release(secrets-mcp): 0.5.5 — 生产 CORS 显式 allow_methods，修复 tower-http 启动 panic

credentials + wildcard methods/headers 被 tower-http 禁止；生产环境改为 GET/POST/PATCH/DELETE/OPTIONS 白名单。
release(secrets-mcp): 0.5.4 — Web 分页修正与 hex 解码；批量删除上限；MCP @ 路径检测
2026-04-05 12:27:40 +08:00 · 2026-04-05 12:14:40 +08:00 · 2026-04-05 11:34:04 +08:00 · 2026-04-05 10:38:50 +08:00 · 2026-04-04 21:27:33 +08:00
29 changed files with 1588 additions and 244 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,12 +2,37 @@

 本仓库为 **MCP SaaS**：`secrets-core`（业务与持久化）+ `secrets-mcp`（Streamable HTTP MCP、Web、OAuth、API Key）。对外入口见 `crates/secrets-mcp`。

+## 版本控制
+
+本仓库使用 **[Jujutsu (jj)](https://jj-vcs.dev/)** 作为版本控制系统（纯 jj 模式，无 `.git` 目录）。
+
+### 常用 jj 命令对照
+
+| 操作 | jj 命令 |
+|------|---------|
+| 查看历史 | `jj log` / `jj log 'all()'` |
+| 查看状态 | `jj status` |
+| 新建提交 | `jj commit` |
+| 创建新变更 | `jj new` |
+| 变基 | `jj rebase` |
+| 合并提交 | `jj squash` |
+| 撤销操作 | `jj undo` |
+| 查看标签 | `jj tag list` |
+| 查看分支 | `jj bookmark list` |
+| 推送远端 | `jj git push` |
+| 拉取远端 | `jj git fetch` |
+
+### 注意事项
+- 本仓库为**纯 jj 模式**，无 `.git` 目录；本地不要使用 `git` 命令
+- CI/CD（Gitea Actions）仍通过 Git 协议拉取代码，Runner 侧自动使用 `git`，无需修改
+- 检查标签是否存在时使用 `jj log --no-graph --revisions "tag(${tag})"` 而非 `git rev-parse`
+
 ## 提交 / 推送硬规则（优先于下文）

 **每次提交和推送前必须执行以下检查，无论是否明确「发版」：**

 1. 涉及 `crates/**`、根目录 `Cargo.toml`/`Cargo.lock`、`secrets-mcp` 行为变更的提交，默认视为**需要发版**，除非明确说明「本次不发版」。
-2. 提交前检查 `crates/secrets-mcp/Cargo.toml` 的 `version`，再查 tag：`git tag -l 'secrets-mcp-*'`。若当前版本对应 tag 已存在且有代码变更，**必须 bump 版本号**并 `cargo build` 同步 `Cargo.lock`。
+2. 提交前检查 `crates/secrets-mcp/Cargo.toml` 的 `version`，再查 tag：`jj tag list`。若当前版本对应 tag 已存在且有代码变更，**必须 bump 版本号**并 `cargo build` 同步 `Cargo.lock`。
 3. 提交前运行 `./scripts/release-check.sh`（版本/tag + `fmt` + `clippy --locked` + `test --locked`）。若脚本不存在或不可用，至少运行 `cargo fmt -- --check && cargo clippy --locked -- -D warnings && cargo test --locked`。

 ## 项目结构
@@ -112,14 +137,16 @@ oauth_accounts (

 ### MCP 消歧（AI 调用）

-按 `name` 定位条目的工具（`get` / `update` / 单条 `delete` / `history` / `rollback`）：若该用户下仅一条匹配则直接执行；若多条（同 `name`、不同 `folder`）则返回错误并提示补全 `folder`。`secrets_delete` 的 `dry_run=true` 与真实删除使用相同消歧规则。
+按 `name` 定位条目的工具（`secrets_update` / `secrets_history` / `secrets_rollback` / `secrets_delete` 单条模式）：若该用户下仅一条匹配则直接执行；若多条（同 `name`、不同 `folder`）则返回错误并提示补全 `folder`。也可直接传 `id`（UUID）跳过消歧。
+
+注意：`secrets_get` 只接受 UUID `id`（来自 `secrets_find` 结果），不支持按 `name` 定位。

 ### 字段职责

 | 字段 | 含义 | 示例 |
 |------|------|------|
 | `folder` | 隔离空间（参与唯一键） | `refining` |
-| `type` | 软分类（不参与唯一键） | `server`, `service`, `person`, `document` |
+| `type` | 软分类（不参与唯一键，用户自定义） | `server`, `service`, `account`, `person`, `document` |
 | `name` | 标识名 | `gitea`, `aliyun` |
 | `notes` | 非敏感说明 | 自由文本 |
 | `tags` | 标签 | `["aliyun","prod"]` |
@@ -144,6 +171,14 @@ oauth_accounts (
 - 加密：密钥由用户密码短语通过 **PBKDF2-SHA256（600k 次）** 在客户端派生，服务端只存 `key_salt`/`key_check`/`key_params`，不持有原始密钥。Web 客户端在浏览器本地完成加解密；MCP 客户端通过 `X-Encryption-Key` 请求头传递密钥，服务端临时解密后返回明文。
 - MCP：tools 参数与 JSON Schema（`schemars`）保持同步，鉴权以请求扩展中的用户上下文为准。

+## 生产 CORS
+
+生产环境 CORS 使用显式请求头白名单（`build_cors_layer`），而非 `allow_headers(Any)`，
+因为 `tower-http` 禁止 `allow_credentials(true)` 与 `allow_headers(Any)` 同时使用。
+
+**维护约束**：若 MCP 协议或客户端新增自定义请求头，必须同步更新 `production_allowed_headers()`。
+当前允许的请求头：`Authorization`、`Content-Type`、`X-Encryption-Key`、`mcp-session-id`、`x-mcp-session`。
+
 ## 提交前检查

 ```bash
@@ -162,7 +197,7 @@ cargo test --locked

 ```bash
 grep '^version' crates/secrets-mcp/Cargo.toml
-git tag -l 'secrets-mcp-*'
+jj tag list
 ```

 ## CI/CD
@@ -182,10 +217,17 @@ git tag -l 'secrets-mcp-*'
 | `SECRETS_DATABASE_URL` | **必填**。PostgreSQL URL。 |
 | `SECRETS_DATABASE_SSL_MODE` | 可选但强烈建议生产必填。推荐 `verify-full`（至少 `verify-ca`）。 |
 | `SECRETS_DATABASE_SSL_ROOT_CERT` | 可选。私有 CA 或自签链路时指定 CA 根证书路径。 |
+| `SECRETS_DATABASE_POOL_SIZE` | 可选。连接池最大连接数，默认 `10`。 |
+| `SECRETS_DATABASE_ACQUIRE_TIMEOUT` | 可选。获取连接超时秒数，默认 `5`。 |
 | `SECRETS_ENV` | 可选。设为 `prod` / `production` 时会拒绝弱 PostgreSQL TLS 模式。 |
 | `BASE_URL` | 对外基址；OAuth 回调 `${BASE_URL}/auth/google/callback`。 |
 | `SECRETS_MCP_BIND` | 监听地址，默认 `127.0.0.1:9315`（容器/远程直接暴露时需改为 `0.0.0.0:9315`）。 |
 | `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | 可选；仅运行时配置。 |
 | `RUST_LOG` | 如 `secrets_mcp=debug`。 |
+| `RATE_LIMIT_GLOBAL_PER_SECOND` | 可选。全局限流速率，默认 `100` req/s。 |
+| `RATE_LIMIT_GLOBAL_BURST` | 可选。全局限流突发量，默认 `200`。 |
+| `RATE_LIMIT_IP_PER_SECOND` | 可选。单 IP 限流速率，默认 `20` req/s。 |
+| `RATE_LIMIT_IP_BURST` | 可选。单 IP 限流突发量，默认 `40`。 |
+| `TRUST_PROXY` | 可选。设为 `1`/`true`/`yes` 时从 `X-Forwarded-For` / `X-Real-IP` 提取客户端 IP。 |

 > `SERVER_MASTER_KEY` 已不再需要。新架构下密钥由用户密码短语在客户端派生，服务端不持有。
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,55 @@
+# Contributing
+
+## 版本控制
+
+本仓库使用 **[Jujutsu (jj)](https://jj-vcs.dev/)**。请勿使用 `git` 命令。
+
+```bash
+jj log          # 查看历史
+jj status       # 查看状态
+jj new          # 创建新变更
+jj commit       # 提交
+jj rebase       # 变基
+jj squash       # 合并提交
+jj git push     # 推送到远端
+```
+
+详见 [AGENTS.md](AGENTS.md) 的「版本控制」章节。
+
+## 本地开发
+
+```bash
+# 复制环境变量
+cp deploy/.env.example .env
+
+# 填写数据库连接等配置后
+cargo build
+cargo test --locked
+```
+
+## 提交前检查
+
+每次提交前必须通过：
+
+```bash
+cargo fmt -- --check
+cargo clippy --locked -- -D warnings
+cargo test --locked
+```
+
+或使用脚本：
+
+```bash
+./scripts/release-check.sh
+```
+
+## 发版规则
+
+涉及 `crates/**`、根目录 `Cargo.toml`/`Cargo.lock`、`secrets-mcp` 行为变更的提交，默认需要发版。
+
+1. 检查 `crates/secrets-mcp/Cargo.toml` 的 `version`
+2. 运行 `jj tag list` 确认对应 tag 是否已存在
+3. 若 tag 已存在且有代码变更，**必须 bump 版本**并 `cargo build` 同步 `Cargo.lock`
+4. 通过 release-check 后再提交
+
+详见 [AGENTS.md](AGENTS.md) 的「提交 / 推送硬规则」章节。
