manage_encryption_key
Manage Fernet encryption keys for stored PostgreSQL secrets: check status, generate or rotate certificates, rekey connection files, and revoke compromised keys.
Instructions
Manage the Data Encryption Certificate (Fernet key) for stored secrets.
Args:
action: One of:
- "status" (default) — list all certs with metadata, no changes.
- "generate" — create a new cert, set as active. ttl_days applies.
- "rotate" — create a new cert (version+1), set as active,
previous one becomes ROTATING (decrypt still works
in grace period).
- "rekey" — re-encrypt connections.json and llm_connections.json
with the new active cert (run after rotation).
- "revoke" — mark cert by `kid` as REVOKED (compromised).
Decrypt NO longer works for it.
- "validate" — same as status, but also tries to decrypt a known
secret (currently no-op placeholder, returns status).
ttl_days: Certificate lifetime for generate/rotate (default 90).
subject: Subject CN for new certs (default "postgres-mcp secrets").
use_passphrase: If true, new cert will be passphrase-protected
(raw key encrypted with PBKDF2(passphrase)). Passphrase is read
from env CERT_PASSPHRASE.
kid: For action="revoke" — which certificate to revoke.
reason: Free-text reason recorded in audit log and cert notes.
Returns:
JSON with details of the operation. For "status" — list of certs.
For generate/rotate — new cert metadata. For revoke — boolean.
For rekey — statistics {scanned, rekeyed, skipped, errors}.
Examples:
# See current state
action="status"
# Create a new cert (auto-active)
action="generate" ttl_days=90
# Rotate (new active, old → ROTATING for grace period)
action="rotate"
# Re-encrypt connections files with new cert
action="rekey"
# Revoke a compromised cert
action="revoke" kid="dec-abc123..." reason="leaked on GitHub"
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kid | No | ||
| action | No | status | |
| reason | No | manual | |
| subject | No | postgres-mcp secrets | |
| ttl_days | No | ||
| use_passphrase | No |