analyze_secrets
Usage profile: most-accessed, stale, never-accessed, no-rotation candidates
How to use it
analyze_secrets is exposed by the Q Ring MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the analyze_secrets tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Q Ring
docker run --rm -p 8080:8080 qring-mcpOther tools in Q Ring (39)
Permanently delete a key from agent memory
Read a memory value, or list every stored key when no key is supplied
Persist a non-secret note in encrypted agent memory across sessions
Multi-project health pass with optional autoRotate for expired secrets
Query the tamper-evident audit log filtered by key, action, and limit
Compare .q-ring.json manifest against the keyring for missing/expired/stale keys
Permanently remove a secret value (not undoable from q-ring)
Surface burst-read and off-hours findings from audit history
Resolve which env slug should drive superposition collapse for the current context
Break the sync link between two keys (does not delete values)
Link two keys so future writes/rotations propagate the same value
Render a complete .env body from the project manifest, with warnings for gaps
Run a child command with secrets injected as env vars and any leaked values redacted from output
Export audit events as jsonl, json, or csv for archival/SIEM
Render multiple secrets as .env or JSON for one-off export (skips approval-protected keys without a grant)
Generate a CSPRNG-backed value in a chosen format and optionally store it
Single redacted snapshot of secrets, env, manifest, hooks, and recent audit activity
Read a secret value (collapses superposition, audits the read)
Boolean existence check that respects decay (no audit read)
Read-only scope sweep: decay/stale/expired counts plus current anomalies
Parse .env text and bulk-store every key/value pair (accepts raw content only — never reads files)
Show metadata for one key (states, decay, entanglement, access count) without revealing the value
Inspect a specific file list for hardcoded secrets with optional auto-fix to process.env.KEY
Show every registered hook with match criteria, type, and enabled flag
Enumerate built-in validation providers and their auto-detect prefixes
List keys + metadata in scope (values never exposed); filter by tag, expiry, glob
Register a shell/HTTP/signal side-effect that fires on write/delete/rotate
Detach a single hook by ID without touching any secrets
Walk a directory tree and flag hardcoded secrets via regex + entropy heuristics
Create or overwrite a single secret with optional TTL, per-env state, tags, rotation format
Start a local SSE dashboard with live KPIs, secrets, hooks, and audit feed (returns a token-gated 127.0.0.1 URL)
Encrypt selected secrets into a passphrase-protected AES-256-GCM bundle
Decrypt a teleport bundle and import each secret (with optional dry-run)
Stash a value in process memory and return an opaque ID (never touches disk)
Immediately remove a tunnel from memory before its TTL/reads run out
Enumerate active tunnels with remaining read budget and TTL (IDs only)
Fetch a tunneled value by ID — may self-destruct on read
Hit the upstream service (OpenAI/Stripe/GitHub/AWS/HTTP) to confirm a single key is still live
Recompute the audit hash chain and report the first break point if tampered