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -464,6 +464,20 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "dashmap"
+version = "6.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -596,6 +610,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"

+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -687,6 +707,12 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"

+[[package]]
+name = "futures-timer"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+
 [[package]]
 name = "futures-util"
 version = "0.3.32"
@@ -765,6 +791,35 @@ dependencies = [
 "polyval",
 ]

+[[package]]
+name = "governor"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
+dependencies = [
+ "cfg-if",
+ "dashmap",
+ "futures-sink",
+ "futures-timer",
+ "futures-util",
+ "getrandom 0.3.4",
+ "hashbrown 0.16.1",
+ "nonzero_ext",
+ "parking_lot",
+ "portable-atomic",
+ "quanta",
+ "rand 0.9.2",
+ "smallvec",
+ "spinning_top",
+ "web-time",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -773,7 +828,7 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
 "allocator-api2",
 "equivalent",
- "foldhash",
+ "foldhash 0.1.5",
 ]

 [[package]]
@@ -781,6 +836,11 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]

 [[package]]
 name = "hashlink"
@@ -1283,6 +1343,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "nonzero_ext"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1463,6 +1529,12 @@ dependencies = [
 "universal-hash",
 ]

+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
 [[package]]
 name = "potential_utf"
 version = "0.1.4"
@@ -1506,6 +1578,21 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -1658,6 +1745,15 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"

+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1953,6 +2049,7 @@ dependencies = [
 "aes-gcm",
 "anyhow",
 "chrono",
+ "hex",
 "rand 0.10.0",
 "serde",
 "serde_json",
@@ -1969,7 +2066,7 @@ dependencies = [

 [[package]]
 name = "secrets-mcp"
-version = "0.5.0"
+version = "0.5.5"
 dependencies = [
 "anyhow",
 "askama",
@@ -1977,6 +2074,7 @@ dependencies = [
 "axum-extra",
 "chrono",
 "dotenvy",
+ "governor",
 "http",
 "rand 0.10.0",
 "reqwest",
@@ -1995,6 +2093,7 @@ dependencies = [
 "tower-sessions-sqlx-store-chrono",
 "tracing",
 "tracing-subscriber",
+ "url",
 "urlencoding",
 "uuid",
 ]
@@ -2195,6 +2294,15 @@ dependencies = [
 "lock_api",
 ]

+[[package]]
+name = "spinning_top"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
+dependencies = [
+ "lock_api",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2717,6 +2825,7 @@ dependencies = [
 "futures-util",
 "http",
 "http-body",
+ "http-body-util",
 "iri-string",
 "pin-project-lite",
 "tower",
@@ -3167,6 +3276,28 @@ dependencies = [
 "wasite",
 ]

+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ flowchart LR
 | 位置 | 字段 | 说明 |
 |------|------|------|
 | entries | folder | 组织/隔离空间，如 `refining`、`ricnsmart`；参与唯一键 |
-| entries | type | 软分类，如 `server`、`service`、`person`、`document`（可扩展，不参与唯一键） |
+| entries | type | 软分类，用户自定义，如 `server`、`service`、`account`、`person`、`document`（不参与唯一键） |
 | entries | name | 人类可读标识；与 `folder` 一起在用户内唯一 |
 | entries | notes | 非敏感说明文本 |
 | entries | metadata | 明文 JSON（ip、url、subtype 等） |
@@ -195,12 +195,9 @@ flowchart LR
 - 同一 secret 可被多个 entry 引用，删除某 entry 不会级联删除被共享的 secret
 - 当 secret 不再被任何 entry 引用时，自动清理（`NOT EXISTS` 子查询）

-### 类型规范化（Taxonomy）
+### 类型（Type）

-`type` 字段用于软分类，系统会自动将历史遗留类型映射为标准化类型：
- `git-server`、`database`、`cache`、`queue`、`storage` 等 → `service`（原始值存入 `metadata.subtype`）
- 新增条目时建议使用标准类型：`server`、`service`、`person`、`document`
- 类型映射在 `crates/secrets-core/src/taxonomy.rs` 中定义
+`type` 字段用于软分类，由用户自由填写，不做任何自动转换或归一化。常见示例：`server`、`service`、`account`、`person`、`document`，但任何值均可接受。

 ## 审计日志

@@ -220,7 +217,7 @@ LIMIT 20;
 Cargo.toml
 crates/secrets-core/     # db / crypto / models / audit / service
  src/
-    taxonomy.rs          # 类型规范化（legacy type → standard type + subtype）
+    taxonomy.rs          # SECRET_TYPE_OPTIONS（secret 字段类型下拉选项）
    service/             # 业务逻辑（add, search, update, delete, export, env_map 等）
 crates/secrets-mcp/     # MCP HTTP、Web、OAuth、API Key
 scripts/
--- a/crates/secrets-core/Cargo.toml
+++ b/crates/secrets-core/Cargo.toml
@@ -12,6 +12,7 @@ aes-gcm.workspace = true
 anyhow.workspace = true
 thiserror.workspace = true
 chrono.workspace = true
+hex = "0.4"
 rand.workspace = true
 serde.workspace = true
 serde_json.workspace = true
--- a/crates/secrets-core/src/crypto.rs
+++ b/crates/secrets-core/src/crypto.rs
@@ -61,7 +61,7 @@ pub fn decrypt_json(master_key: &[u8; 32], data: &[u8]) -> Result<Value> {

 /// Parse a 64-char hex string (from X-Encryption-Key header) into a 32-byte key.
 pub fn extract_key_from_hex(hex_str: &str) -> Result<[u8; 32]> {
-    let bytes = hex::decode_hex(hex_str.trim())?;
+    let bytes = ::hex::decode(hex_str.trim())?;
    if bytes.len() != 32 {
        bail!(
            "X-Encryption-Key must be 64 hex chars (32 bytes), got {} bytes",
@@ -76,21 +76,14 @@ pub fn extract_key_from_hex(hex_str: &str) -> Result<[u8; 32]> {
 // ─── Public hex helpers ───────────────────────────────────────────────────────

 pub mod hex {
-    use anyhow::{Result, bail};
+    use anyhow::Result;

    pub fn encode_hex(bytes: &[u8]) -> String {
        bytes.iter().map(|b| format!("{:02x}", b)).collect()
    }

    pub fn decode_hex(s: &str) -> Result<Vec<u8>> {
-        let s = s.trim();
-        if !s.len().is_multiple_of(2) {
-            bail!("hex string has odd length");
-        }
-        (0..s.len())
-            .step_by(2)
-            .map(|i| u8::from_str_radix(&s[i..i + 2], 16).map_err(|e| anyhow::anyhow!("{}", e)))
-            .collect()
+        Ok(::hex::decode(s.trim())?)
