entangle_secrets
Link two keys so future writes/rotations propagate the same value
How to use it
entangle_secrets is exposed by the Q Ring MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the entangle_secrets tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Q Ring
docker run --rm -p 8080:8080 qring-mcpOther tools in Q Ring (39)
Permanently delete a key from agent memory
Read a memory value, or list every stored key when no key is supplied
Persist a non-secret note in encrypted agent memory across sessions
Multi-project health pass with optional autoRotate for expired secrets
Usage profile: most-accessed, stale, never-accessed, no-rotation candidates
Query the tamper-evident audit log filtered by key, action, and limit
Compare .q-ring.json manifest against the keyring for missing/expired/stale keys
Permanently remove a secret value (not undoable from q-ring)
Surface burst-read and off-hours findings from audit history
Resolve which env slug should drive superposition collapse for the current context
Break the sync link between two keys (does not delete values)
Render a complete .env body from the project manifest, with warnings for gaps
Run a child command with secrets injected as env vars and any leaked values redacted from output
Export audit events as jsonl, json, or csv for archival/SIEM
Render multiple secrets as .env or JSON for one-off export (skips approval-protected keys without a grant)
Generate a CSPRNG-backed value in a chosen format and optionally store it
Single redacted snapshot of secrets, env, manifest, hooks, and recent audit activity
Read a secret value (collapses superposition, audits the read)
Boolean existence check that respects decay (no audit read)
Read-only scope sweep: decay/stale/expired counts plus current anomalies
Parse .env text and bulk-store every key/value pair (accepts raw content only — never reads files)
Show metadata for one key (states, decay, entanglement, access count) without revealing the value
Inspect a specific file list for hardcoded secrets with optional auto-fix to process.env.KEY
Show every registered hook with match criteria, type, and enabled flag
Enumerate built-in validation providers and their auto-detect prefixes
List keys + metadata in scope (values never exposed); filter by tag, expiry, glob
Register a shell/HTTP/signal side-effect that fires on write/delete/rotate
Detach a single hook by ID without touching any secrets
Walk a directory tree and flag hardcoded secrets via regex + entropy heuristics
Create or overwrite a single secret with optional TTL, per-env state, tags, rotation format
Start a local SSE dashboard with live KPIs, secrets, hooks, and audit feed (returns a token-gated 127.0.0.1 URL)
Encrypt selected secrets into a passphrase-protected AES-256-GCM bundle
Decrypt a teleport bundle and import each secret (with optional dry-run)
Stash a value in process memory and return an opaque ID (never touches disk)
Immediately remove a tunnel from memory before its TTL/reads run out
Enumerate active tunnels with remaining read budget and TTL (IDs only)
Fetch a tunneled value by ID — may self-destruct on read
Hit the upstream service (OpenAI/Stripe/GitHub/AWS/HTTP) to confirm a single key is still live
Recompute the audit hash chain and report the first break point if tampered