pulsemcp-cms-admin-mcp-server 0.10.4 → 0.10.6

package/README.md

@@ -40,76 +40,77 @@ This is an MCP ([Model Context Protocol](https://modelcontextprotocol.io/)) Serv
 
 This server is built and tested on macOS with Claude Desktop. It should work with other MCP clients as well.
 
-| Tool Name                              | Tool Group          | Read/Write | Description                                                                                                                         |
-| -------------------------------------- | ------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| `get_newsletter_posts`                 | newsletter          | read       | List newsletter posts with search, sorting, and pagination options.                                                                 |
-| `get_newsletter_post`                  | newsletter          | read       | Retrieve a specific newsletter post by its unique slug.                                                                             |
-| `draft_newsletter_post`                | newsletter          | write      | Create a new draft newsletter post with title, body, and metadata.                                                                  |
-| `update_newsletter_post`               | newsletter          | write      | Update an existing newsletter post's content and metadata (except status).                                                          |
-| `upload_image`                         | newsletter          | write      | Upload an image and attach it to a specific newsletter post.                                                                        |
-| `get_authors`                          | newsletter          | read       | Get a list of authors with optional search and pagination.                                                                          |
-| `search_mcp_implementations`           | server_directory    | read       | Search for MCP servers and clients in the PulseMCP registry.                                                                        |
-| `get_draft_mcp_implementations`        | server_directory    | read       | Retrieve paginated list of draft MCP implementations needing review.                                                                |
-| `find_providers`                       | server_directory    | read       | Search for providers by ID, name, URL, or slug.                                                                                     |
-| `save_mcp_implementation`              | server_directory    | write      | Update an MCP implementation (replicates Admin panel "Save Changes" button).                                                        |
-| `send_impl_posted_notif`               | server_directory    | write      | Send email notification when MCP implementation goes live.                                                                          |
-| `get_official_mirror_queue_items`      | official_queue      | read       | List and filter official mirror queue entries with pagination and search.                                                           |
-| `get_official_mirror_queue_item`       | official_queue      | read       | Get detailed information about a single official mirror queue entry.                                                                |
-| `approve_official_mirror_queue_item`   | official_queue      | write      | Approve a queue entry and link it to an existing MCP server (async).                                                                |
-| `approve_mirror_no_modify`             | official_queue      | write      | Approve without updating the linked server.                                                                                         |
-| `reject_official_mirror_queue_item`    | official_queue      | write      | Reject a queue entry (async operation).                                                                                             |
-| `add_official_mirror_to_regular_queue` | official_queue      | write      | Convert a queue entry to a draft MCP implementation (async).                                                                        |
-| `unlink_official_mirror_queue_item`    | official_queue      | write      | Unlink a queue entry from its linked MCP server.                                                                                    |
-| `get_unofficial_mirrors`               | unofficial_mirrors  | read       | List unofficial mirrors with search, pagination, and MCP server filtering.                                                          |
-| `get_unofficial_mirror`                | unofficial_mirrors  | read       | Get detailed unofficial mirror info by ID or name.                                                                                  |
-| `create_unofficial_mirror`             | unofficial_mirrors  | write      | Create a new unofficial mirror entry with JSON data.                                                                                |
-| `update_unofficial_mirror`             | unofficial_mirrors  | write      | Update an existing unofficial mirror by ID.                                                                                         |
-| `delete_unofficial_mirror`             | unofficial_mirrors  | write      | Delete an unofficial mirror by ID (irreversible).                                                                                   |
-| `get_official_mirrors`                 | official_mirrors    | read       | List official mirrors with search, status, and processing filters.                                                                  |
-| `get_official_mirror`                  | official_mirrors    | read       | Get detailed official mirror info by ID or name.                                                                                    |
-| `get_tenants`                          | tenants             | read       | List tenants with search and admin status filtering.                                                                                |
-| `get_tenant`                           | tenants             | read       | Get detailed tenant info by ID or slug.                                                                                             |
-| `create_tenant`                        | tenants             | write      | Create a new tenant for sub-registry provisioning.                                                                                  |
-| `create_api_key`                       | tenants             | write      | Create an API key for a tenant. Returns the raw key (only available at creation time).                                              |
-| `revoke_api_key`                       | tenants             | write      | Revoke an API key by ID, immediately invalidating it. Idempotent. Requires elicitation approval.                                    |
-| `delete_tenant`                        | tenants_destructive | write      | Permanently delete a tenant. Requires elicitation approval. With `force: true`, cascades to dependents.                             |
-| `delete_api_key`                       | tenants_destructive | write      | Permanently revoke (delete) an API key. Idempotent. Requires elicitation approval.                                                  |
-| `get_mcp_jsons`                        | mcp_jsons           | read       | List MCP JSON configs with mirror and server filtering.                                                                             |
-| `get_mcp_json`                         | mcp_jsons           | read       | Get a single MCP JSON configuration by ID.                                                                                          |
-| `create_mcp_json`                      | mcp_jsons           | write      | Create a new MCP JSON configuration for an unofficial mirror.                                                                       |
-| `update_mcp_json`                      | mcp_jsons           | write      | Update an existing MCP JSON configuration by ID.                                                                                    |
-| `delete_mcp_json`                      | mcp_jsons           | write      | Delete an MCP JSON configuration by ID (irreversible).                                                                              |
-| `list_mcp_servers`                     | mcp_servers         | read       | List/search MCP servers with filtering by status, classification, pagination.                                                       |
-| `get_mcp_server`                       | mcp_servers         | read       | Get detailed MCP server info by slug (unified view of all admin UI fields).                                                         |
-| `update_mcp_server`                    | mcp_servers         | write      | Update an MCP server's fields (all admin UI fields supported).                                                                      |
-| `recache_mcp_server`                   | mcp_servers         | write      | Refresh the cache for a specific MCP server (show page, cards, canonicals, parent pages).                                           |
-| `set_github_repository_classification` | mcp_servers         | write      | Set a GitHub repository's `classification` (e.g. `other` to drop a non-MCP-driven platform repo from the gh_stars popularity path). |
-| `get_redirects`                        | redirects           | read       | List URL redirects with search, status filtering, and pagination.                                                                   |
-| `get_redirect`                         | redirects           | read       | Get detailed redirect info by ID.                                                                                                   |
-| `create_redirect`                      | redirects           | write      | Create a new URL redirect entry.                                                                                                    |
-| `update_redirect`                      | redirects           | write      | Update an existing URL redirect by ID.                                                                                              |
-| `delete_redirect`                      | redirects           | write      | Delete a URL redirect by ID (irreversible).                                                                                         |
-| `list_good_jobs`                       | good_jobs           | read       | List and filter background jobs by queue, status, job class, and date range.                                                        |
-| `get_good_job`                         | good_jobs           | read       | Get detailed information about a specific background job.                                                                           |
-| `list_good_job_cron_schedules`         | good_jobs           | read       | List all configured cron schedules.                                                                                                 |
-| `list_good_job_processes`              | good_jobs           | read       | List active worker processes.                                                                                                       |
-| `get_good_job_queue_statistics`        | good_jobs           | read       | Get aggregate job statistics by status.                                                                                             |
-| `retry_good_job`                       | good_jobs           | write      | Retry a failed or discarded background job.                                                                                         |
-| `discard_good_job`                     | good_jobs           | write      | Discard a background job to prevent retries.                                                                                        |
-| `reschedule_good_job`                  | good_jobs           | write      | Reschedule a background job to a new time.                                                                                          |
-| `force_trigger_good_job_cron`          | good_jobs           | write      | Force trigger a cron schedule immediately.                                                                                          |
-| `cleanup_good_jobs`                    | good_jobs           | write      | Clean up old background jobs by status and age.                                                                                     |
-| `run_exam_for_mirror`                  | proctor             | write      | Run proctor exams against unofficial mirrors via Fly Machines. Returns truncated summary with `result_id`.                          |
-| `get_exam_result`                      | proctor             | read       | Retrieve full untruncated exam results by `result_id`, with optional section/mirror filtering.                                      |
-| `save_results_for_mirror`              | proctor             | write      | Save proctor exam results via `result_id` from `run_exam_for_mirror`.                                                               |
-| `list_proctor_runs`                    | proctor             | read       | List proctor runs with filtering by name, recommended status, and tenant IDs.                                                       |
-| `get_proctor_metadata`                 | proctor             | read       | Get available proctor runtimes and exam types.                                                                                      |
-| `list_discovered_urls`                 | discovered_urls     | read       | List discovered URLs with status filtering and pagination.                                                                          |
-| `mark_discovered_url_processed`        | discovered_urls     | write      | Mark a discovered URL as processed with a result status.                                                                            |
-| `get_discovered_url_stats`             | discovered_urls     | read       | Get summary statistics for discovered URLs pipeline.                                                                                |
-| `get_moz_metrics`                      | moz                 | read       | Fetch live URL metrics from the MOZ API (page authority, domain authority, spam score, link counts).                                |
-| `get_moz_backlinks`                    | moz                 | read       | Fetch live backlink data from the MOZ API (source pages, anchor text, domain authority).                                            |
-| `get_moz_stored_metrics`               | moz                 | read       | List stored/historical MOZ data for a server's canonicals with pagination.                                                          |
+| Tool Name                              | Tool Group          | Read/Write | Description                                                                                                                                                                               |
+| -------------------------------------- | ------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `get_newsletter_posts`                 | newsletter          | read       | List newsletter posts with search, sorting, and pagination options.                                                                                                                       |
+| `get_newsletter_post`                  | newsletter          | read       | Retrieve a specific newsletter post by its unique slug.                                                                                                                                   |
+| `draft_newsletter_post`                | newsletter          | write      | Create a new draft newsletter post with title, body, and metadata.                                                                                                                        |
+| `update_newsletter_post`               | newsletter          | write      | Update an existing newsletter post's content and metadata (except status).                                                                                                                |
+| `upload_image`                         | newsletter          | write      | Upload an image and attach it to a specific newsletter post.                                                                                                                              |
+| `get_authors`                          | newsletter          | read       | Get a list of authors with optional search and pagination.                                                                                                                                |
