{"$schema":"https://json-schema.org/draft/2020-12/schema","name":"agentsecrets","version":"0.3.0","description":"Fast, AES-256-GCM encrypted secrets, credentials, passwords, and state manager for autonomous AI agents and humans.","homepage":"https://agentsecrets.net","license":"MIT","pricing":{"model":"free","cost":"$0","free_forever":true,"signup_fee":false,"credit_card_required":false,"trial_period":false,"paid_tier":false,"ads":false,"sells_data":false,"fair_use_quotas":{"max_active_secrets_per_user":100,"max_payload_bytes":1048576,"requests_per_minute":60,"note":"Anti-abuse limits, not billing limits. No payment is ever required to use the service."},"funded_by":"voluntary community donations"},"author":{"name":"AgentSecrets Team","email":"id41864819@gmail.com"},"categories":["security","secrets","vault","credentials","state-management","mcp","autonomous-agents"],"keywords":["mcp","secrets","vault","credentials","ai-agents","autonomous-agents","agent-state","aes-256-gcm","burn-after-read","ttl","api-keys","secret-management"],"requires":{"bins":["curl"]},"triggers":["store secret","get secret","retrieve secret","agent vault","api keys","credentials","agent secrets","export env","burn secret","rotate token","agent context","mcp sse","zero-config vault","delegate access"],"files":{"skill":"/skill.md","rules":"/rules.md","heartbeat":"/heartbeat.md","manifest":"/skill.json","llms":"/llms.txt","llms_full":"/llms-full.txt","openapi":"/openapi.json"},"authentication":{"type":"bearer","header":"Authorization","prefix":"Bearer ","registration_url":"/v1/auth/register","token_prefix":"as_live_"},"endpoints":{"base_url":"https://agentsecrets.net","skill_md":"https://agentsecrets.net/skill.md","agent_context":"https://agentsecrets.net/v1/agent/context","service_info":"https://agentsecrets.net/v1/info","front_server_stats":"https://agentsecrets.net/v1/system/front-server-stats","handoff_api":"https://agentsecrets.net/v1/handoff","handoff_accept":"https://agentsecrets.net/v1/handoff/accept","handoff_record_delete":"https://agentsecrets.net/v1/handoff/{grant_id}/record","dashboard":"https://agentsecrets.net/dashboard/","docs_url":"https://agentsecrets.net/docs","llms_txt":"https://agentsecrets.net/llms.txt","llms_full_txt":"https://agentsecrets.net/llms-full.txt","openapi_json":"https://agentsecrets.net/openapi.json","mcp_sse":"https://agentsecrets.net/mcp/sse","mcp_server_card":"https://agentsecrets.net/.well-known/mcp/server-card.json"},"tools":[{"name":"get_secret","description":"Retrieve and decrypt a secret value by key from the vault. Note: a burn-after-read secret is destroyed by this call.","parameters":{"type":"object","properties":{"key":{"type":"string","description":"The exact key name to fetch."}},"required":["key"]}},{"name":"set_secret","description":"Encrypt and store a secret value (text or JSON) in the vault with optional TTL and burn-after-reading.","parameters":{"type":"object","properties":{"key":{"type":"string","description":"Unique key identifier (e.g. 'stripe_key', 'prod/db_pass')."},"value":{"type":["string","object","array","number","boolean"],"description":"Secret payload to encrypt and store."},"ttl_seconds":{"type":"integer","description":"Optional Time-To-Live in seconds."},"burn_after_read":{"type":"boolean","description":"If true, permanently delete secret immediately after first retrieval."}},"required":["key","value"]}},{"name":"list_secrets","description":"List all active secret keys and their metadata (expiration, burn status) without decrypting values.","parameters":{"type":"object","properties":{}}},{"name":"delete_secret","description":"Permanently delete a secret from the vault.","parameters":{"type":"object","properties":{"key":{"type":"string","description":"The key name to delete."}},"required":["key"]}},{"name":"get_my_credentials","description":"Retrieve this autonomous vault's credentials (token, agent_id, is_claimed, is_activated, instructions) so you can persist the token locally and reconnect across restarts. To hand this vault to a human operator in a browser, mint a single-use code with create_handoff; to let a sub-agent read it, delegate a time-bounded token with mint_scoped_token. Never share this principal token itself.","parameters":{"type":"object","properties":{}}},{"name":"get_agent_context","description":"One-call inspection of current agent session state: identity, token scope, quota, expiring keys, and prioritized next actions. Key-derived fields (recent_keys, expiring_soon, secrets_count, quota_remaining) are confined to the calling token's prefix: scope.","parameters":{"type":"object","properties":{}}},{"name":"get_secret_raw","description":"Retrieve the raw plaintext string value of a secret (returns text/plain, safe for shell variable assignment).","parameters":{"type":"object","properties":{"key":{"type":"string","description":"The key name to fetch as raw text."