    }
 }

--- a/crates/secrets-core/src/db.rs
+++ b/crates/secrets-core/src/db.rs
@@ -36,12 +36,31 @@ fn build_connect_options(config: &DatabaseConfig) -> Result<PgConnectOptions> {
 pub async fn create_pool(config: &DatabaseConfig) -> Result<PgPool> {
    tracing::debug!("connecting to database");
    let connect_options = build_connect_options(config)?;
+
+    // Connection pool configuration from environment
+    let max_connections = std::env::var("SECRETS_DATABASE_POOL_SIZE")
+        .ok()
+        .and_then(|v| v.parse::<u32>().ok())
+        .unwrap_or(10);
+
+    let acquire_timeout_secs = std::env::var("SECRETS_DATABASE_ACQUIRE_TIMEOUT")
+        .ok()
+        .and_then(|v| v.parse::<u64>().ok())
+        .unwrap_or(5);
+
    let pool = PgPoolOptions::new()
-        .max_connections(10)
-        .acquire_timeout(std::time::Duration::from_secs(5))
+        .max_connections(max_connections)
+        .acquire_timeout(std::time::Duration::from_secs(acquire_timeout_secs))
+        .max_lifetime(std::time::Duration::from_secs(1800)) // 30 minutes
+        .idle_timeout(std::time::Duration::from_secs(600)) // 10 minutes
        .connect_with(connect_options)
        .await?;
-    tracing::debug!("database connection established");
+
+    tracing::debug!(
+        max_connections,
+        acquire_timeout_secs,
+        "database connection established"
+    );
    Ok(pool)
 }

--- a/crates/secrets-core/src/error.rs
+++ b/crates/secrets-core/src/error.rs
@@ -15,6 +15,18 @@ pub enum AppError {
    #[error("Entry not found")]
    NotFoundEntry,

+    #[error("User not found")]
+    NotFoundUser,
+
+    #[error("Secret not found")]
+    NotFoundSecret,
+
+    #[error("Authentication failed")]
+    AuthenticationFailed,
+
+    #[error("Unauthorized: insufficient permissions")]
+    Unauthorized,
+
    #[error("Validation failed: {message}")]
    Validation { message: String },

@@ -24,6 +36,9 @@ pub enum AppError {
    #[error("Decryption failed — the encryption key may be incorrect")]
    DecryptionFailed,

+    #[error("Encryption key not set — user must set passphrase first")]
+    EncryptionKeyNotSet,
+
    #[error(transparent)]
    Internal(#[from] anyhow::Error),
 }
@@ -119,6 +134,18 @@ mod tests {
        let err = AppError::NotFoundEntry;
        assert_eq!(err.to_string(), "Entry not found");

+        let err = AppError::NotFoundUser;
+        assert_eq!(err.to_string(), "User not found");
+
+        let err = AppError::NotFoundSecret;
+        assert_eq!(err.to_string(), "Secret not found");
+
+        let err = AppError::AuthenticationFailed;
+        assert_eq!(err.to_string(), "Authentication failed");
+
+        let err = AppError::Unauthorized;
+        assert!(err.to_string().contains("Unauthorized"));
+
        let err = AppError::Validation {
            message: "too long".to_string(),
        };
@@ -126,6 +153,9 @@ mod tests {

        let err = AppError::ConcurrentModification;
        assert!(err.to_string().contains("Concurrent modification"));
+
+        let err = AppError::EncryptionKeyNotSet;
+        assert!(err.to_string().contains("Encryption key not set"));
    }

    #[test]
--- a/crates/secrets-core/src/models.rs
+++ b/crates/secrets-core/src/models.rs
@@ -4,7 +4,7 @@ use serde_json::Value;
 use std::collections::BTreeMap;
 use uuid::Uuid;

-/// A top-level entry (server, service, key, person, …).
+/// A top-level entry (server, service, account, person, …).
 /// Sensitive fields are stored separately in `secrets`.
 #[derive(Debug, Serialize, Deserialize, sqlx::FromRow)]
 pub struct Entry {
--- a/crates/secrets-core/src/service/add.rs
+++ b/crates/secrets-core/src/service/add.rs
@@ -9,7 +9,6 @@ use crate::crypto;
 use crate::db;
 use crate::error::{AppError, DbErrorContext};
 use crate::models::EntryRow;
-use crate::taxonomy;

 // ── Key/value parsing helpers ─────────────────────────────────────────────────

@@ -186,11 +185,10 @@ pub struct AddParams<'a> {
 }

 pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) -> Result<AddResult> {
-    let Value::Object(mut metadata_map) = build_json(params.meta_entries)? else {
+    let Value::Object(metadata_map) = build_json(params.meta_entries)? else {
        unreachable!("build_json always returns a JSON object");
    };
-    let normalized_entry_type =
-        taxonomy::normalize_entry_type_and_metadata(params.entry_type, &mut metadata_map);
+    let entry_type = params.entry_type.trim();
    let metadata = Value::Object(metadata_map);
    let secret_json = build_json(params.secret_entries)?;
    let meta_keys = collect_key_paths(params.meta_entries)?;
@@ -232,7 +230,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
                entry_id: ex.id,
                user_id: params.user_id,
                folder: params.folder,
-                entry_type: &normalized_entry_type,
+                entry_type,
                name: params.name,
                version: ex.version,
                action: "add",
@@ -245,6 +243,11 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
        tracing::warn!(error = %e, "failed to snapshot entry history before upsert");
    }

+    // Upsert the entry row. On conflict (existing entry with same user_id+folder+name),
+    // the entry columns are replaced wholesale. The old secret associations are torn down
+    // below within the same transaction, so the whole operation is atomic: if any step
+    // after this point fails, the transaction rolls back and the entry reverts to its
+    // pre-upsert state (including the version bump that happened in the DO UPDATE clause).
    let entry_id: Uuid = if let Some(uid) = params.user_id {
        sqlx::query_scalar(
            r#"INSERT INTO entries (user_id, folder, type, name, notes, tags, metadata, version, updated_at)
@@ -262,7 +265,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
        )
        .bind(uid)
        .bind(params.folder)
-        .bind(&normalized_entry_type)
+        .bind(entry_type)
        .bind(params.name)
        .bind(params.notes)
        .bind(params.tags)
@@ -285,7 +288,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
               RETURNING id"#,
        )
        .bind(params.folder)
-        .bind(&normalized_entry_type)
+        .bind(entry_type)
        .bind(params.name)
        .bind(params.notes)
        .bind(params.tags)
@@ -307,7 +310,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
                entry_id,
                user_id: params.user_id,
                folder: params.folder,
-                entry_type: &normalized_entry_type,
+                entry_type,
                name: params.name,
                version: current_entry_version,
                action: "create",
@@ -434,7 +437,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
        params.user_id,
        "add",
        params.folder,
-        &normalized_entry_type,
+        entry_type,
        params.name,
        serde_json::json!({
            "tags": params.tags,
@@ -449,7 +452,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
    Ok(AddResult {
        name: params.name.to_string(),
        folder: params.folder.to_string(),
-        entry_type: normalized_entry_type,
+        entry_type: entry_type.to_string(),
        tags: params.tags.to_vec(),
        meta_keys,
        secret_keys,
--- a/crates/secrets-core/src/service/api_key.rs
+++ b/crates/secrets-core/src/service/api_key.rs
@@ -2,6 +2,8 @@ use anyhow::Result;
 use sqlx::PgPool;
 use uuid::Uuid;

+use crate::error::AppError;
+
 const KEY_PREFIX: &str = "sk_";

 /// Generate a new API key: `sk_<64 hex chars>` = 67 characters total.