+| `search_mcp_implementations`           | server_directory    | read       | Search for MCP servers and clients in the PulseMCP registry.                                                                                                                              |
+| `get_draft_mcp_implementations`        | server_directory    | read       | Retrieve paginated list of draft MCP implementations needing review.                                                                                                                      |
+| `find_providers`                       | server_directory    | read       | Search for providers by ID, name, URL, or slug.                                                                                                                                           |
+| `save_mcp_implementation`              | server_directory    | write      | Update an MCP implementation (replicates Admin panel "Save Changes" button).                                                                                                              |
+| `send_impl_posted_notif`               | server_directory    | write      | Send email notification when MCP implementation goes live.                                                                                                                                |
+| `get_official_mirror_queue_items`      | official_queue      | read       | List and filter official mirror queue entries with pagination and search.                                                                                                                 |
+| `get_official_mirror_queue_item`       | official_queue      | read       | Get detailed information about a single official mirror queue entry.                                                                                                                      |
+| `approve_official_mirror_queue_item`   | official_queue      | write      | Approve a queue entry and link it to an existing MCP server (async).                                                                                                                      |
+| `approve_mirror_no_modify`             | official_queue      | write      | Approve without updating the linked server.                                                                                                                                               |
+| `reject_official_mirror_queue_item`    | official_queue      | write      | Reject a queue entry (async operation).                                                                                                                                                   |
+| `add_official_mirror_to_regular_queue` | official_queue      | write      | Convert a queue entry to a draft MCP implementation (async).                                                                                                                              |
+| `unlink_official_mirror_queue_item`    | official_queue      | write      | Unlink a queue entry from its linked MCP server.                                                                                                                                          |
+| `get_unofficial_mirrors`               | unofficial_mirrors  | read       | List unofficial mirrors with search, pagination, and MCP server filtering.                                                                                                                |
+| `get_unofficial_mirror`                | unofficial_mirrors  | read       | Get detailed unofficial mirror info by ID or name.                                                                                                                                        |
+| `create_unofficial_mirror`             | unofficial_mirrors  | write      | Create a new unofficial mirror entry with JSON data.                                                                                                                                      |
+| `update_unofficial_mirror`             | unofficial_mirrors  | write      | Update an existing unofficial mirror by ID.                                                                                                                                               |
+| `delete_unofficial_mirror`             | unofficial_mirrors  | write      | Delete an unofficial mirror by ID (irreversible).                                                                                                                                         |
+| `get_official_mirrors`                 | official_mirrors    | read       | List official mirrors with search, status, and processing filters.                                                                                                                        |
+| `get_official_mirror`                  | official_mirrors    | read       | Get detailed official mirror info by ID or name.                                                                                                                                          |
+| `get_tenants`                          | tenants             | read       | List tenants with search and admin status filtering.                                                                                                                                      |
+| `get_tenant`                           | tenants             | read       | Get detailed tenant info by ID or slug.                                                                                                                                                   |
+| `create_tenant`                        | tenants             | write      | Create a new tenant for sub-registry provisioning.                                                                                                                                        |
+| `create_api_key`                       | tenants             | write      | Create an API key for a tenant. Returns the raw key (only available at creation time).                                                                                                    |
+| `revoke_api_key`                       | tenants             | write      | Revoke an API key by ID, immediately invalidating it. Idempotent. Requires elicitation approval.                                                                                          |
+| `delete_tenant`                        | tenants_destructive | write      | Permanently delete a tenant. Requires elicitation approval. With `force: true`, cascades to dependents.                                                                                   |
+| `delete_api_key`                       | tenants_destructive | write      | Permanently revoke (delete) an API key. Idempotent. Requires elicitation approval.                                                                                                        |
+| `get_mcp_jsons`                        | mcp_jsons           | read       | List MCP JSON configs with mirror and server filtering.                                                                                                                                   |
+| `get_mcp_json`                         | mcp_jsons           | read       | Get a single MCP JSON configuration by ID.                                                                                                                                                |
+| `create_mcp_json`                      | mcp_jsons           | write      | Create a new MCP JSON configuration for an unofficial mirror.                                                                                                                             |
+| `update_mcp_json`                      | mcp_jsons           | write      | Update an existing MCP JSON configuration by ID.                                                                                                                                          |
+| `delete_mcp_json`                      | mcp_jsons           | write      | Delete an MCP JSON configuration by ID (irreversible).                                                                                                                                    |
+| `list_mcp_servers`                     | mcp_servers         | read       | List/search MCP servers with filtering by status, classification, pagination.                                                                                                             |
+| `get_mcp_server`                       | mcp_servers         | read       | Get detailed MCP server info by slug (unified view of all admin UI fields).                                                                                                               |
+| `update_mcp_server`                    | mcp_servers         | write      | Update an MCP server's fields (all admin UI fields supported).                                                                                                                            |
+| `recache_mcp_server`                   | mcp_servers         | write      | Refresh the cache for a specific MCP server (show page, cards, canonicals, parent pages).                                                                                                 |
+| `set_github_repository_classification` | mcp_servers         | write      | Set a GitHub repository's `classification` (e.g. `other` to drop a non-MCP-driven platform repo from the gh_stars popularity path).                                                       |
+| `get_redirects`                        | redirects           | read       | List URL redirects with search, status filtering, and pagination.                                                                                                                         |
+| `get_redirect`                         | redirects           | read       | Get detailed redirect info by ID.                                                                                                                                                         |
+| `create_redirect`                      | redirects           | write      | Create a new URL redirect entry.                                                                                                                                                          |
+| `update_redirect`                      | redirects           | write      | Update an existing URL redirect by ID.                                                                                                                                                    |
+| `delete_redirect`                      | redirects           | write      | Delete a URL redirect by ID (irreversible).                                                                                                                                               |
+| `list_good_jobs`                       | good_jobs           | read       | List and filter background jobs by queue, status, job class, and date range.                                                                                                              |
+| `get_good_job`                         | good_jobs           | read       | Get detailed information about a specific background job.                                                                                                                                 |
+| `list_good_job_cron_schedules`         | good_jobs           | read       | List all configured cron schedules.                                                                                                                                                       |
+| `list_good_job_processes`              | good_jobs           | read       | List active worker processes.                                                                                                                                                             |
+| `get_good_job_queue_statistics`        | good_jobs           | read       | Get aggregate job statistics by status.                                                                                                                                                   |
+| `retry_good_job`                       | good_jobs           | write      | Retry a failed or discarded background job.                                                                                                                                               |
+| `discard_good_job`                     | good_jobs           | write      | Discard a background job to prevent retries.                                                                                                                                              |
+| `reschedule_good_job`                  | good_jobs           | write      | Reschedule a background job to a new time.                                                                                                                                                |
+| `force_trigger_good_job_cron`          | good_jobs           | write      | Force trigger a cron schedule immediately.                                                                                                                                                |
+| `cleanup_good_jobs`                    | good_jobs           | write      | Clean up old background jobs by status and age.                                                                                                                                           |
+| `run_exam_for_mirror`                  | proctor             | write      | Run proctor exams against unofficial mirrors via Fly Machines. Returns truncated summary with `result_id`.                                                                                |
+| `get_exam_result`                      | proctor             | read       | Retrieve full untruncated exam results by `result_id`, with optional section/mirror filtering.                                                                                            |
+| `save_results_for_mirror`              | proctor             | write      | Save proctor exam results via `result_id` from `run_exam_for_mirror`.                                                                                                                     |
+| `list_proctor_runs`                    | proctor             | read       | List proctor runs with filtering by name, recommended status, and tenant IDs.                                                                                                             |
+| `get_proctor_metadata`                 | proctor             | read       | Get available proctor runtimes and exam types.                                                                                                                                            |
+| `list_discovered_urls`                 | discovered_urls     | read       | List discovered URLs with status filtering and pagination.                                                                                                                                |
+| `mark_discovered_url_processed`        | discovered_urls     | write      | Mark a discovered URL as processed with a result status.                                                                                                                                  |
+| `get_discovered_url_stats`             | discovered_urls     | read       | Get summary statistics for discovered URLs pipeline.                                                                                                                                      |
+| `get_moz_metrics`                      | moz                 | read       | Fetch live URL metrics from the MOZ API (page authority, domain authority, spam score, link counts).                                                                                      |
+| `get_moz_backlinks`                    | moz                 | read       | Fetch live backlink data from the MOZ API (source pages, anchor text, domain authority).                                                                                                  |
+| `get_moz_stored_metrics`               | moz                 | read       | List stored/historical MOZ data for a server's canonicals with pagination.                                                                                                                |
+| `link_secret_to_mcp_server`            | secrets             | write      | Make an auth secret available to an MCP server: upsert a Secret (referencing a 1Password item) and write the server↔secret link Proctor reads. The raw secret value never passes through. |
 
