from '../api.js';
+import { guarded, textResult } from '../results.js';
+import { environmentSlug, requestedName, secretRequestId, vaultSlug } from '../schemas.js';
+async function listRequests(token, target) {
+    const { requests } = await vaultRequest(secretRequestsPath(target), { token });
+    return requests;
+}
+function summary(request) {
+    const { id, name, state, request_count, first_requested_at, last_requested_at, fulfilled_at, last_requester_kind, } = request;
+    return {
+        id,
+        name,
+        state,
+        request_count,
+        first_requested_at,
+        last_requested_at,
+        fulfilled_at,
+        last_requester_kind,
+    };
+}
+function requestRef(id, name) {
+    if (id !== undefined && name === undefined)
+        return { id };
+    if (name !== undefined && id === undefined)
+        return { name };
+    throw new Error('pass exactly one of id or name');
+}
+async function resolvePendingId(token, target, name) {
+    const requests = await listRequests(token, target);
+    const pending = requests.find((r) => r.name === name && r.state === 'pending');
+    if (!pending) {
+        throw new Error(`no pending secret request named ${name} in ${target.vault}/${target.environment}`);
+    }
+    return pending.id;
+}
+export function registerSecretRequestTools(server) {
+    server.tool('list_ferrvault_secret_requests', 'List the pending secret requests of one vault environment: names a client (operator, CLI) asked for that have no value yet, with request counts, timestamps and requester kind. The API returns pending requests only; fulfilled and archived ones are not listed.', { vault: vaultSlug, environment: environmentSlug }, ({ vault, environment }) => guarded(async () => {
+        const token = await getToken();
+        return textResult((await listRequests(token, { vault, environment })).map(summary));
+    }));
+    server.tool('archive_ferrvault_secret_request', 'Archive a pending secret request (a false positive, e.g. a typo), by id or by secret name. An archived request stays archived even if clients keep asking for the name. Pass exactly one of id or name.', {
+        vault: vaultSlug,
+        environment: environmentSlug,
+        id: secretRequestId.optional(),
+        name: requestedName.optional(),
+    }, ({ vault, environment, id, name }) => guarded(async () => {
+        const ref = requestRef(id, name);
+        const token = await getToken();
+        const target = { vault, environment };
+        const requestId = 'id' in ref ? ref.id : await resolvePendingId(token, target, ref.name);
+        await vaultRequest(archiveSecretRequestPath(target, requestId), {
+            token,
+            method: 'POST',
+        });
+        return textResult({ archived: requestId, name, vault, environment, state: 'archived' });
+    }));
+}

package/dist/tools/secret-writes.d.ts

@@ -0,0 +1,3 @@
+import { type McpServer } from '@ferrlabs/mcp-core';
+export declare function registerSecretWriteTools(server: McpServer): void;
+//# sourceMappingURL=secret-writes.d.ts.map

package/dist/tools/secret-writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-writes.d.ts","sourceRoot":"","sources":["../../src/tools/secret-writes.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAmB9D,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiDhE"}

package/dist/tools/secret-writes.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import { getToken } from '@ferrlabs/mcp-core';
+import { CHARSETS, generateValue } from '../generate.js';
+import { guarded, textResult } from '../results.js';
+import { environmentSlug, secretName, vaultSlug } from '../schemas.js';
+import { withoutValue } from '../secret.js';
+import { outcome, upsertSecret } from '../upsert.js';
+function summary(written, target, extra = {}) {
+    return {
+        outcome: outcome(written, 'rotated'),
+        ...target,
+        ...extra,
+        secret: withoutValue(written.secret),
+    };
+}
+const charsetNames = Object.keys(CHARSETS);
+export function registerSecretWriteTools(server) {
+    server.tool('set_ferrvault_secret', 'Create a secret, or store a new version of it when it already exists (the previous version stays restorable in FerrVault). The value you pass is part of this conversation; to avoid that, use generate_ferrvault_secret.', {
+        vault: vaultSlug,
+        environment: environmentSlug,
+        name: secretName,
+        value: z.string().min(1).max(65_536).describe('Plaintext value, encrypted by FerrVault'),
+    }, ({ vault, environment, name, value }) => guarded(async () => {
+        const token = await getToken();
+        const target = { vault, environment };
+        return textResult(summary(await upsertSecret(token, target, name, value), target));
+    }));
+    server.tool('generate_ferrvault_secret', 'Generate a cryptographically random value inside the MCP server and store it as a secret, creating it or rotating it to a new version. The value is never returned, so it never enters the conversation; reveal_ferrvault_secret reads it back if the user asks.', {
+        vault: vaultSlug,
+        environment: environmentSlug,
+        name: secretName,
+        length: z
+            .number()
+            .int()
+            .min(8)
+            .max(4096)
+            .optional()
+            .describe('Number of characters (default 48)'),
+        charset: z
+            .enum(charsetNames)
+            .optional()
+            .describe('alphanumeric (default), hex, base64url, or ascii (alphanumeric plus punctuation, no quotes, backslash or space)'),
+    }, ({ vault, environment, name, length = 48, charset = 'alphanumeric' }) => {
+        const value = generateValue(length, charset);
+        return guarded(async () => {
+            const token = await getToken();
+            const target = { vault, environment };
+            const written = await upsertSecret(token, target, name, value);
+            return textResult(summary(written, target, { length, charset }));
+        }, value);
+    });
+}