@@ -14,23 +16,32 @@ pub fn generate_api_key() -> String {
 }

 /// Return the user's existing API key, or generate and store a new one if NULL.
+/// Uses a transaction with atomic update to prevent TOCTOU race conditions.
 pub async fn ensure_api_key(pool: &PgPool, user_id: Uuid) -> Result<String> {
-    let existing: Option<(Option<String>,)> =
-        sqlx::query_as("SELECT api_key FROM users WHERE id = $1")
-            .bind(user_id)
-            .fetch_optional(pool)
-            .await?;
+    let mut tx = pool.begin().await?;

-    if let Some((Some(key),)) = existing {
+    // Lock the row and check existing key
+    let existing: (Option<String>,) =
+        sqlx::query_as("SELECT api_key FROM users WHERE id = $1 FOR UPDATE")
+            .bind(user_id)
+            .fetch_optional(&mut *tx)
+            .await?
+            .ok_or(AppError::NotFoundUser)?;
+
+    if let Some(key) = existing.0 {
+        tx.commit().await?;
        return Ok(key);
    }

+    // Generate and store new key atomically
    let new_key = generate_api_key();
    sqlx::query("UPDATE users SET api_key = $1 WHERE id = $2")
        .bind(&new_key)
        .bind(user_id)
-        .execute(pool)
+        .execute(&mut *tx)
        .await?;
+
+    tx.commit().await?;
    Ok(new_key)
 }

--- a/crates/secrets-core/src/service/audit_log.rs
+++ b/crates/secrets-core/src/service/audit_log.rs
@@ -4,20 +4,36 @@ use uuid::Uuid;

 use crate::models::AuditLogEntry;

-pub async fn list_for_user(pool: &PgPool, user_id: Uuid, limit: i64) -> Result<Vec<AuditLogEntry>> {
+pub async fn list_for_user(
+    pool: &PgPool,
+    user_id: Uuid,
+    limit: i64,
+    offset: i64,
+) -> Result<Vec<AuditLogEntry>> {
    let limit = limit.clamp(1, 200);
+    let offset = offset.max(0);

    let rows = sqlx::query_as(
        "SELECT id, user_id, action, folder, type, name, detail, created_at \
         FROM audit_log \
         WHERE user_id = $1 \
         ORDER BY created_at DESC, id DESC \
-         LIMIT $2",
+         LIMIT $2 OFFSET $3",
    )
    .bind(user_id)
    .bind(limit)
+    .bind(offset)
    .fetch_all(pool)
    .await?;

    Ok(rows)
 }
+
+pub async fn count_for_user(pool: &PgPool, user_id: Uuid) -> Result<i64> {
+    let count: i64 =
+        sqlx::query_scalar("SELECT COUNT(*)::bigint FROM audit_log WHERE user_id = $1")
+            .bind(user_id)
+            .fetch_one(pool)
+            .await?;
+    Ok(count)
+}
--- a/crates/secrets-core/src/service/delete.rs
+++ b/crates/secrets-core/src/service/delete.rs
@@ -31,6 +31,10 @@ pub struct DeleteParams<'a> {
    pub user_id: Option<Uuid>,
 }

+/// Maximum number of entries that can be deleted in a single bulk operation.
+/// Prevents accidental mass deletion when filters are too broad.
+pub const MAX_BULK_DELETE: usize = 1000;
+
 /// Delete a single entry by id (multi-tenant: `user_id` must match).
 pub async fn delete_by_id(pool: &PgPool, entry_id: Uuid, user_id: Uuid) -> Result<DeleteResult> {
    let mut tx = pool.begin().await?;
@@ -374,6 +378,16 @@ async fn delete_bulk(
    }
    let rows = q.fetch_all(&mut *tx).await?;

+    if rows.len() > MAX_BULK_DELETE {
+        tx.rollback().await?;
+        anyhow::bail!(
+            "Bulk delete would affect {} entries (limit: {}). \
+             Narrow your filters or delete entries individually.",
+            rows.len(),
+            MAX_BULK_DELETE,
+        );
+    }
+
    let mut deleted = Vec::with_capacity(rows.len());
    for row in &rows {
        let entry_row: EntryRow = EntryRow {
--- a/crates/secrets-core/src/service/update.rs
+++ b/crates/secrets-core/src/service/update.rs
@@ -11,7 +11,6 @@ use crate::service::add::{
    collect_field_paths, collect_key_paths, flatten_json_fields, insert_path, parse_key_path,
    parse_kv, remove_path,
 };
-use crate::taxonomy;

 #[derive(Debug, serde::Serialize)]
 pub struct UpdateResult {
@@ -403,8 +402,8 @@ pub async fn run(
        &mut tx,
        params.user_id,
        "update",
-        "",
-        "",
+        &row.folder,
+        &row.entry_type,
        params.name,
        serde_json::json!({
            "add_tags": params.add_tags,
@@ -501,13 +500,7 @@ pub async fn update_fields_by_id(
        tracing::warn!(error = %e, "failed to snapshot entry history before web update");
    }

-    let mut metadata_map = match params.metadata {
-        Value::Object(m) => m.clone(),
-        _ => Map::new(),
-    };
-    let normalized_type =
-        taxonomy::normalize_entry_type_and_metadata(params.entry_type, &mut metadata_map);
-    let normalized_metadata = Value::Object(metadata_map);
+    let entry_type = params.entry_type.trim();

    let res = sqlx::query(
        "UPDATE entries SET folder = $1, type = $2, name = $3, notes = $4, tags = $5, metadata = $6, \
@@ -515,11 +508,11 @@ pub async fn update_fields_by_id(
         WHERE id = $7 AND version = $8",
    )
    .bind(params.folder)
-    .bind(&normalized_type)
+    .bind(entry_type)
    .bind(params.name)
    .bind(params.notes)
    .bind(params.tags)
-    .bind(&normalized_metadata)
+    .bind(params.metadata)
    .bind(row.id)
    .bind(row.version)
    .execute(&mut *tx)
@@ -546,7 +539,7 @@ pub async fn update_fields_by_id(
        Some(user_id),
        "update",
        params.folder,
-        &normalized_type,
+        entry_type,
        params.name,
        serde_json::json!({
            "source": "web",
--- a/crates/secrets-core/src/service/user.rs
+++ b/crates/secrets-core/src/service/user.rs
@@ -16,14 +16,17 @@ pub struct OAuthProfile {
 /// Find or create a user from an OAuth profile.