 # Tool Groups
 
@@ -149,6 +150,7 @@ This server organizes tools into groups that can be selectively enabled or disab
 | `discovered_urls_readonly`    | 2     | Discovered URL tools read-only (list, stats)                                                                                                                                |
 | `moz`                         | 3     | MOZ SEO metrics — live URL metrics, backlinks, and stored historical data (all read-only)                                                                                   |
 | `moz_readonly`                | 3     | MOZ tools read-only (alias — all MOZ tools are read-only)                                                                                                                   |
+| `secrets`                     | 1     | Auth-secret ↔ MCP server linking. Write-only (no `_readonly` variant): upserts a 1Password-referenced Secret and links it to a server so Proctor can inject it at runtime.  |
 
 ### Tools by Group
 
@@ -191,18 +193,20 @@ This server organizes tools into groups that can be selectively enabled or disab
   - Write: `mark_discovered_url_processed`
 - **moz** / **moz_readonly**:
   - Read-only: `get_moz_metrics`, `get_moz_backlinks`, `get_moz_stored_metrics`
+- **secrets** (write-only — no `_readonly` variant):
+  - Write: `link_secret_to_mcp_server`
 
 ## Environment Variables
 
-| Variable                                           | Description                                                                                                                                                                                                                                                                                                                 | Default                                                                                                                                                                          |
-| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `PULSEMCP_ADMIN_API_KEY`                           | API key sent as `X-API-Key` for admin-API authentication. Required.                                                                                                                                                                                                                                                         | —                                                                                                                                                                                |
-| `PULSEMCP_ADMIN_API_URL`                           | Base URL for the admin API.                                                                                                                                                                                                                                                                                                 | `https://admin.pulsemcp.com`                                                                                                                                                     |
-| `PULSEMCP_ADMIN_INTERNAL_SECRET`                   | Optional shared secret sent as the `X-PulseMCP-Internal` header. A Cloudflare custom rule uses it to route trusted internal traffic past the WAF and rate limiter in front of `admin.pulsemcp.com`. Needed in production to avoid spurious 403s; leave unset locally and against staging (staging is grey-clouded, no WAF). | unset                                                                                                                                                                            |
-| `TOOL_GROUPS`                                      | Comma-separated list of enabled tool groups. `tenants_destructive` is **NOT** included in the default; opt in explicitly.                                                                                                                                                                                                   | `newsletter,server_directory,official_queue,unofficial_mirrors,official_mirrors,tenants,mcp_jsons,mcp_servers,redirects,good_jobs,proctor,discovered_urls,moz` (all base groups) |
-| `DANGEROUSLY_SKIP_ELICITATIONS`                    | When set to `true`, skips elicitation prompts for destructive tools (`delete_tenant`, `delete_api_key`, `revoke_api_key`). Use only when running in trusted automation that already has its own approval gate.                                                                                                              | unset (false)                                                                                                                                                                    |
-| `PULSEMCP_CMS_ADMIN_ELICITATION_DESTRUCTIVE`       | Per-action override. Set to `false` to skip elicitation for destructive tools while leaving other elicitation behavior unchanged. Implied false when `DANGEROUSLY_SKIP_ELICITATIONS=true`.                                                                                                                                  | `true`                                                                                                                                                                           |
-| `ELICITATION_REQUEST_URL` / `ELICITATION_POLL_URL` | HTTP fallback elicitation endpoints (used when the MCP client doesn't support native elicitation). Both must be set together. Required at startup if `tenants_destructive` is enabled and `DANGEROUSLY_SKIP_ELICITATIONS` is not set.                                                                                       | unset                                                                                                                                                                            |
+| Variable                                           | Description                                                                                                                                                                                                                                                                                                                 | Default                                                                                                                                                                                  |
+| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `PULSEMCP_ADMIN_API_KEY`                           | API key sent as `X-API-Key` for admin-API authentication. Required.                                                                                                                                                                                                                                                         | —                                                                                                                                                                                        |
+| `PULSEMCP_ADMIN_API_URL`                           | Base URL for the admin API.                                                                                                                                                                                                                                                                                                 | `https://admin.pulsemcp.com`                                                                                                                                                             |
+| `PULSEMCP_ADMIN_INTERNAL_SECRET`                   | Optional shared secret sent as the `X-PulseMCP-Internal` header. A Cloudflare custom rule uses it to route trusted internal traffic past the WAF and rate limiter in front of `admin.pulsemcp.com`. Needed in production to avoid spurious 403s; leave unset locally and against staging (staging is grey-clouded, no WAF). | unset                                                                                                                                                                                    |
+| `TOOL_GROUPS`                                      | Comma-separated list of enabled tool groups. `tenants_destructive` is **NOT** included in the default; opt in explicitly.                                                                                                                                                                                                   | `newsletter,server_directory,official_queue,unofficial_mirrors,official_mirrors,tenants,mcp_jsons,mcp_servers,redirects,good_jobs,proctor,discovered_urls,moz,secrets` (all base groups) |
+| `DANGEROUSLY_SKIP_ELICITATIONS`                    | When set to `true`, skips elicitation prompts for destructive tools (`delete_tenant`, `delete_api_key`, `revoke_api_key`). Use only when running in trusted automation that already has its own approval gate.                                                                                                              | unset (false)                                                                                                                                                                            |
+| `PULSEMCP_CMS_ADMIN_ELICITATION_DESTRUCTIVE`       | Per-action override. Set to `false` to skip elicitation for destructive tools while leaving other elicitation behavior unchanged. Implied false when `DANGEROUSLY_SKIP_ELICITATIONS=true`.                                                                                                                                  | `true`                                                                                                                                                                                   |
+| `ELICITATION_REQUEST_URL` / `ELICITATION_POLL_URL` | HTTP fallback elicitation endpoints (used when the MCP client doesn't support native elicitation). Both must be set together. Required at startup if `tenants_destructive` is enabled and `DANGEROUSLY_SKIP_ELICITATIONS` is not set.                                                                                       | unset                                                                                                                                                                                    |
 
 ### Destructive tools and elicitation
 

package/build/shared/src/pulsemcp-admin-client/lib/create-secret.js

@@ -0,0 +1,41 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Create a secret. The secret's value stays in 1Password — this only records
+ * the `onepassword_item_id` reference plus metadata.
+ */
+export async function createSecret(apiKey, baseUrl, params) {
+    const url = new URL('/api/secrets', baseUrl);
+    const body = {
+        slug: params.slug,
+        onepassword_item_id: params.onepassword_item_id,
+    };
+    if (params.title !== undefined) {
+        body.title = params.title;
+    }
+    if (params.description !== undefined) {
+        body.description = params.description;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to create secret: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/build/shared/src/pulsemcp-admin-client/lib/get-secret.js

