Secrets

Write-only workspace secrets referenced from tools and workflows. 3 tools.

`trillet_list_secrets`

List workspace secrets

List workspace secrets (names and field names only; values are always masked and can never be read back). Reference syntax: {{_secret.<name>}} reads the api_key field, {{_secret.<name>.<field>}} reads a specific field. Code steps read them as secrets.<name>.<field>.

Flags: read-only structured output

Parameters

Name	Type	Required	Description
`workspace_id`	string	no	Run this call in another workspace: its id or its name (see trillet_list_workspaces). Omit to use the default (TRILLET_WORKSPACE_ID, the workspace picked when the connector was approved, or the one set with trillet_switch_workspace).

Structured output

Returned as structuredContent (fields are optional; the same data is in the text result, where it is a bare array):

Field	Type	Description
`secrets`	any[]

`trillet_set_secret`

Create or update workspace secret

Create a workspace secret or merge fields into an existing one (upsert). Name must be slug-safe lowercase (letters, numbers, hyphen, underscore); field keys alphanumeric/underscore; values non-empty strings, encrypted at rest. Store third-party API keys here instead of pasting them into tool headers, then reference {{_secret.<name>}} in in-call API tool headers/urls.

Flags: writes destructive idempotent

Parameters

Name	Type	Required	Description
`name`	string	yes	Slug-safe, e.g. "airtable" or "stripe-test"
`values`	object (map)	yes	Fields, e.g. {"api_key": "...", "base_url": "..."}. api_key is the default field.
`description`	string	no
`workspace_id`	string	no	Run this call in another workspace: its id or its name (see trillet_list_workspaces). Omit to use the default (TRILLET_WORKSPACE_ID, the workspace picked when the connector was approved, or the one set with trillet_switch_workspace).

`trillet_delete_secret`

Delete workspace secret

Delete a workspace secret by name. Any {{_secret.<name>}} references in tools or workflows will resolve to empty strings afterwards.

Flags: writes destructive asks for confirmation

Clients that support MCP elicitation show a confirmation form before this tool runs; declining cancels it with no changes. Other clients rely on their own approval prompt.

Parameters

Name	Type	Required	Description
`name`	string	yes
`workspace_id`	string	no	Run this call in another workspace: its id or its name (see trillet_list_workspaces). Omit to use the default (TRILLET_WORKSPACE_ID, the workspace picked when the connector was approved, or the one set with trillet_switch_workspace).