 /// Returns (user, is_new) where is_new indicates first-time registration.
 pub async fn find_or_create_user(pool: &PgPool, profile: OAuthProfile) -> Result<(User, bool)> {
-    // Check if this OAuth account already exists
+    // Use a transaction with FOR UPDATE to prevent TOCTOU race conditions
+    let mut tx = pool.begin().await?;
+
+    // Check if this OAuth account already exists (with row lock)
    let existing: Option<OauthAccount> = sqlx::query_as(
        "SELECT id, user_id, provider, provider_id, email, name, avatar_url, created_at \
-         FROM oauth_accounts WHERE provider = $1 AND provider_id = $2",
+         FROM oauth_accounts WHERE provider = $1 AND provider_id = $2 FOR UPDATE",
    )
    .bind(&profile.provider)
    .bind(&profile.provider_id)
-    .fetch_optional(pool)
+    .fetch_optional(&mut *tx)
    .await?;

    if let Some(oa) = existing {
@@ -32,8 +35,9 @@ pub async fn find_or_create_user(pool: &PgPool, profile: OAuthProfile) -> Result
             FROM users WHERE id = $1",
        )
        .bind(oa.user_id)
-        .fetch_one(pool)
+        .fetch_one(&mut *tx)
        .await?;
+        tx.commit().await?;
        return Ok((user, false));
    }

@@ -43,8 +47,6 @@ pub async fn find_or_create_user(pool: &PgPool, profile: OAuthProfile) -> Result
        .clone()
        .unwrap_or_else(|| profile.email.clone().unwrap_or_else(|| "User".to_string()));

-    let mut tx = pool.begin().await?;
-
    let user: User = sqlx::query_as(
        "INSERT INTO users (email, name, avatar_url) \
         VALUES ($1, $2, $3) \
@@ -125,13 +127,16 @@ pub async fn bind_oauth_account(
    user_id: Uuid,
    profile: OAuthProfile,
 ) -> Result<OauthAccount> {
-    // Check if this provider_id is already linked to someone else
+    // Use a transaction with FOR UPDATE to prevent TOCTOU race conditions
+    let mut tx = pool.begin().await?;
+
+    // Check if this provider_id is already linked to someone else (with row lock)
    let conflict: Option<(Uuid,)> = sqlx::query_as(
-        "SELECT user_id FROM oauth_accounts WHERE provider = $1 AND provider_id = $2",
+        "SELECT user_id FROM oauth_accounts WHERE provider = $1 AND provider_id = $2 FOR UPDATE",
    )
    .bind(&profile.provider)
    .bind(&profile.provider_id)
-    .fetch_optional(pool)
+    .fetch_optional(&mut *tx)
    .await?;

    if let Some((existing_user_id,)) = conflict {
@@ -148,11 +153,11 @@ pub async fn bind_oauth_account(
    }

    let existing_provider_for_user: Option<(String,)> = sqlx::query_as(
-        "SELECT provider_id FROM oauth_accounts WHERE user_id = $1 AND provider = $2",
+        "SELECT provider_id FROM oauth_accounts WHERE user_id = $1 AND provider = $2 FOR UPDATE",
    )
    .bind(user_id)
    .bind(&profile.provider)
-    .fetch_optional(pool)
+    .fetch_optional(&mut *tx)
    .await?;

    if existing_provider_for_user.is_some() {
@@ -174,9 +179,10 @@ pub async fn bind_oauth_account(
    .bind(&profile.email)
    .bind(&profile.name)
    .bind(&profile.avatar_url)
-    .fetch_one(pool)
+    .fetch_one(&mut *tx)
    .await?;

+    tx.commit().await?;
    Ok(account)
 }

--- a/crates/secrets-core/src/taxonomy.rs
+++ b/crates/secrets-core/src/taxonomy.rs
@@ -1,111 +1,4 @@
-use serde_json::{Map, Value};
-
-fn normalize_token(input: &str) -> String {
-    input.trim().to_lowercase().replace('_', "-")
-}
-
-fn normalize_subtype_token(input: &str) -> String {
-    normalize_token(input)
-}
-
-fn map_legacy_entry_type(input: &str) -> Option<(&'static str, &'static str)> {
-    match input {
-        "log-ingestion-endpoint" => Some(("service", "log-ingestion")),
-        "cloud-api" => Some(("service", "cloud-api")),
-        "git-server" => Some(("service", "git")),
-        "mqtt-broker" => Some(("service", "mqtt-broker")),
-        "database" => Some(("service", "database")),
-        "monitoring-dashboard" => Some(("service", "monitoring")),
-        "dns-api" => Some(("service", "dns-api")),
-        "notification-webhook" => Some(("service", "webhook")),
-        "api-endpoint" => Some(("service", "api-endpoint")),
-        "credential" | "credential-key" => Some(("service", "credential")),
-        "key" => Some(("service", "credential")),
-        _ => None,
-    }
-}
-
-/// Normalize entry `type` and optionally backfill `metadata.subtype` for legacy values.
-///
-/// This keeps backward compatibility:
-/// - stable primary types stay unchanged
-/// - known legacy long-tail types are mapped to `service` + `metadata.subtype`
-/// - unknown values are kept (normalized to kebab-case) instead of hard failing
-pub fn normalize_entry_type_and_metadata(
-    entry_type: &str,
-    metadata: &mut Map<String, Value>,
-) -> String {
-    let original_raw = entry_type.trim();
-    let normalized = normalize_token(original_raw);
-    if normalized.is_empty() {
-        return String::new();
-    }
-
-    if let Some((mapped_type, mapped_subtype)) = map_legacy_entry_type(&normalized) {
-        if !metadata.contains_key("subtype") {
-            metadata.insert(
-                "subtype".to_string(),
-                Value::String(mapped_subtype.to_string()),
-            );
-        }
-        if !metadata.contains_key("_original_type") && original_raw != mapped_type {
-            metadata.insert(
-                "_original_type".to_string(),
-                Value::String(original_raw.to_string()),
-            );
-        }
-        return mapped_type.to_string();
-    }
-
-    if let Some(subtype) = metadata.get_mut("subtype")
-        && let Some(s) = subtype.as_str()
-    {
-        *subtype = Value::String(normalize_subtype_token(s));
-    }
-
-    normalized
-}
-
 /// Canonical secret type options for UI dropdowns.
 pub const SECRET_TYPE_OPTIONS: &[&str] = &[
    "text", "password", "token", "api-key", "ssh-key", "url", "phone", "id-card",
 ];
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::{Map, Value};
-
-    #[test]
-    fn normalize_entry_type_maps_legacy_type_and_backfills_metadata() {
-        let mut metadata = Map::new();
-        let normalized = normalize_entry_type_and_metadata("git-server", &mut metadata);
-
-        assert_eq!(normalized, "service");
-        assert_eq!(
-            metadata.get("subtype"),
-            Some(&Value::String("git".to_string()))
-        );
-        assert_eq!(
-            metadata.get("_original_type"),
-            Some(&Value::String("git-server".to_string()))
-        );
-    }
-
-    #[test]
-    fn normalize_entry_type_normalizes_existing_subtype() {
-        let mut metadata = Map::new();
-        metadata.insert(
-            "subtype".to_string(),
-            Value::String("Cloud_API".to_string()),
-        );
-
-        let normalized = normalize_entry_type_and_metadata("service", &mut metadata);
-
-        assert_eq!(normalized, "service");
-        assert_eq!(
-            metadata.get("subtype"),
-            Some(&Value::String("cloud-api".to_string()))
-        );
-    }
-}
--- a/crates/secrets-mcp/Cargo.toml
+++ b/crates/secrets-mcp/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "secrets-mcp"
-version = "0.5.0"
+version = "0.5.5"
 edition.workspace = true

 [[bin]]
@@ -17,9 +17,10 @@ rmcp = { version = "1", features = ["server", "macros", "transport-streamable-ht
 axum = "0.8"
 axum-extra = { version = "0.10", features = ["typed-header"] }
 tower = "0.5"
-tower-http = { version = "0.6", features = ["cors", "trace"] }
+tower-http = { version = "0.6", features = ["cors", "trace", "limit"] }
 tower-sessions = "0.14"
 tower-sessions-sqlx-store-chrono = { version = "0.14", features = ["postgres"] }
+governor = { version = "0.10", features = ["std", "jitter"] }
 time = "0.3"

 # OAuth (manual token exchange via reqwest)
@@ -44,3 +45,4 @@ dotenvy.workspace = true
 urlencoding = "2"
 schemars = "1"
 http = "1"
+url = "2"
--- a/crates/secrets-mcp/src/auth.rs
+++ b/crates/secrets-mcp/src/auth.rs
@@ -1,7 +1,5 @@
-use std::net::SocketAddr;
-
 use axum::{
-    extract::{ConnectInfo, Request, State},
+    extract::{Request, State},
    http::StatusCode,
    middleware::Next,
    response::Response,
@@ -11,29 +9,14 @@ use uuid::Uuid;

 use secrets_core::service::api_key::validate_api_key;

+use crate::client_ip;
+
 /// Injected into request extensions after Bearer token validation.