@@ -0,0 +1,28 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Fetch a secret by id or slug. Returns null when the secret does not exist
+ * (HTTP 404) so callers can branch on create-vs-reuse without catching errors.
+ */
+export async function getSecret(apiKey, baseUrl, idOrSlug) {
+    const url = new URL(`/api/secrets/${encodeURIComponent(String(idOrSlug))}`, baseUrl);
+    const response = await adminFetch(url.toString(), {
+        method: 'GET',
+        headers: {
+            'X-API-Key': apiKey,
+            Accept: 'application/json',
+        },
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            return null;
+        }
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks admin privileges');
+        }
+        throw new Error(`Failed to fetch secret: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/build/shared/src/pulsemcp-admin-client/lib/link-secret-to-server.js

@@ -0,0 +1,50 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Link an MCP server to a secret by writing the mcp_servers_secrets join row.
+ * This join is what Proctor reads to inject the secret value at runtime, so it
+ * is the operation that actually scopes a stored secret to a server.
+ *
+ * Idempotent on the backend: relinking an already-linked server returns the
+ * existing join (updating onepassword_tag when a new value is supplied) instead
+ * of erroring or duplicating.
+ */
+export async function linkSecretToServer(apiKey, baseUrl, params) {
+    const url = new URL(`/api/secrets/${encodeURIComponent(String(params.secret))}/servers`, baseUrl);
+    const body = {};
+    if (params.mcp_server_id !== undefined) {
+        body.mcp_server_id = params.mcp_server_id;
+    }
+    if (params.mcp_server_slug !== undefined) {
+        body.mcp_server_slug = params.mcp_server_slug;
+    }
+    if (params.onepassword_tag !== undefined) {
+        body.onepassword_tag = params.onepassword_tag;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            const errorData = (await response.json().catch(() => ({})));
+            throw new Error(errorData.error || 'Secret or MCP server not found');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to link secret to server: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/build/shared/src/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.js

@@ -1105,5 +1105,58 @@ export function createMockPulseMCPAdminClient(mockData) {
                 classification,
             };
         },
+        // Secret REST API methods
+        async getSecret(idOrSlug) {
+            if (mockData.errors?.getSecret) {
+                throw mockData.errors.getSecret;
+            }
+            const key = String(idOrSlug);
+            return mockData.secretsBySlug?.[key] ?? null;
+        },
+        async createSecret(params) {
+            if (mockData.errors?.createSecret) {
+                throw mockData.errors.createSecret;
+            }
+            if (mockData.createSecretResponse) {
+                return mockData.createSecretResponse;
+            }
+            return {
+                id: 1,
+                slug: params.slug,
+                onepassword_item_id: params.onepassword_item_id,
+                title: params.title ?? null,
+                description: params.description ?? null,
+                mcp_servers_count: 0,
+                mcp_server_slugs: [],
+                created_at: new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+            };
+        },
+        async linkSecretToServer(params) {
+            if (mockData.errors?.linkSecretToServer) {
+                throw mockData.errors.linkSecretToServer;
+            }
+            if (mockData.linkSecretToServerResponse) {
+                return mockData.linkSecretToServerResponse;
+            }
+            const slug = typeof params.secret === 'string' ? params.secret : `secret-${params.secret}`;
+            const serverSlug = params.mcp_server_slug ?? 'mock-server';
+            return {
+                id: 1,
+                slug,
+                onepassword_item_id: 'op://Vault/Item/credential',
+                title: null,
+                description: null,
+                mcp_servers_count: 1,
+                mcp_server_slugs: [serverSlug],
+                created_at: new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+                link: {
+                    mcp_server_id: params.mcp_server_id ?? 1,
+                    mcp_server_slug: serverSlug,
+                    onepassword_tag: params.onepassword_tag ?? null,
+                },
+            };
+        },
     };
 }

package/build/shared/src/server.js

@@ -51,6 +51,9 @@ import { getRedirect } from './pulsemcp-admin-client/lib/get-redirect.js';
 import { createRedirect } from './pulsemcp-admin-client/lib/create-redirect.js';
 import { updateRedirect } from './pulsemcp-admin-client/lib/update-redirect.js';
 import { deleteRedirect } from './pulsemcp-admin-client/lib/delete-redirect.js';
+import { getSecret } from './pulsemcp-admin-client/lib/get-secret.js';
+import { createSecret } from './pulsemcp-admin-client/lib/create-secret.js';
+import { linkSecretToServer } from './pulsemcp-admin-client/lib/link-secret-to-server.js';
 import { getGoodJobs } from './pulsemcp-admin-client/lib/get-good-jobs.js';
 import { getGoodJob } from './pulsemcp-admin-client/lib/get-good-job.js';
 import { getGoodJobCronSchedules } from './pulsemcp-admin-client/lib/get-good-job-cron-schedules.js';
@@ -270,6 +273,16 @@ export class PulseMCPAdminClient {
     async deleteRedirect(id) {
         return deleteRedirect(this.apiKey, this.baseUrl, id);
     }
+    // Secret REST API methods
+    async getSecret(idOrSlug) {
+        return getSecret(this.apiKey, this.baseUrl, idOrSlug);
+    }
+    async createSecret(params) {
+        return createSecret(this.apiKey, this.baseUrl, params);
+    }
+    async linkSecretToServer(params) {
+        return linkSecretToServer(this.apiKey, this.baseUrl, params);
+    }
     // GoodJob REST API methods
     async getGoodJobs(params) {
         return getGoodJobs(this.apiKey, this.baseUrl, params);

