vault_list_secrets

vault_list_secrets returns the names, versions, and timestamps of all secrets in the active app. It never returns values.

Parameters

Parameter	Type	Required	Description
`filter`	string	No	Return only secrets whose name contains this substring

Response

{
  "secrets": [
    {
      "name": "DATABASE_URL",
      "version": 1,
      "created_at": "2026-04-01T09:00:00Z",
      "updated_at": "2026-04-09T14:32:00Z"
    },
    {
      "name": "OPENAI_API_KEY",
      "version": 1,
      "created_at": "2026-04-01T09:00:00Z",
      "updated_at": "2026-04-01T09:00:00Z"
    }
  ]
}

Field	Description
`secrets`	Array of secret metadata objects
`secrets[].name`	Secret name
`secrets[].version`	Incremented each time the secret is updated
`secrets[].created_at`	When the secret was first created
`secrets[].updated_at`	When the secret was last updated

Values are never included. The active app is set via ov app use or the --app flag when starting ov mcp serve.

Typical usage

Claude calls vault_list_secrets before vault_run to verify that the required secrets exist before attempting to run a command:

“Let me check what secrets are available before running the migrations.” → calls vault_list_secrets → sees DATABASE_URL is present → calls vault_run