 #[derive(Clone, Debug)]
 pub struct AuthUser {
    pub user_id: Uuid,
 }

-fn log_client_ip(req: &Request) -> Option<String> {
-    if let Some(first) = req
-        .headers()
-        .get("x-forwarded-for")
-        .and_then(|v| v.to_str().ok())
-        .and_then(|s| s.split(',').next())
-    {
-        let s = first.trim();
-        if !s.is_empty() {
-            return Some(s.to_string());
-        }
-    }
-    req.extensions()
-        .get::<ConnectInfo<SocketAddr>>()
-        .map(|c| c.ip().to_string())
-}
-
 /// Axum middleware that validates Bearer API keys for the /mcp route.
 /// Passes all non-MCP paths through without authentication.
 pub async fn bearer_auth_middleware(
@@ -43,7 +26,7 @@ pub async fn bearer_auth_middleware(
 ) -> Result<Response, StatusCode> {
    let path = req.uri().path();
    let method = req.method().as_str();
-    let client_ip = log_client_ip(&req);
+    let client_ip = client_ip::extract_client_ip(&req);

    // Only authenticate /mcp paths
    if !path.starts_with("/mcp") {
@@ -66,7 +49,7 @@ pub async fn bearer_auth_middleware(
            tracing::warn!(
                method,
                path,
-                client_ip = client_ip.as_deref(),
+                %client_ip,
                "invalid Authorization header format on /mcp (expected Bearer …)"
            );
            return Err(StatusCode::UNAUTHORIZED);
@@ -75,7 +58,7 @@ pub async fn bearer_auth_middleware(
            tracing::warn!(
                method,
                path,
-                client_ip = client_ip.as_deref(),
+                %client_ip,
                "missing Authorization header on /mcp"
            );
            return Err(StatusCode::UNAUTHORIZED);
@@ -93,7 +76,7 @@ pub async fn bearer_auth_middleware(
            tracing::warn!(
                method,
                path,
-                client_ip = client_ip.as_deref(),
+                %client_ip,
                key_prefix = %&raw_key.chars().take(12).collect::<String>(),
                key_len = raw_key.len(),
                "invalid api key (not found in database — e.g. revoked key or DB was reset; update MCP client Bearer token)"
@@ -104,7 +87,7 @@ pub async fn bearer_auth_middleware(
            tracing::error!(
                method,
                path,
-                client_ip = client_ip.as_deref(),
+                %client_ip,
                error = %e,
                "api key validation error"
            );
--- a/crates/secrets-mcp/src/client_ip.rs
+++ b/crates/secrets-mcp/src/client_ip.rs
@@ -0,0 +1,65 @@
+use axum::extract::Request;
+use std::net::{IpAddr, SocketAddr};
+
+/// Extract the client IP from a request.
+///
+/// When the `TRUST_PROXY` environment variable is set to `1` or `true`, the
+/// `X-Forwarded-For` and `X-Real-IP` headers are consulted first, which is
+/// appropriate when the service runs behind a trusted reverse proxy (e.g.
+/// Caddy). Otherwise — or if those headers are absent/empty — the direct TCP
+/// connection address from `ConnectInfo` is used.
+///
+/// **Important**: only enable `TRUST_PROXY` when the application is guaranteed
+/// to receive traffic exclusively through a controlled reverse proxy. Enabling
+/// it on a directly-exposed port allows clients to spoof their IP address and
+/// bypass per-IP rate limiting.
+pub fn extract_client_ip(req: &Request) -> String {
+    if trust_proxy_enabled() {
+        if let Some(ip) = forwarded_for_ip(req.headers()) {
+            return ip;
+        }
+        if let Some(ip) = real_ip(req.headers()) {
+            return ip;
+        }
+    }
+
+    connect_info_ip(req).unwrap_or_else(|| "unknown".to_string())
+}
+
+fn trust_proxy_enabled() -> bool {
+    static CACHE: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+    *CACHE.get_or_init(|| {
+        matches!(
+            std::env::var("TRUST_PROXY").as_deref(),
+            Ok("1") | Ok("true") | Ok("yes")
+        )
+    })
+}
+
+fn forwarded_for_ip(headers: &axum::http::HeaderMap) -> Option<String> {
+    let value = headers.get("x-forwarded-for")?.to_str().ok()?;
+    let first = value.split(',').next()?.trim();
+    if first.is_empty() {
+        None
+    } else {
+        validate_ip(first)
+    }
+}
+
+fn real_ip(headers: &axum::http::HeaderMap) -> Option<String> {
+    let value = headers.get("x-real-ip")?.to_str().ok()?;
+    let ip = value.trim();
+    if ip.is_empty() { None } else { validate_ip(ip) }
+}
+
+/// Validate that a string is a valid IP address.
+/// Returns Some(ip) if valid, None otherwise.