package/build/shared/src/tools/link-secret-to-mcp-server.js

@@ -0,0 +1,140 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    slug: 'Unique slug identifier for the secret (lowercase, hyphenated, e.g. "linear-api-key"). Used to look up an existing secret or to create a new one.',
+    onepassword_item_id: 'The 1Password item reference the secret value lives in (e.g. "op://Vault/Item/credential"). The raw secret value is NEVER passed through this tool — only this reference. If a secret with this slug already exists, this must match its stored reference.',
+    mcp_server_slug: 'Slug of the MCP server to grant the secret to (e.g. "linear"). The link is what Proctor reads to inject the secret value when running that server.',
+    title: 'Optional human-readable title for the secret (only used when creating a new secret).',
+    description: 'Optional description of what the secret is for (only used when creating a new secret).',
+    onepassword_tag: 'Optional tag scoping which field of the 1Password item to inject for this server (e.g. "production"). Stored on the server↔secret link, so the same secret can inject different fields per server.',
+};
+const LinkSecretToMcpServerSchema = z.object({
+    slug: z.string().describe(PARAM_DESCRIPTIONS.slug),
+    onepassword_item_id: z.string().describe(PARAM_DESCRIPTIONS.onepassword_item_id),
+    mcp_server_slug: z.string().describe(PARAM_DESCRIPTIONS.mcp_server_slug),
+    title: z.string().optional().describe(PARAM_DESCRIPTIONS.title),
+    description: z.string().optional().describe(PARAM_DESCRIPTIONS.description),
+    onepassword_tag: z.string().optional().describe(PARAM_DESCRIPTIONS.onepassword_tag),
+});
+export function linkSecretToMcpServer(_server, clientFactory) {
+    return {
+        name: 'link_secret_to_mcp_server',
+        description: `Make an auth secret available to an MCP server. This upserts a Secret (by slug) that references a 1Password item, then writes the server↔secret link that Proctor reads to inject the secret value at runtime.
+
+The raw secret value stays in 1Password — this tool only deals in the 1Password item reference ("onepassword_item_id") and slug, never a credential value.
+
+Behavior:
+- If no secret with "slug" exists, it is created from "onepassword_item_id" (plus optional title/description).
+- If a secret with "slug" already exists, it is reused. Its stored "onepassword_item_id" must match the one you pass, otherwise the tool errors instead of silently rebinding a shared secret.
+- The link is idempotent: re-running for an already-linked server updates the "onepassword_tag" (when provided) without creating a duplicate.
+
+Example request:
+{
+  "slug": "linear-api-key",
+  "onepassword_item_id": "op://Shared/Linear API Key/credential",
+  "mcp_server_slug": "linear",
+  "onepassword_tag": "production"
+}
+
+Use cases:
+- Onboarding an auth-gated MCP server: register its credential reference and scope it to the server so Proctor can run it.
+- Granting an already-registered secret to an additional server.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                slug: { type: 'string', description: PARAM_DESCRIPTIONS.slug },
+                onepassword_item_id: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.onepassword_item_id,
+                },
+                mcp_server_slug: { type: 'string', description: PARAM_DESCRIPTIONS.mcp_server_slug },
+                title: { type: 'string', description: PARAM_DESCRIPTIONS.title },
+                description: { type: 'string', description: PARAM_DESCRIPTIONS.description },
+                onepassword_tag: { type: 'string', description: PARAM_DESCRIPTIONS.onepassword_tag },
+            },
+            required: ['slug', 'onepassword_item_id', 'mcp_server_slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = LinkSecretToMcpServerSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const existing = await client.getSecret(validatedArgs.slug);
+                if (existing && existing.onepassword_item_id !== validatedArgs.onepassword_item_id) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Error: a secret with slug "${validatedArgs.slug}" already exists but references a different 1Password item ` +
+                                    `("${existing.onepassword_item_id}", not "${validatedArgs.onepassword_item_id}"). ` +
+                                    `Refusing to rebind it, since other servers may depend on it. ` +
+                                    `Use a different slug, or update the existing secret explicitly if the reference really changed.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                let created = false;
+                if (!existing) {
+                    try {
+                        await client.createSecret({
+                            slug: validatedArgs.slug,
+                            onepassword_item_id: validatedArgs.onepassword_item_id,
+                            title: validatedArgs.title,
+                            description: validatedArgs.description,
+                        });
+                    }
+                    catch (createError) {
+                        // The backend also enforces uniqueness on onepassword_item_id, so the
+                        // item may already be registered under a *different* slug than the one
+                        // requested. getSecret(slug) can't surface that (it looks up by slug),
+                        // so translate the opaque uniqueness 422 into actionable guidance
+                        // instead of letting the raw validation message reach the agent.
+                        const message = createError instanceof Error ? createError.message : String(createError);
+                        if (/onepassword item/i.test(message) && /taken/i.test(message)) {
+                            return {
+                                content: [
+                                    {
+                                        type: 'text',
+                                        text: `Error: the 1Password item "${validatedArgs.onepassword_item_id}" is already registered under a different secret slug, ` +
+                                            `so it cannot be created again as "${validatedArgs.slug}". ` +
+                                            `To link it to "${validatedArgs.mcp_server_slug}", re-run this tool with the existing secret's slug ` +
+                                            `(find it via the secrets list), or register a different 1Password item under "${validatedArgs.slug}".`,
+                                    },
+                                ],
+                                isError: true,
+                            };
+                        }
+                        throw createError;
+                    }
+                    created = true;
+                }
+                const result = await client.linkSecretToServer({
+                    secret: validatedArgs.slug,
+                    mcp_server_slug: validatedArgs.mcp_server_slug,
+                    onepassword_tag: validatedArgs.onepassword_tag,
+                });
+                let content = `Successfully linked secret "${result.slug}" to MCP server "${result.link.mcp_server_slug}".\n\n`;
+                content += `**Secret:** ${result.slug} (id ${result.id}) — ${created ? 'created' : 'reused existing'}\n`;
+                content += `**1Password item:** ${result.onepassword_item_id}\n`;
+                content += `**Linked server:** ${result.link.mcp_server_slug} (id ${result.link.mcp_server_id})\n`;
+                if (result.link.onepassword_tag) {
+                    content += `**1Password tag:** ${result.link.onepassword_tag}\n`;
+                }
+                if (result.mcp_server_slugs && result.mcp_server_slugs.length > 0) {
+                    content += `**All servers using this secret:** ${result.mcp_server_slugs.join(', ')}\n`;
+                }
+                return { content: [{ type: 'text', text: content }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error linking secret to MCP server: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools.js

@@ -55,6 +55,8 @@ import { getRedirect } from './tools/get-redirect.js';
 import { createRedirect } from './tools/create-redirect.js';
 import { updateRedirect } from './tools/update-redirect.js';
 import { deleteRedirect } from './tools/delete-redirect.js';
+// Secret tools
+import { linkSecretToMcpServer } from './tools/link-secret-to-mcp-server.js';
 // GoodJob tools
 import { listGoodJobs } from './tools/list-good-jobs.js';
 import { getGoodJob } from './tools/get-good-job.js';
@@ -254,6 +256,8 @@ const ALL_TOOLS = [
     { factory: createRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: updateRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: deleteRedirect, groups: ['redirects'], isWriteOperation: true },
+    // Secret tools (write-only: upsert a secret + write the mcp_servers_secrets join Proctor reads)
+    { factory: linkSecretToMcpServer, groups: ['secrets'], isWriteOperation: true },
     // GoodJob tools
     { factory: listGoodJobs, groups: ['good_jobs'], isWriteOperation: false },
     { factory: getGoodJob, groups: ['good_jobs'], isWriteOperation: false },
@@ -328,6 +332,7 @@ const VALID_TOOL_GROUPS = [
     'mcp_servers_readonly',
     'redirects',
     'redirects_readonly',
+    'secrets',
     'good_jobs',
     'good_jobs_readonly',
     'proctor',
@@ -351,6 +356,7 @@ const BASE_TOOL_GROUPS = [
     'mcp_jsons',
     'mcp_servers',
     'redirects',
+    'secrets',
     'good_jobs',
     'proctor',
     'discovered_urls',

package/node_modules/@pulsemcp/mcp-elicitation/package.json

@@ -23,6 +23,6 @@
   "devDependencies": {
     "@types/node": "^24.10.12",
     "typescript": "^5.7.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulsemcp-cms-admin-mcp-server",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "description": "Local implementation of PulseMCP CMS Admin MCP server",
   "mcpName": "com.pulsemcp/pulsemcp-cms-admin",
   "main": "build/index.js",

package/shared/pulsemcp-admin-client/lib/create-secret.d.ts

@@ -0,0 +1,7 @@
+import type { Secret, CreateSecretParams } from '../../types.js';
+/**
+ * Create a secret. The secret's value stays in 1Password — this only records
+ * the `onepassword_item_id` reference plus metadata.
+ */
+export declare function createSecret(apiKey: string, baseUrl: string, params: CreateSecretParams): Promise<Secret>;
+//# sourceMappingURL=create-secret.d.ts.map

package/shared/pulsemcp-admin-client/lib/create-secret.js

@@ -0,0 +1,41 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Create a secret. The secret's value stays in 1Password — this only records
+ * the `onepassword_item_id` reference plus metadata.
+ */
+export async function createSecret(apiKey, baseUrl, params) {
+    const url = new URL('/api/secrets', baseUrl);
+    const body = {
+        slug: params.slug,
+        onepassword_item_id: params.onepassword_item_id,
+    };
+    if (params.title !== undefined) {
+        body.title = params.title;
+    }
+    if (params.description !== undefined) {
+        body.description = params.description;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to create secret: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/lib/get-secret.d.ts

@@ -0,0 +1,7 @@
+import type { Secret } from '../../types.js';
+/**
+ * Fetch a secret by id or slug. Returns null when the secret does not exist
+ * (HTTP 404) so callers can branch on create-vs-reuse without catching errors.
+ */
+export declare function getSecret(apiKey: string, baseUrl: string, idOrSlug: string | number): Promise<Secret | null>;
+//# sourceMappingURL=get-secret.d.ts.map

package/shared/pulsemcp-admin-client/lib/get-secret.js

@@ -0,0 +1,28 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Fetch a secret by id or slug. Returns null when the secret does not exist
+ * (HTTP 404) so callers can branch on create-vs-reuse without catching errors.
+ */
+export async function getSecret(apiKey, baseUrl, idOrSlug) {
+    const url = new URL(`/api/secrets/${encodeURIComponent(String(idOrSlug))}`, baseUrl);
+    const response = await adminFetch(url.toString(), {
+        method: 'GET',
+        headers: {
+            'X-API-Key': apiKey,
+            Accept: 'application/json',
+        },
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            return null;
+        }
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks admin privileges');
+        }
+        throw new Error(`Failed to fetch secret: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/lib/link-secret-to-server.d.ts

