Secrets
Space MCP tools in the Secrets scope (secrets). Reach these with a wks_live_ key over space-mcp or space-api.
Tools in the secrets scope, callable over space-mcp (tools/call) or space-api (REST) with a wks_live_* key that grants secrets.
http_request
Scope: secrets:run
Make an HTTP request to an external API via the platform egress proxy (consequential — calls the outside world). Any ${secret:NAME} placeholders in the url, header values, or body are replaced with the real secret value server-side; the value is never visible to you, and any echo of it in the response is redacted. Redirects are not followed. Private/internal addresses are blocked.
| Parameter | Type | Required | Description |
|---|---|---|---|
url | string | yes | |
method | string | GET | POST | PUT | PATCH | DELETE | HEAD (default GET) | |
headers | object | Header name → value. Values may contain ${secret:NAME} placeholders. | |
body | string | Raw request body. For JSON, pass the serialized string. May contain placeholders. | |
timeout_ms | number | 1000–60000, default 30000 |
list_secret_names
Scope: secrets:read
List the NAMES of secrets stored in the space. Values are never returned.
use_secret
Scope: secrets:run
Get a redacted placeholder (${secret:NAME} / ${secret:NAME:field}) for a secret assigned to this space, to embed in http_request. The platform substitutes the real value at egress — the value is NEVER returned to you. Use field_key to pick one field of a multi-field secret. Validates the secret exists and resolves.
| Parameter | Type | Required | Description |
|---|---|---|---|
secret_name | string | yes | Secret name as shown by list_secret_names |
field_key | string | Optional field of a multi-field secret (e.g. api_key) |