+fn validate_ip(s: &str) -> Option<String> {
+    s.parse::<IpAddr>().ok().map(|ip| ip.to_string())
+}
+
+fn connect_info_ip(req: &Request) -> Option<String> {
+    req.extensions()
+        .get::<axum::extract::ConnectInfo<SocketAddr>>()
+        .map(|c| c.0.ip().to_string())
+}
--- a/crates/secrets-mcp/src/error.rs
+++ b/crates/secrets-mcp/src/error.rs
@@ -23,6 +23,16 @@ pub fn app_error_to_mcp(err: &AppError) -> rmcp::ErrorData {
            "Entry not found. Use secrets_find to discover existing entries.",
            None,
        ),
+        AppError::NotFoundUser => rmcp::ErrorData::invalid_request("User not found.", None),
+        AppError::NotFoundSecret => rmcp::ErrorData::invalid_request("Secret not found.", None),
+        AppError::AuthenticationFailed => rmcp::ErrorData::invalid_request(
+            "Authentication failed. Please check your API key or login credentials.",
+            None,
+        ),
+        AppError::Unauthorized => rmcp::ErrorData::invalid_request(
+            "Unauthorized: you do not have permission to access this resource.",
+            None,
+        ),
        AppError::Validation { message } => rmcp::ErrorData::invalid_request(message.clone(), None),
        AppError::ConcurrentModification => rmcp::ErrorData::invalid_request(
            "The entry was modified by another request. Please refresh and try again.",
@@ -32,6 +42,10 @@ pub fn app_error_to_mcp(err: &AppError) -> rmcp::ErrorData {
            "Decryption failed — the encryption key may be incorrect or does not match the data.",
            None,
        ),
+        AppError::EncryptionKeyNotSet => rmcp::ErrorData::invalid_request(
+            "Encryption key not set. You must set a passphrase before using this feature.",
+            None,
+        ),
        AppError::Internal(_) => rmcp::ErrorData::internal_error(
            "Request failed due to a server error. Check service logs if you need details.",
            None,
--- a/crates/secrets-mcp/src/main.rs
+++ b/crates/secrets-mcp/src/main.rs
@@ -1,8 +1,11 @@
 mod auth;
+mod client_ip;
 mod error;
 mod logging;
 mod oauth;
+mod rate_limit;
 mod tools;
+mod validation;
 mod web;

 use std::net::SocketAddr;
@@ -153,10 +156,20 @@ async fn main() -> Result<()> {
    );

    // ── Router ────────────────────────────────────────────────────────────────
-    let cors = CorsLayer::new()
-        .allow_origin(Any)
-        .allow_methods(Any)
-        .allow_headers(Any);
+    // CORS: restrict origins in production, allow all in development
+    let is_production = matches!(
+        load_env_var("SECRETS_ENV")
+            .as_deref()
+            .map(|s| s.to_ascii_lowercase())
+            .as_deref(),
+        Some("prod" | "production")
+    );
+
+    let cors = build_cors_layer(&base_url, is_production);
+
+    // Rate limiting
+    let rate_limit_state = rate_limit::RateLimitState::new();
+    let rate_limit_cleanup = rate_limit::spawn_cleanup_task(rate_limit_state.ip_limiter.clone());

    let router = Router::new()
        .merge(web::web_router())
@@ -168,6 +181,10 @@ async fn main() -> Result<()> {
            pool,
            auth::bearer_auth_middleware,
        ))
+        .layer(axum::middleware::from_fn_with_state(
+            rate_limit_state.clone(),
+            rate_limit::rate_limit_middleware,
+        ))
        .layer(session_layer)
        .layer(cors)
        .with_state(app_state);
@@ -192,12 +209,135 @@ async fn main() -> Result<()> {
    .context("server error")?;

    session_cleanup.abort();
+    rate_limit_cleanup.abort();
    Ok(())
 }

 async fn shutdown_signal() {
-    tokio::signal::ctrl_c()
-        .await
-        .expect("failed to install CTRL+C signal handler");
+    let ctrl_c = tokio::signal::ctrl_c();
+
+    #[cfg(unix)]
+    let terminate = async {
+        tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
+            .expect("failed to install SIGTERM handler")
+            .recv()
+            .await;
+    };
+
+    #[cfg(not(unix))]
+    let terminate = std::future::pending::<()>();
+
+    tokio::select! {
+        _ = ctrl_c => {},
+        _ = terminate => {},
+    }
+
    tracing::info!("Shutting down gracefully...");
 }
+
+/// Production CORS allowed headers.
+///
+/// When adding a new custom header to the MCP or Web API, this list must be
+/// updated accordingly — otherwise browsers will block the request during
+/// the CORS preflight check.
+fn production_allowed_headers() -> [axum::http::HeaderName; 5] {
+    [
+        axum::http::header::AUTHORIZATION,
+        axum::http::header::CONTENT_TYPE,
+        axum::http::HeaderName::from_static("x-encryption-key"),
+        axum::http::HeaderName::from_static("mcp-session-id"),
+        axum::http::HeaderName::from_static("x-mcp-session"),
+    ]
+}
+
+/// Production CORS allowed methods.
+///
+/// Keep this list explicit because tower-http rejects
+/// `allow_credentials(true)` together with `allow_methods(Any)`.
+fn production_allowed_methods() -> [axum::http::Method; 5] {
+    [
+        axum::http::Method::GET,
+        axum::http::Method::POST,
+        axum::http::Method::PATCH,
+        axum::http::Method::DELETE,
+        axum::http::Method::OPTIONS,
+    ]
+}
+
+/// Build the CORS layer for the application.
+///
+/// In production mode the origin is restricted to the BASE_URL origin
+/// (scheme://host:port, path stripped) and credentials are allowed.
+/// `allow_headers` and `allow_methods` use explicit whitelists to avoid the
+/// tower-http restriction on `allow_credentials(true)` + wildcards.
+///
+/// In development mode all origins, methods and headers are allowed.
+fn build_cors_layer(base_url: &str, is_production: bool) -> CorsLayer {
+    if is_production {
+        let allowed_origin = if let Ok(parsed) = base_url.parse::<url::Url>() {
+            let origin = parsed.origin().ascii_serialization();
+            origin
+                .parse::<axum::http::HeaderValue>()
+                .unwrap_or_else(|_| panic!("invalid BASE_URL origin: {}", origin))
+        } else {
+            base_url
+                .parse::<axum::http::HeaderValue>()
+                .unwrap_or_else(|_| panic!("invalid BASE_URL: {}", base_url))
+        };
+        CorsLayer::new()
+            .allow_origin(allowed_origin)
+            .allow_methods(production_allowed_methods())
+            .allow_headers(production_allowed_headers())
+            .allow_credentials(true)
+    } else {
+        CorsLayer::new()
+            .allow_origin(Any)
+            .allow_methods(Any)
+            .allow_headers(Any)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn production_cors_does_not_panic() {
+        let layer = build_cors_layer("https://secrets.example.com/app", true);
+        let _ = layer;
+    }
+
+    #[test]
+    fn production_cors_headers_include_all_required() {
+        let headers = production_allowed_headers();
+        let names: Vec<&str> = headers.iter().map(|h| h.as_str()).collect();
+        assert!(names.contains(&"authorization"));
+        assert!(names.contains(&"content-type"));
+        assert!(names.contains(&"x-encryption-key"));
+        assert!(names.contains(&"mcp-session-id"));
+        assert!(names.contains(&"x-mcp-session"));
+    }
+
+    #[test]
+    fn production_cors_methods_include_all_required() {
+        let methods = production_allowed_methods();
+        assert!(methods.contains(&axum::http::Method::GET));
+        assert!(methods.contains(&axum::http::Method::POST));
+        assert!(methods.contains(&axum::http::Method::PATCH));
+        assert!(methods.contains(&axum::http::Method::DELETE));
+        assert!(methods.contains(&axum::http::Method::OPTIONS));
+    }
+
+    #[test]
+    fn production_cors_normalizes_base_url_with_path() {
+        let url = url::Url::parse("https://secrets.example.com/secrets/app").unwrap();
+        let origin = url.origin().ascii_serialization();
+        assert_eq!(origin, "https://secrets.example.com");
+    }
+
+    #[test]
+    fn development_cors_allows_everything() {
+        let layer = build_cors_layer("http://localhost:9315", false);
+        let _ = layer;
+    }
+}
--- a/crates/secrets-mcp/src/rate_limit.rs
+++ b/crates/secrets-mcp/src/rate_limit.rs
@@ -0,0 +1,160 @@
+use std::num::NonZeroU32;
+use std::sync::Arc;
+use std::time::Duration;
+
+use axum::{
+    extract::{Request, State},
+    http::{HeaderMap, HeaderValue, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use governor::{
+    Quota, RateLimiter,
+    clock::{Clock, DefaultClock},
+    state::{InMemoryState, NotKeyed, keyed::DashMapStateStore},
+};
+use serde_json::json;
+
+use crate::client_ip;
+
+/// Per-IP rate limiter (keyed by client IP string)
+type IpRateLimiter = RateLimiter<String, DashMapStateStore<String>, DefaultClock>;
+
+/// Global rate limiter (not keyed)
+type GlobalRateLimiter = RateLimiter<NotKeyed, InMemoryState, DefaultClock>;
+
+/// Parse a u32 env value into NonZeroU32, logging a warning and falling back
+/// to the default if the value is zero.