@@ -0,0 +1,12 @@
+import type { LinkSecretToServerParams, SecretWithLink } from '../../types.js';
+/**
+ * Link an MCP server to a secret by writing the mcp_servers_secrets join row.
+ * This join is what Proctor reads to inject the secret value at runtime, so it
+ * is the operation that actually scopes a stored secret to a server.
+ *
+ * Idempotent on the backend: relinking an already-linked server returns the
+ * existing join (updating onepassword_tag when a new value is supplied) instead
+ * of erroring or duplicating.
+ */
+export declare function linkSecretToServer(apiKey: string, baseUrl: string, params: LinkSecretToServerParams): Promise<SecretWithLink>;
+//# sourceMappingURL=link-secret-to-server.d.ts.map

package/shared/pulsemcp-admin-client/lib/link-secret-to-server.js

@@ -0,0 +1,50 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Link an MCP server to a secret by writing the mcp_servers_secrets join row.
+ * This join is what Proctor reads to inject the secret value at runtime, so it
+ * is the operation that actually scopes a stored secret to a server.
+ *
+ * Idempotent on the backend: relinking an already-linked server returns the
+ * existing join (updating onepassword_tag when a new value is supplied) instead
+ * of erroring or duplicating.
+ */
+export async function linkSecretToServer(apiKey, baseUrl, params) {
+    const url = new URL(`/api/secrets/${encodeURIComponent(String(params.secret))}/servers`, baseUrl);
+    const body = {};
+    if (params.mcp_server_id !== undefined) {
+        body.mcp_server_id = params.mcp_server_id;
+    }
+    if (params.mcp_server_slug !== undefined) {
+        body.mcp_server_slug = params.mcp_server_slug;
+    }
+    if (params.onepassword_tag !== undefined) {
+        body.onepassword_tag = params.onepassword_tag;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            const errorData = (await response.json().catch(() => ({})));
+            throw new Error(errorData.error || 'Secret or MCP server not found');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to link secret to server: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.d.ts

@@ -1,5 +1,5 @@
 import type { IPulseMCPAdminClient } from '../server.js';
-import type { Post, ImageUploadResponse, Author, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, Provider, ProvidersResponse, OfficialMirrorQueueItem, OfficialMirrorQueueItemDetail, OfficialMirrorQueueResponse, OfficialMirrorQueueActionResponse } from '../types.js';
+import type { Post, ImageUploadResponse, Author, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, Provider, ProvidersResponse, OfficialMirrorQueueItem, OfficialMirrorQueueItemDetail, OfficialMirrorQueueResponse, OfficialMirrorQueueActionResponse, Secret, SecretWithLink } from '../types.js';
 interface MockData {
     posts?: Post[];
     postsBySlug?: Record<string, Post>;
@@ -19,6 +19,9 @@ interface MockData {
     officialMirrorQueueItemsResponse?: OfficialMirrorQueueResponse;
     officialMirrorQueueItemDetail?: OfficialMirrorQueueItemDetail;
     officialMirrorQueueActionResponse?: OfficialMirrorQueueActionResponse;
+    secretsBySlug?: Record<string, Secret>;
+    createSecretResponse?: Secret;
+    linkSecretToServerResponse?: SecretWithLink;
     errors?: {
         getPosts?: Error;
         getPost?: Error;
@@ -42,6 +45,9 @@ interface MockData {
         rejectOfficialMirrorQueueItem?: Error;
         addOfficialMirrorToRegularQueue?: Error;
         unlinkOfficialMirrorQueueItem?: Error;
+        getSecret?: Error;
+        createSecret?: Error;
+        linkSecretToServer?: Error;
     };
 }
 export declare function createMockPulseMCPAdminClient(mockData: MockData): IPulseMCPAdminClient;

package/shared/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.js

@@ -1105,5 +1105,58 @@ export function createMockPulseMCPAdminClient(mockData) {
                 classification,
             };
         },
+        // Secret REST API methods
+        async getSecret(idOrSlug) {
+            if (mockData.errors?.getSecret) {
+                throw mockData.errors.getSecret;
+            }
+            const key = String(idOrSlug);
+            return mockData.secretsBySlug?.[key] ?? null;
+        },
+        async createSecret(params) {
+            if (mockData.errors?.createSecret) {
+                throw mockData.errors.createSecret;
+            }
+            if (mockData.createSecretResponse) {
+                return mockData.createSecretResponse;
+            }
+            return {
+                id: 1,
+                slug: params.slug,
+                onepassword_item_id: params.onepassword_item_id,
+                title: params.title ?? null,
+                description: params.description ?? null,
+                mcp_servers_count: 0,
+                mcp_server_slugs: [],
+                created_at: new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+            };
+        },
+        async linkSecretToServer(params) {
+            if (mockData.errors?.linkSecretToServer) {
+                throw mockData.errors.linkSecretToServer;
+            }
+            if (mockData.linkSecretToServerResponse) {
+                return mockData.linkSecretToServerResponse;
+            }
+            const slug = typeof params.secret === 'string' ? params.secret : `secret-${params.secret}`;
+            const serverSlug = params.mcp_server_slug ?? 'mock-server';
+            return {
+                id: 1,
+                slug,
+                onepassword_item_id: 'op://Vault/Item/credential',
+                title: null,
+                description: null,
+                mcp_servers_count: 1,
+                mcp_server_slugs: [serverSlug],
+                created_at: new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+                link: {
+                    mcp_server_id: params.mcp_server_id ?? 1,
+                    mcp_server_slug: serverSlug,
+                    onepassword_tag: params.onepassword_tag ?? null,
+                },
+            };
+        },
     };
 }

package/shared/server.d.ts

@@ -1,5 +1,5 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import type { Post, PostsResponse, CreatePostParams, UpdatePostParams, ImageUploadResponse, Author, AuthorsResponse, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, SaveMCPImplementationParams, CreateMCPImplementationParams, Provider, ProvidersResponse, OfficialMirrorQueueStatus, OfficialMirrorQueueResponse, OfficialMirrorQueueItemDetail, OfficialMirrorQueueActionResponse, UnofficialMirror, UnofficialMirrorsResponse, CreateUnofficialMirrorParams, UpdateUnofficialMirrorParams, OfficialMirrorRest, OfficialMirrorsResponse, Tenant, TenantsResponse, ListTenantServersResponse, BulkUpdateTenantServersParams, BulkUpdateTenantServersResponse, McpJson, McpJsonsResponse, CreateMcpJsonParams, UpdateMcpJsonParams, UnifiedMCPServer, UnifiedMCPServersResponse, UpdateUnifiedMCPServerParams, Redirect, RedirectsResponse, RedirectStatus, CreateRedirectParams, UpdateRedirectParams, GoodJob, GoodJobsResponse, GoodJobStatus, GoodJobCronSchedule, GoodJobProcess, GoodJobStatistics, GoodJobActionResponse, GoodJobCleanupResponse, PopularityDropBypassStatus, ProctorRunExamParams, ProctorRunExamResponse, ProctorSaveResultsParams, ProctorSaveResultsResponse, ProctorRunsResponse, GetProctorRunsParams, ProctorMetadataResponse, DiscoveredUrlsResponse, MarkDiscoveredUrlProcessedParams, MarkDiscoveredUrlProcessedResponse, DiscoveredUrlStats, MozMetricsResponse, MozBacklinksResponse, MozStoredMetricsResponse, CreateTenantParams, ApiKey, CreateApiKeyParams, DeleteTenantParams, DeleteTenantResponse, DeleteApiKeyResponse, RecacheMCPServerResponse, SetKnownMissingInitToolsListResponse, GithubRepositoryClassification, SetGithubRepositoryClassificationResponse } from './types.js';
+import type { Post, PostsResponse, CreatePostParams, UpdatePostParams, ImageUploadResponse, Author, AuthorsResponse, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, SaveMCPImplementationParams, CreateMCPImplementationParams, Provider, ProvidersResponse, OfficialMirrorQueueStatus, OfficialMirrorQueueResponse, OfficialMirrorQueueItemDetail, OfficialMirrorQueueActionResponse, UnofficialMirror, UnofficialMirrorsResponse, CreateUnofficialMirrorParams, UpdateUnofficialMirrorParams, OfficialMirrorRest, OfficialMirrorsResponse, Tenant, TenantsResponse, ListTenantServersResponse, BulkUpdateTenantServersParams, BulkUpdateTenantServersResponse, McpJson, McpJsonsResponse, CreateMcpJsonParams, UpdateMcpJsonParams, UnifiedMCPServer, UnifiedMCPServersResponse, UpdateUnifiedMCPServerParams, Redirect, RedirectsResponse, RedirectStatus, CreateRedirectParams, UpdateRedirectParams, Secret, CreateSecretParams, LinkSecretToServerParams, SecretWithLink, GoodJob, GoodJobsResponse, GoodJobStatus, GoodJobCronSchedule, GoodJobProcess, GoodJobStatistics, GoodJobActionResponse, GoodJobCleanupResponse, PopularityDropBypassStatus, ProctorRunExamParams, ProctorRunExamResponse, ProctorSaveResultsParams, ProctorSaveResultsResponse, ProctorRunsResponse, GetProctorRunsParams, ProctorMetadataResponse, DiscoveredUrlsResponse, MarkDiscoveredUrlProcessedParams, MarkDiscoveredUrlProcessedResponse, DiscoveredUrlStats, MozMetricsResponse, MozBacklinksResponse, MozStoredMetricsResponse, CreateTenantParams, ApiKey, CreateApiKeyParams, DeleteTenantParams, DeleteTenantResponse, DeleteApiKeyResponse, RecacheMCPServerResponse, SetKnownMissingInitToolsListResponse, GithubRepositoryClassification, SetGithubRepositoryClassificationResponse } from './types.js';
 export interface IPulseMCPAdminClient {
     getPosts(params?: {
         search?: string;
@@ -150,6 +150,9 @@ export interface IPulseMCPAdminClient {
         success: boolean;
         message: string;
     }>;
+    getSecret(idOrSlug: string | number): Promise<Secret | null>;
+    createSecret(params: CreateSecretParams): Promise<Secret>;
+    linkSecretToServer(params: LinkSecretToServerParams): Promise<SecretWithLink>;
     getGoodJobs(params?: {
         queue_name?: string;
         status?: GoodJobStatus;
@@ -352,6 +355,9 @@ export declare class PulseMCPAdminClient implements IPulseMCPAdminClient {
         success: boolean;
         message: string;
     }>;
+    getSecret(idOrSlug: string | number): Promise<Secret | null>;
+    createSecret(params: CreateSecretParams): Promise<Secret>;
+    linkSecretToServer(params: LinkSecretToServerParams): Promise<SecretWithLink>;
     getGoodJobs(params?: {
         queue_name?: string;
         status?: GoodJobStatus;