package/dist/tools/secrets.d.ts

@@ -1,3 +1,3 @@
 import { type McpServer } from '@ferrlabs/mcp-core';
-export declare function registerSecretTools(server: McpServer): void;
+export declare function registerSecretReadTools(server: McpServer): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/tools/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/tools/secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,SAAS,EAAc,MAAM,oBAAoB,CAAC;AAetF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QA8CpD"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/tools/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAM9D,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2C/D"}

package/dist/tools/secrets.js

@@ -1,32 +1,24 @@
-import { z } from 'zod';
-import { apiRequest, getToken, toToolText } from '@ferrlabs/mcp-core';
-export function registerSecretTools(server) {
-    server.tool('list_secrets', 'List secrets inside a FerrVault vault. Values are NOT included — use get_secret with reveal=true to see a specific value.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-    }, async ({ org_slug, project_slug, vault_id }) => {
+import { getToken } from '@ferrlabs/mcp-core';
+import { secretPath, secretsPath, vaultRequest } from '../api.js';
+import { guarded, textResult } from '../results.js';
+import { environmentSlug, secretName, vaultSlug } from '../schemas.js';
+import { withoutValue } from '../secret.js';
+export function registerSecretReadTools(server) {
+    server.tool('list_ferrvault_secrets', 'List the secrets of one vault environment: names, versions, tags and expiry. Never includes values.', { vault: vaultSlug, environment: environmentSlug }, ({ vault, environment }) => guarded(async () => {
         const token = await getToken();
-        const secrets = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults/${encodeURIComponent(vault_id)}/secrets`, { token });
-        return {
-            content: [{ type: 'text', text: toToolText(secrets) }],
-        };
-    });
-    server.tool('get_secret', 'Get one secret. By default returns metadata only; pass reveal=true to also include the decrypted value (audit-logged on the server).', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        secret_id: z.string().min(1).describe('Secret id'),
-        reveal: z
-            .boolean()
-            .optional()
-            .describe('Include the decrypted value in the response (default false).'),
-    }, async ({ org_slug, project_slug, vault_id, secret_id, reveal }) => {
+        const secrets = await vaultRequest(secretsPath({ vault, environment }), { token });
+        return textResult(secrets.map(withoutValue));
+    }));
+    server.tool('reveal_ferrvault_secret', 'Reveal the current plaintext value of one secret. The read is audit-logged by FerrVault and the value lands in this conversation transcript: only call it when the user explicitly asks to see the value. To create or rotate a value without exposing it, use generate_ferrvault_secret.', { vault: vaultSlug, environment: environmentSlug, name: secretName }, ({ vault, environment, name }) => guarded(async () => {
         const token = await getToken();
-        const qs = reveal ? '?reveal=true' : '';
-        const secret = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults/${encodeURIComponent(vault_id)}/secrets/${encodeURIComponent(secret_id)}${qs}`, { token });
-        return {
-            content: [{ type: 'text', text: toToolText(secret) }],
-        };
-    });
+        return textResult(await vaultRequest(secretPath({ vault, environment }, name), { token }));
+    }));
+    server.tool('delete_ferrvault_secret', 'Delete a secret from one vault environment. Workloads reading it lose access.', { vault: vaultSlug, environment: environmentSlug, name: secretName }, ({ vault, environment, name }) => guarded(async () => {
+        const token = await getToken();
+        await vaultRequest(secretPath({ vault, environment }, name), {
+            token,
+            method: 'DELETE',
+        });
+        return textResult({ deleted: name, vault, environment });
+    }));
 }

package/dist/tools/service-tokens.d.ts

@@ -0,0 +1,3 @@
+import { type McpServer } from '@ferrlabs/mcp-core';
+export declare function registerServiceTokenTools(server: McpServer): void;
+//# sourceMappingURL=service-tokens.d.ts.map

