Get credential reference

The get_credential tool retrieves a plaintext credential from the Gazebo vault for a named service. Every credential-access attempt is logged in the audit trail regardless of outcome. The value is delivered to the MCP client/agent; do not persist it.

Parameters

Parameter	Type	Required	Description
service	string	Yes	The service slug (e.g. "stripe", "github", "vercel")
method	string	Yes	The HTTP method you intend to use the credential for ("GET", "POST", "PUT", "PATCH", "DELETE")
key_name	string	No	The named credential to retrieve. Omit it to retrieve the service's primary credential.

The method parameter is policy-enforced — declaring "POST" when you intend to make a write call is not optional. If your access profile doesn't permit POST on that service, the call is denied and logged.

Success response

On success, get_credential returns the plaintext credential as a string:

get_credential({ service: "stripe", method: "GET" })
→ "<scoped-service-credential>"

Use this value directly in your API call. Do not persist it; retrieve it again when needed.

Denial response

If the agent is not permitted to access the service or method, get_credential returns a structured JSON object:

{
  "status": "denied",
  "service": "stripe",
  "method": "DELETE",
  "allowed_methods": ["GET", "POST"],
  "reason": "Method DELETE is not permitted for service stripe",
  "next_action": "Update the agent's access profile to include DELETE, or use a permitted method."
}

On denial, do not retry without user intervention. The policy will not change between calls. Parse the response, tell the user what happened (including next_action), and stop.

Not-found response

If no credential is stored for the requested service:

{
  "status": "not_found",
  "service": "stripe",
  "reason": "No credential stored for service stripe",
  "next_action": "Connect Stripe in the Gazebo dashboard under Settings → Services."
}

Error table

HTTP status	status field	Meaning
200	—	Credential returned as plain string
403	denied	Service not in access profile, or method not permitted
404	not_found	No credential stored for this service
401	—	Invalid or missing bearer token

Recommended usage pattern

1. get_identity()                           → confirm accessible services
2. get_credential({ service, method })      → fetch the credential
3. [make your API call using the credential]
4. list_audit_events({ service, limit: 1 }) → optionally confirm it was logged

Do not store the returned credential in memory beyond the scope of the current API call. Treat it as ephemeral.