package/shared/server.js

@@ -51,6 +51,9 @@ import { getRedirect } from './pulsemcp-admin-client/lib/get-redirect.js';
 import { createRedirect } from './pulsemcp-admin-client/lib/create-redirect.js';
 import { updateRedirect } from './pulsemcp-admin-client/lib/update-redirect.js';
 import { deleteRedirect } from './pulsemcp-admin-client/lib/delete-redirect.js';
+import { getSecret } from './pulsemcp-admin-client/lib/get-secret.js';
+import { createSecret } from './pulsemcp-admin-client/lib/create-secret.js';
+import { linkSecretToServer } from './pulsemcp-admin-client/lib/link-secret-to-server.js';
 import { getGoodJobs } from './pulsemcp-admin-client/lib/get-good-jobs.js';
 import { getGoodJob } from './pulsemcp-admin-client/lib/get-good-job.js';
 import { getGoodJobCronSchedules } from './pulsemcp-admin-client/lib/get-good-job-cron-schedules.js';
@@ -270,6 +273,16 @@ export class PulseMCPAdminClient {
     async deleteRedirect(id) {
         return deleteRedirect(this.apiKey, this.baseUrl, id);
     }
+    // Secret REST API methods
+    async getSecret(idOrSlug) {
+        return getSecret(this.apiKey, this.baseUrl, idOrSlug);
+    }
+    async createSecret(params) {
+        return createSecret(this.apiKey, this.baseUrl, params);
+    }
+    async linkSecretToServer(params) {
+        return linkSecretToServer(this.apiKey, this.baseUrl, params);
+    }
     // GoodJob REST API methods
     async getGoodJobs(params) {
         return getGoodJobs(this.apiKey, this.baseUrl, params);

package/shared/tools/link-secret-to-mcp-server.d.ts

@@ -0,0 +1,50 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { ClientFactory } from '../server.js';
+export declare function linkSecretToMcpServer(_server: Server, clientFactory: ClientFactory): {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            slug: {
+                type: string;
+                description: "Unique slug identifier for the secret (lowercase, hyphenated, e.g. \"linear-api-key\"). Used to look up an existing secret or to create a new one.";
+            };
+            onepassword_item_id: {
+                type: string;
+                description: "The 1Password item reference the secret value lives in (e.g. \"op://Vault/Item/credential\"). The raw secret value is NEVER passed through this tool — only this reference. If a secret with this slug already exists, this must match its stored reference.";
+            };
+            mcp_server_slug: {
+                type: string;
+                description: "Slug of the MCP server to grant the secret to (e.g. \"linear\"). The link is what Proctor reads to inject the secret value when running that server.";
+            };
+            title: {
+                type: string;
+                description: "Optional human-readable title for the secret (only used when creating a new secret).";
+            };
+            description: {
+                type: string;
+                description: "Optional description of what the secret is for (only used when creating a new secret).";
+            };
+            onepassword_tag: {
+                type: string;
+                description: "Optional tag scoping which field of the 1Password item to inject for this server (e.g. \"production\"). Stored on the server↔secret link, so the same secret can inject different fields per server.";
+            };
+        };
+        required: string[];
+    };
+    handler: (args: unknown) => Promise<{
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError: boolean;
+    } | {
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError?: undefined;
+    }>;
+};
+//# sourceMappingURL=link-secret-to-mcp-server.d.ts.map

package/shared/tools/link-secret-to-mcp-server.js

@@ -0,0 +1,140 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    slug: 'Unique slug identifier for the secret (lowercase, hyphenated, e.g. "linear-api-key"). Used to look up an existing secret or to create a new one.',
+    onepassword_item_id: 'The 1Password item reference the secret value lives in (e.g. "op://Vault/Item/credential"). The raw secret value is NEVER passed through this tool — only this reference. If a secret with this slug already exists, this must match its stored reference.',
+    mcp_server_slug: 'Slug of the MCP server to grant the secret to (e.g. "linear"). The link is what Proctor reads to inject the secret value when running that server.',
+    title: 'Optional human-readable title for the secret (only used when creating a new secret).',
+    description: 'Optional description of what the secret is for (only used when creating a new secret).',
+    onepassword_tag: 'Optional tag scoping which field of the 1Password item to inject for this server (e.g. "production"). Stored on the server↔secret link, so the same secret can inject different fields per server.',
+};
+const LinkSecretToMcpServerSchema = z.object({
+    slug: z.string().describe(PARAM_DESCRIPTIONS.slug),
+    onepassword_item_id: z.string().describe(PARAM_DESCRIPTIONS.onepassword_item_id),
+    mcp_server_slug: z.string().describe(PARAM_DESCRIPTIONS.mcp_server_slug),
+    title: z.string().optional().describe(PARAM_DESCRIPTIONS.title),
+    description: z.string().optional().describe(PARAM_DESCRIPTIONS.description),
+    onepassword_tag: z.string().optional().describe(PARAM_DESCRIPTIONS.onepassword_tag),
+});
+export function linkSecretToMcpServer(_server, clientFactory) {
+    return {
+        name: 'link_secret_to_mcp_server',
+        description: `Make an auth secret available to an MCP server. This upserts a Secret (by slug) that references a 1Password item, then writes the server↔secret link that Proctor reads to inject the secret value at runtime.
+
+The raw secret value stays in 1Password — this tool only deals in the 1Password item reference ("onepassword_item_id") and slug, never a credential value.
+
+Behavior:
+- If no secret with "slug" exists, it is created from "onepassword_item_id" (plus optional title/description).
+- If a secret with "slug" already exists, it is reused. Its stored "onepassword_item_id" must match the one you pass, otherwise the tool errors instead of silently rebinding a shared secret.
+- The link is idempotent: re-running for an already-linked server updates the "onepassword_tag" (when provided) without creating a duplicate.
+
+Example request:
+{
+  "slug": "linear-api-key",
+  "onepassword_item_id": "op://Shared/Linear API Key/credential",
+  "mcp_server_slug": "linear",
+  "onepassword_tag": "production"
+}
+
+Use cases:
+- Onboarding an auth-gated MCP server: register its credential reference and scope it to the server so Proctor can run it.
+- Granting an already-registered secret to an additional server.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                slug: { type: 'string', description: PARAM_DESCRIPTIONS.slug },
+                onepassword_item_id: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.onepassword_item_id,
+                },
+                mcp_server_slug: { type: 'string', description: PARAM_DESCRIPTIONS.mcp_server_slug },
+                title: { type: 'string', description: PARAM_DESCRIPTIONS.title },
+                description: { type: 'string', description: PARAM_DESCRIPTIONS.description },
+                onepassword_tag: { type: 'string', description: PARAM_DESCRIPTIONS.onepassword_tag },
+            },
+            required: ['slug', 'onepassword_item_id', 'mcp_server_slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = LinkSecretToMcpServerSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const existing = await client.getSecret(validatedArgs.slug);
+                if (existing && existing.onepassword_item_id !== validatedArgs.onepassword_item_id) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Error: a secret with slug "${validatedArgs.slug}" already exists but references a different 1Password item ` +
+                                    `("${existing.onepassword_item_id}", not "${validatedArgs.onepassword_item_id}"). ` +
+                                    `Refusing to rebind it, since other servers may depend on it. ` +
+                                    `Use a different slug, or update the existing secret explicitly if the reference really changed.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                let created = false;
+                if (!existing) {
+                    try {
+                        await client.createSecret({
+                            slug: validatedArgs.slug,
+                            onepassword_item_id: validatedArgs.onepassword_item_id,
+                            title: validatedArgs.title,
+                            description: validatedArgs.description,
+                        });
+                    }
+                    catch (createError) {
+                        // The backend also enforces uniqueness on onepassword_item_id, so the
+                        // item may already be registered under a *different* slug than the one
+                        // requested. getSecret(slug) can't surface that (it looks up by slug),
+                        // so translate the opaque uniqueness 422 into actionable guidance
+                        // instead of letting the raw validation message reach the agent.
+                        const message = createError instanceof Error ? createError.message : String(createError);
+                        if (/onepassword item/i.test(message) && /taken/i.test(message)) {
+                            return {
+                                content: [
+                                    {
+                                        type: 'text',
+                                        text: `Error: the 1Password item "${validatedArgs.onepassword_item_id}" is already registered under a different secret slug, ` +
+                                            `so it cannot be created again as "${validatedArgs.slug}". ` +
+                                            `To link it to "${validatedArgs.mcp_server_slug}", re-run this tool with the existing secret's slug ` +
+                                            `(find it via the secrets list), or register a different 1Password item under "${validatedArgs.slug}".`,
+                                    },
+                                ],
+                                isError: true,
+                            };
+                        }
+                        throw createError;
+                    }
+                    created = true;
+                }
+                const result = await client.linkSecretToServer({
+                    secret: validatedArgs.slug,
+                    mcp_server_slug: validatedArgs.mcp_server_slug,
+                    onepassword_tag: validatedArgs.onepassword_tag,
+                });
+                let content = `Successfully linked secret "${result.slug}" to MCP server "${result.link.mcp_server_slug}".\n\n`;
+                content += `**Secret:** ${result.slug} (id ${result.id}) — ${created ? 'created' : 'reused existing'}\n`;
+                content += `**1Password item:** ${result.onepassword_item_id}\n`;
+                content += `**Linked server:** ${result.link.mcp_server_slug} (id ${result.link.mcp_server_id})\n`;
+                if (result.link.onepassword_tag) {
+                    content += `**1Password tag:** ${result.link.onepassword_tag}\n`;
+                }
+                if (result.mcp_server_slugs && result.mcp_server_slugs.length > 0) {
+                    content += `**All servers using this secret:** ${result.mcp_server_slugs.join(', ')}\n`;
+                }
+                return { content: [{ type: 'text', text: content }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error linking secret to MCP server: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/shared/tools.d.ts

