Check Your Secrets

bob secrets check answers one question: is every secret your operator declares present on this machine? It checks that each secret exists and reads its metadata. It never reads, prints or copies a value. The full contract is in the bob secrets reference.

Terminal only. It probes this machine's shell, files, keychain and CLIs.

Before you start

You need a resolved operator repo (bob operator show exits 0). If it exits 3, start with Set Up Your Operator Repo.

1. Declare each secret in operator.json

Every entry in secrets[] has a name and a source (where the value is kept). To be checkable it also needs present_at, which says where this machine should find the secret. Add "required": true only for secrets whose absence should fail the check.

"secrets": [
  {
    "name": "BRIDGE_SECRET",
    "source": "op://Example/remote-decision-bridge/secret",
    "required": true,
    "present_at": { "kind": "env", "ref": "BRIDGE_SECRET" }
  },
  {
    "name": "REPORTER_LINKS",
    "source": "file:~/.claude/secrets/reporter-links.md",
    "present_at": { "kind": "file", "ref": "~/.claude/secrets/reporter-links.md" }
  }
]

kind is one of env, file, keychain, gh-secret or op. The present_at table in the bob secrets reference gives the ref shape for each. Never put a value in the file: the schema refuses any extra key, so a value fails bob operator show.

Commit the change in the operator repo, then confirm it still validates:

bob operator show          # exit 0

2. Run the check

bob secrets check

Each row shows a state, the locator it probed, and the source. Every gap gets a Fix: line:

  SECRET            STATE     PRESENT_AT                 SOURCE
  BRIDGE_SECRET *   MISSING   env:BRIDGE_SECRET          op://Example/remote-decision-bridge/secret
                    variable BRIDGE_SECRET is not set — Fix: export BRIDGE_SECRET=… from its source …
  * required (1)
MISSING — 1 required secret(s) not present: BRIDGE_SECRET.

3. Close each gap

State	Do this
missing	Place the secret from its source, following the printed Fix: (export, place the file then chmod 600, security add-generic-password, gh secret set, op item create).
insecure	The file exists but group or others can read it: chmod 600 <path>.
unknown	The check could not look: declare present_at, install or sign in to op / gh, or run a keychain check on the Mac that holds the keychain.

Rerun bob secrets check until it prints OK — every required secret is present. and exits 0.

Verify

bob secrets check; echo "exit=$?"     # 0 = every required secret present
bob doctor                            # its "secrets" line carries the same counts

Exit 1 means a required secret is missing, insecure or unknown. Exit 2 means operator.json is invalid. Exit 3 means no operator resolved.

Check another operator repo

To test declarations before you commit them, point the check at a different checkout:

bob secrets check --operator <dir>

Related

• bob secrets reference: the four states, how each kind is probed, and the bob-secrets/1 document.
• Set Up Your Operator Repo
• Secrets inventory: every credential BoB depends on, and when each is due for rotation.