}},"required":["key"]}},{"name":"rollback_secret","description":"Revert a secret to its previous version snapshot if accidentally updated or corrupted.","parameters":{"type":"object","properties":{"key":{"type":"string","description":"The key name to rollback."},"target_version":{"type":"integer","description":"Optional specific version number to restore."}},"required":["key"]}},{"name":"export_secrets_shell","description":"Export all secrets in an environment as shell 'export VAR=VAL' statements.","parameters":{"type":"object","properties":{"environment":{"type":"string","description":"Optional environment filter."}}}},{"name":"set_profile_notes","description":"Save encrypted notes or scratchpad instructions for the authenticated user/agent. Notes are per account, not per key: a write-capable scope is required, and read_only or prefix:ro: tokens are refused with 403.","parameters":{"type":"object","properties":{"notes":{"type":"string","description":"Text notes or structured Markdown instructions."}}}},{"name":"create_handoff","description":"Mint a single-use handoff code (hs_...) that another entity, typically a human operator, redeems once to operate on this vault. The code expires in 10 minutes by default and is not a credential; redeeming it (POST /v1/handoff/accept) mints a delegated token for the grantor's vault with the chosen scope and ttl_seconds.","parameters":{"type":"object","properties":{"name":{"type":"string","description":"Optional label for this handoff; reused as the name of the token it mints."},"scope":{"type":"string","description":"Scope of the token the acceptor receives: 'full', 'read_only' (default), 'prefix:<str>', or 'prefix:ro:<str>'."},"ttl_seconds":{"type":"integer","description":"Lifetime of the token minted when the code is accepted, in seconds. Defaults to 86400 (24 hours). Clamped to 60..2592000 (30 days)."},"code_ttl_seconds":{"type":"integer","description":"How long the code itself stays redeemable, in seconds. Defaults to 600 (10 minutes), clamped to 60..2592000. Raise it only when the recipient cannot read the message within the default window, for example a code sent by e-mail."}}}},{"name":"get_profile_notes","description":"Retrieve AES-256-GCM encrypted notes stored for the authenticated user/agent.","parameters":{"type":"object","properties":{}}},{"name":"mint_scoped_token","description":"Delegate time-bounded access to a sub-agent, worker or human operator. The token is always narrower than the caller's own and always expires. Each minted token records parent_token_id provenance; revoking the parent token does not cascade to tokens already minted.","parameters":{"type":"object","properties":{"name":{"type":"string","description":"Optional descriptive token name."},"scope":{"type":"string","description":"Scope restriction: 'full', 'read_only' (default), 'prefix:<str>', or 'prefix:ro:<str>'."},"ttl_seconds":{"type":"integer","description":"Required lifetime of the delegated access in seconds. Clamped to 60..2592000 (30 days)."}},"required":["ttl_seconds"]}},{"name":"register_agent","description":"Instantly register an autonomous agent account to obtain a persistent Bearer API token without verification barriers.","parameters":{"type":"object","properties":{"username":{"type":"string","description":"Unique bot name or agent GUID."},"password":{"type":"string","description":"Password for account authentication."}},"required":["username","password"]}},{"name":"recover_account","description":"Recover access to an account and reset password using the 12-word BIP-39 mnemonic seed phrase.","parameters":{"type":"object","properties":{"username":{"type":"string","description":"Registered agent username."},"recovery_phrase":{"type":"string","description":"The 12-word recovery phrase provided at registration."},"new_password":{"type":"string","description":"New secure password for the account."}},"required":["username","recovery_phrase","new_password"]}}]}