@@ -23,13 +23,14 @@ import { ClientFactory } from './server.js';
  * - mcp_jsons / mcp_jsons_readonly: MCP JSON configuration tools
  * - mcp_servers / mcp_servers_readonly: Unified MCP server tools (abstracted interface)
  * - redirects / redirects_readonly: URL redirect management tools
+ * - secrets: Auth-secret tools (link_secret_to_mcp_server). Upserts a Secret referencing a 1Password item and writes the mcp_servers_secrets join Proctor reads to inject the value. Write-only, so there is no _readonly variant.
  * - good_jobs / good_jobs_readonly: GoodJob background job management tools
  * - proctor / proctor_readonly: Proctor exam execution and result storage tools. The readonly variant includes get_exam_result, list_proctor_runs, and get_proctor_metadata for retrieving stored results and metadata without running exams or saving
  * - discovered_urls / discovered_urls_readonly: Discovered URL management tools for processing URLs into MCP implementations
  * - moz / moz_readonly: MOZ SEO metrics tools (live URL metrics, backlinks, stored historical data)
  * - notifications: Notification email tools (send_impl_posted_notif). Separated from server_directory so notification capability can be granted independently.
  */
-export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_directory' | 'server_directory_readonly' | 'official_queue' | 'official_queue_readonly' | 'unofficial_mirrors' | 'unofficial_mirrors_readonly' | 'official_mirrors' | 'official_mirrors_readonly' | 'tenants' | 'tenants_readonly' | 'tenants_destructive' | 'mcp_jsons' | 'mcp_jsons_readonly' | 'mcp_servers' | 'mcp_servers_readonly' | 'redirects' | 'redirects_readonly' | 'good_jobs' | 'good_jobs_readonly' | 'proctor' | 'proctor_readonly' | 'discovered_urls' | 'discovered_urls_readonly' | 'moz' | 'moz_readonly' | 'notifications';
+export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_directory' | 'server_directory_readonly' | 'official_queue' | 'official_queue_readonly' | 'unofficial_mirrors' | 'unofficial_mirrors_readonly' | 'official_mirrors' | 'official_mirrors_readonly' | 'tenants' | 'tenants_readonly' | 'tenants_destructive' | 'mcp_jsons' | 'mcp_jsons_readonly' | 'mcp_servers' | 'mcp_servers_readonly' | 'redirects' | 'redirects_readonly' | 'secrets' | 'good_jobs' | 'good_jobs_readonly' | 'proctor' | 'proctor_readonly' | 'discovered_urls' | 'discovered_urls_readonly' | 'moz' | 'moz_readonly' | 'notifications';
 /**
  * Parse enabled tool groups from environment variable or parameter
  * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_directory_readonly")

package/shared/tools.js

@@ -55,6 +55,8 @@ import { getRedirect } from './tools/get-redirect.js';
 import { createRedirect } from './tools/create-redirect.js';
 import { updateRedirect } from './tools/update-redirect.js';
 import { deleteRedirect } from './tools/delete-redirect.js';
+// Secret tools
+import { linkSecretToMcpServer } from './tools/link-secret-to-mcp-server.js';
 // GoodJob tools
 import { listGoodJobs } from './tools/list-good-jobs.js';
 import { getGoodJob } from './tools/get-good-job.js';
@@ -254,6 +256,8 @@ const ALL_TOOLS = [
     { factory: createRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: updateRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: deleteRedirect, groups: ['redirects'], isWriteOperation: true },
+    // Secret tools (write-only: upsert a secret + write the mcp_servers_secrets join Proctor reads)
+    { factory: linkSecretToMcpServer, groups: ['secrets'], isWriteOperation: true },
     // GoodJob tools
     { factory: listGoodJobs, groups: ['good_jobs'], isWriteOperation: false },
     { factory: getGoodJob, groups: ['good_jobs'], isWriteOperation: false },
@@ -328,6 +332,7 @@ const VALID_TOOL_GROUPS = [
     'mcp_servers_readonly',
     'redirects',
     'redirects_readonly',
+    'secrets',
     'good_jobs',
     'good_jobs_readonly',
     'proctor',
@@ -351,6 +356,7 @@ const BASE_TOOL_GROUPS = [
     'mcp_jsons',
     'mcp_servers',
     'redirects',
+    'secrets',
     'good_jobs',
     'proctor',
     'discovered_urls',

package/shared/types.d.ts

@@ -676,6 +676,37 @@ export interface UpdateRedirectParams {
     to?: string;
     status?: RedirectStatus;
 }
+export interface Secret {
+    id: number;
+    slug: string;
+    onepassword_item_id: string;
+    title?: string | null;
+    description?: string | null;
+    mcp_servers_count?: number;
+    mcp_server_slugs?: string[];
+    created_at?: string;
+    updated_at?: string;
+}
+export interface CreateSecretParams {
+    slug: string;
+    onepassword_item_id: string;
+    title?: string;
+    description?: string;
+}
+export interface SecretServerLink {
+    mcp_server_id: number;
+    mcp_server_slug: string;
+    onepassword_tag?: string | null;
+}
+export interface LinkSecretToServerParams {
+    secret: string | number;
+    mcp_server_id?: number;
+    mcp_server_slug?: string;
+    onepassword_tag?: string;
+}
+export interface SecretWithLink extends Secret {
+    link: SecretServerLink;
+}
 export type GoodJobStatus = 'scheduled' | 'queued' | 'running' | 'succeeded' | 'failed' | 'discarded';
 export interface GoodJob {
     id: string;