package/dist/tools/service-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-tokens.d.ts","sourceRoot":"","sources":["../../src/tools/service-tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA8E9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6DjE"}

package/dist/tools/service-tokens.js

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+import { getToken } from '@ferrlabs/mcp-core';
+import { serviceTokenPath, serviceTokensPath, vaultRequest } from '../api.js';
+import { describeError, guarded, textResult } from '../results.js';
+import { environmentSlug, expiresAt, secretName, serviceTokenId, serviceTokenName, vaultRole, vaultSlug, } from '../schemas.js';
+import { upsertSecret, outcome } from '../upsert.js';
+function metadata(row, scope) {
+    return {
+        id: row.id,
+        name: row.label,
+        vault: scope.vault,
+        environment: scope.environment,
+        role: row.role,
+        created_by: row.created_by,
+        created_at: row.created_at,
+        expires_at: row.expires_at,
+        last_used_at: row.last_used_at,
+    };
+}
+async function revokeQuietly(token, scope, id) {
+    try {
+        await vaultRequest(serviceTokenPath(scope, id), { token, method: 'DELETE' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function storeOrRevoke(token, scope, created, into) {
+    try {
+        return await upsertSecret(token, { vault: into.vault, environment: into.environment }, into.name, created.token);
+    }
+    catch (err) {
+        const revoked = await revokeQuietly(token, scope, created.id);
+        throw new Error(`storing service token ${created.id} failed (${describeError(err)}); ${revoked ? 'the token was revoked' : 'revoking it failed too, revoke it by id'}`);
+    }
+}
+const store = z
+    .object({ vault: vaultSlug, environment: environmentSlug, name: secretName })
+    .describe('Secret the new token value is written to, created or versioned');
+export function registerServiceTokenTools(server) {
+    server.tool('list_ferrvault_service_tokens', 'List the active service tokens (operator tokens) bound to one vault environment: id, name, role, creator, creation, expiry and last use. Never includes the token value. Requires the admin role on the vault.', { vault: vaultSlug, environment: environmentSlug }, ({ vault, environment }) => guarded(async () => {
+        const token = await getToken();
+        const scope = { vault, environment };
+        const rows = await vaultRequest(serviceTokensPath(scope), { token });
+        return textResult(rows.map((row) => metadata(row, scope)));
+    }));
+    server.tool('create_ferrvault_service_token', 'Create a service token (operator token) bound to one vault environment with a role, and write its value into a secret (created, or versioned when it exists) inside the MCP server. The token value is never returned, so it never enters the conversation. If the write fails, the new token is revoked. Requires the admin role on the vault, and write access to the store secret.', {
+        vault: vaultSlug,
+        environment: environmentSlug,
+        name: serviceTokenName,
+        role: vaultRole,
+        expires_at: expiresAt.optional(),
+        store,
+    }, ({ vault, environment, name, role, expires_at, store: into }) => guarded(async (redactLater) => {
+        const token = await getToken();
+        const scope = { vault, environment };
+        const created = await vaultRequest(serviceTokensPath(scope), {
+            token,
+            method: 'POST',
+            body: { label: name, role, expires_at },
+        });
+        redactLater(created.token);
+        const written = await storeOrRevoke(token, scope, created, into);
+        return textResult({
+            token: metadata(created, scope),
+            stored: {
+                outcome: outcome(written, 'versioned'),
+                ...into,
+                version: written.secret.current_version,
+            },
+        });
+    }));
+    server.tool('revoke_ferrvault_service_token', 'Revoke a service token of one vault environment by id. Workloads using it lose access immediately. Requires the admin role on the vault.', { vault: vaultSlug, environment: environmentSlug, id: serviceTokenId }, ({ vault, environment, id }) => guarded(async () => {
+        const token = await getToken();
+        await vaultRequest(serviceTokenPath({ vault, environment }, id), {
+            token,
+            method: 'DELETE',
+        });
+        return textResult({ revoked: id, vault, environment });
+    }));
+}

package/dist/tools/vaults.d.ts

@@ -1,3 +1,3 @@
 import { type McpServer } from '@ferrlabs/mcp-core';
-export declare function registerVaultMutationTools(server: McpServer): void;
+export declare function registerVaultTools(server: McpServer): void;
 //# sourceMappingURL=vaults.d.ts.map

package/dist/tools/vaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/tools/vaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,SAAS,EAAc,MAAM,oBAAoB,CAAC;AAetF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,QAoE3D"}
+{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/tools/vaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK9D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsD1D"}