From a09ec4a0a5a9e57c1987f1ab45b6f46816413942 Mon Sep 17 00:00:00 2001 From: Max Solovev Date: Fri, 10 Jul 2026 14:43:43 +0300 Subject: [PATCH] feat(kv): include KV v2 metadata in read_secret response The v2 read handler discarded secret.Data["metadata"] and returned only the data payload, so clients could not see version, timestamps or custom_metadata (e.g. description/usage). Return {data, metadata} instead, keeping the values and surfacing the metadata block clients need to understand a secret. --- pkg/tools/kv/read_secret.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/tools/kv/read_secret.go b/pkg/tools/kv/read_secret.go index 160acaf..d1946f5 100644 --- a/pkg/tools/kv/read_secret.go +++ b/pkg/tools/kv/read_secret.go @@ -127,7 +127,13 @@ func readSecretHandler(ctx context.Context, req mcp.CallToolRequest, logger *log if !ok { return mcp.NewToolResultError("unexpected secret data format for v2 API"), nil } - secretData = data + // Include the KV v2 metadata block (version, created/updated times and + // custom_metadata such as description/usage) alongside the data payload, + // instead of discarding it — clients need it to understand a secret. + secretData = map[string]interface{}{ + "data": data, + "metadata": secret.Data["metadata"], + } } else { // V1 API structure: secret.Data directly contains the key-value pairs secretData = secret.Data