Secret Manager

One rule governs this page: a secret’s value never leaves Google Cloud. enoki reads Secret Manager metadata only — names, versions, and their state — so you can audit and locate secrets from Slack without ever exposing their contents.

Reads — metadata only

• list_secrets(project_id) — the secret names in a project. No values.
• list_secret_versions(secret_id, project_id) — the versions of a secret and each one’s state (enabled, disabled, destroyed). No values.

Why there is no “read secret” tool

There is deliberately no tool that calls access_secret_version — the API that returns the actual secret material. A chat surface is exactly the wrong place for a plaintext credential: it would land in Slack, in thread history, and in an LLM’s context window. enoki can tell you a secret exists, how many versions it has, and whether they’re active — the questions you can safely answer in a thread — and stops there. See Guardrails.

Next: Networking.