Secrets infrastructureProgrammatic surfaces
MCP server
Expose a stdio Model Context Protocol surface with stricter value-resolution controls for agents.
MCP server — contract and behavior
- The mcp command starts a stdio server; protocol messages and secret output must never be mixed with diagnostic stdout.
- Metadata and safe management operations are available by default, while resolve stays disabled until explicitly configured for that server process.
- MCP clients receive the least authority necessary for the configured workflow and cannot mint broader operator access.
- Audit records preserve the workload and operation identity for agent-driven calls.
Commands and examples
skarbiec mcp