Skip to content

agentstack secrets

Synopsis

agentstack secrets <subcommand> [options]

Description

The secrets command manages secret values such as API keys and tokens outside the canonical profile.

In the current model, your profile stores references such as MCP env_refs, while the secret values live in the local secrets store.

Subcommands

Subcommand	Description
`set <name> <value>`	Store a secret value
`get <name>`	Retrieve a secret value
`delete <name>`	Remove a secret
`list`	List stored secret names (never values)

Options

Flag	Type	Default	Description
`--backend <backend>`	`file\|darwin-keychain`	platform-dependent	Storage backend

Examples

agentstack secrets set GITHUB_TOKEN ghp_xxxxxxxxxxxx
agentstack secrets set OPENAI_API_KEY sk-xxxxxxxxxxxx

agentstack secrets list

agentstack secrets get GITHUB_TOKEN

agentstack secrets delete OLD_API_KEY

agentstack secrets set GITHUB_TOKEN ghp_xxx --backend darwin-keychain

Referencing secrets from the current schema

In the current v3 manifest, MCP entries reference required environment variable names via env_refs:

profile:
  mcp_servers:
    - id: github
      transport: stdio
      command: npx
      args:
        - -y
        - '@modelcontextprotocol/server-github'
      env_refs:
        - GITHUB_TOKEN
      enabled: true

Notes