vault_list_secrets

vault_list_secrets returns the names, versions, and timestamps of secrets in the resolved (app, env) context — the same per-call resolution vault_run uses. It never returns values.

Listing is scoped to the resolved environment: secrets written under a different env in the same app do not appear. Scoping is computed client-side by the bridge — it recomputes each secret’s name-HMAC under the resolved env and classifies the row locally; the underlying server API still has no env filter and receives no env parameter, so it learns nothing new about which secrets belong to which environment.

Two legacy populations behave differently — do not assume one rule covers both:

Legacy secrets from before per-app/per-env namespacing (encrypted name, no env binding) are visible only when the bridge is running in its startup-validated (app, env) context — not when a call declares a different env via expected_app/expected_env.
Ancient secrets from before name encryption existed (no encrypted name at all) never appear in vault_list_secrets, in any environment. Use the CLI (ov secret list) to see these — it is unaffected by this scoping and remains app-wide.

Parameters

Parameter	Type	Required	Description
`filter`	string	No	Return only secrets whose name contains this substring

Response

{
  "secrets": [
    {
      "name": "DATABASE_URL",
      "version": 1,
      "created_at": "2026-04-01T09:00:00Z",
      "updated_at": "2026-04-09T14:32:00Z"
    },
    {
      "name": "OPENAI_API_KEY",
      "version": 1,
      "created_at": "2026-04-01T09:00:00Z",
      "updated_at": "2026-04-01T09:00:00Z"
    }
  ]
}

Field	Description
`secrets`	Array of secret metadata objects
`secrets[].name`	Secret name
`secrets[].version`	Incremented each time the secret is updated
`secrets[].created_at`	When the secret was first created
`secrets[].updated_at`	When the secret was last updated

Values are never included. The active (app, env) is resolved per call, primarily from the project’s .ov.yaml, falling back to ov app use / the --app and --env flags passed to ov mcp serve as defaults.

Typical usage

Claude calls vault_list_secrets before vault_run to verify that the required secrets exist before attempting to run a command:

“Let me check what secrets are available before running the migrations.” → calls vault_list_secrets → sees DATABASE_URL is present → calls vault_run