+fn nz_or_log(value: u32, default: u32, name: &str) -> NonZeroU32 {
+    NonZeroU32::new(value).unwrap_or_else(|| {
+        tracing::warn!(
+            configured = value,
+            default,
+            "{name} must be non-zero, using default"
+        );
+        NonZeroU32::new(default).unwrap()
+    })
+}
+
+#[derive(Clone)]
+pub struct RateLimitState {
+    pub ip_limiter: Arc<IpRateLimiter>,
+    pub global_limiter: Arc<GlobalRateLimiter>,
+}
+
+impl RateLimitState {
+    /// Create a new RateLimitState with default limits.
+    ///
+    /// Default limits (can be overridden via environment variables):
+    /// - Global: 100 req/s, burst 200
+    /// - Per-IP: 20 req/s, burst 40
+    pub fn new() -> Self {
+        let global_rate = std::env::var("RATE_LIMIT_GLOBAL_PER_SECOND")
+            .ok()
+            .and_then(|v| v.parse::<u32>().ok())
+            .unwrap_or(100);
+
+        let global_burst = std::env::var("RATE_LIMIT_GLOBAL_BURST")
+            .ok()
+            .and_then(|v| v.parse::<u32>().ok())
+            .unwrap_or(200);
+
+        let ip_rate = std::env::var("RATE_LIMIT_IP_PER_SECOND")
+            .ok()
+            .and_then(|v| v.parse::<u32>().ok())
+            .unwrap_or(20);
+
+        let ip_burst = std::env::var("RATE_LIMIT_IP_BURST")
+            .ok()
+            .and_then(|v| v.parse::<u32>().ok())
+            .unwrap_or(40);
+
+        let global_rate_nz = nz_or_log(global_rate, 100, "RATE_LIMIT_GLOBAL_PER_SECOND");
+        let global_burst_nz = nz_or_log(global_burst, 200, "RATE_LIMIT_GLOBAL_BURST");
+        let ip_rate_nz = nz_or_log(ip_rate, 20, "RATE_LIMIT_IP_PER_SECOND");
+        let ip_burst_nz = nz_or_log(ip_burst, 40, "RATE_LIMIT_IP_BURST");
+
+        let global_quota = Quota::per_second(global_rate_nz).allow_burst(global_burst_nz);
+        let ip_quota = Quota::per_second(ip_rate_nz).allow_burst(ip_burst_nz);
+
+        tracing::info!(
+            global_rate = global_rate_nz.get(),
+            global_burst = global_burst_nz.get(),
+            ip_rate = ip_rate_nz.get(),
+            ip_burst = ip_burst_nz.get(),
+            "rate limiter initialized"
+        );
+
+        Self {
+            global_limiter: Arc::new(RateLimiter::direct(global_quota)),
+            ip_limiter: Arc::new(RateLimiter::dashmap(ip_quota)),
+        }
+    }
+}
+
+/// Rate limiting middleware function.
+///
+/// Checks both global and per-IP rate limits before allowing the request through.
+/// Returns 429 Too Many Requests if either limit is exceeded.
+pub async fn rate_limit_middleware(
+    State(rl): State<RateLimitState>,
+    req: Request,
+    next: Next,
+) -> Result<Response, Response> {
+    // Check global rate limit first
+    if let Err(negative) = rl.global_limiter.check() {
+        let retry_after = negative.wait_time_from(DefaultClock::default().now());
+        tracing::warn!(
+            retry_after_secs = retry_after.as_secs(),
+            "global rate limit exceeded"
+        );
+        return Err(too_many_requests_response(Some(retry_after)));
+    }
+
+    // Check per-IP rate limit
+    let key = client_ip::extract_client_ip(&req);
+    if let Err(negative) = rl.ip_limiter.check_key(&key) {
+        let retry_after = negative.wait_time_from(DefaultClock::default().now());
+        tracing::warn!(
+            client_ip = %key,
+            retry_after_secs = retry_after.as_secs(),
+            "per-IP rate limit exceeded"
+        );
+        return Err(too_many_requests_response(Some(retry_after)));
+    }
+
+    Ok(next.run(req).await)
+}
+
+/// Start a background task to clean up expired rate limiter entries.
+///
+/// This should be called once during application startup.
+/// The task runs every 60 seconds and will be aborted on shutdown.
+pub fn spawn_cleanup_task(ip_limiter: Arc<IpRateLimiter>) -> tokio::task::JoinHandle<()> {
+    tokio::spawn(async move {
+        let mut interval = tokio::time::interval(Duration::from_secs(60));
+        loop {
+            interval.tick().await;
+            ip_limiter.retain_recent();
+        }
+    })
+}
+
+/// Create a 429 Too Many Requests response.
+fn too_many_requests_response(retry_after: Option<Duration>) -> Response {
+    let mut headers = HeaderMap::new();
+    headers.insert("Content-Type", HeaderValue::from_static("application/json"));
+
+    if let Some(duration) = retry_after {
+        let secs = duration.as_secs().max(1);
+        if let Ok(value) = HeaderValue::from_str(&secs.to_string()) {
+            headers.insert("Retry-After", value);
+        }
+    }
+
+    let body = json!({
+        "error": "Too many requests, please try again later"
+    });
+
+    (StatusCode::TOO_MANY_REQUESTS, headers, body.to_string()).into_response()
+}
--- a/crates/secrets-mcp/src/tools.rs
+++ b/crates/secrets-mcp/src/tools.rs
@@ -18,6 +18,8 @@ use serde_json::{Map, Value};
 use sqlx::PgPool;
 use uuid::Uuid;

+use crate::validation;
+
 // ── Serde helpers for numeric parameters that may arrive as strings ──────────

 mod deser {
@@ -70,6 +72,94 @@ mod deser {
            }
        }
    }
+
+    /// Deserialize a bool that may come as a JSON bool or a JSON string ("true"/"false").
+    pub fn option_bool_from_string<'de, D>(deserializer: D) -> Result<Option<bool>, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum BoolOrStr {
+            Bool(bool),
+            Str(String),
+        }
+
+        match Option::<BoolOrStr>::deserialize(deserializer)? {
+            None => Ok(None),
+            Some(BoolOrStr::Bool(b)) => Ok(Some(b)),
+            Some(BoolOrStr::Str(s)) => {
+                if s.is_empty() {
+                    return Ok(None);
+                }
+                s.parse::<bool>().map(Some).map_err(de::Error::custom)
+            }
+        }
+    }
+
+    /// Deserialize a Vec<String> that may come as a JSON array or a JSON string containing an array.
+    pub fn option_vec_string_from_string<'de, D>(
+        deserializer: D,
+    ) -> Result<Option<Vec<String>>, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum VecOrStr {
+            Vec(Vec<String>),
+            Str(String),
+        }
+
+        match Option::<VecOrStr>::deserialize(deserializer)? {
+            None => Ok(None),
+            Some(VecOrStr::Vec(v)) => Ok(Some(v)),
+            Some(VecOrStr::Str(s)) => {
+                if s.is_empty() {
+                    return Ok(None);
+                }
+                serde_json::from_str(&s)
+                    .map(Some)
+                    .map_err(|e| {
+                        de::Error::custom(format!(
+                            "invalid string value for array field: expected a JSON array, e.g. '[\"a\",\"b\"]': {e}"
+                        ))
+                    })
+            }
+        }
+    }
+
+    /// Deserialize a Map<String, Value> that may come as a JSON object or a JSON string containing an object.
+    pub fn option_map_from_string<'de, D>(
+        deserializer: D,
+    ) -> Result<Option<Map<String, Value>>, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum MapOrStr {
+            Map(Map<String, Value>),
+            Str(String),
+        }
+
+        match Option::<MapOrStr>::deserialize(deserializer)? {
+            None => Ok(None),
+            Some(MapOrStr::Map(m)) => Ok(Some(m)),
+            Some(MapOrStr::Str(s)) => {
+                if s.is_empty() {
+                    return Ok(None);
+                }
+                serde_json::from_str(&s)
+                    .map(Some)
+                    .map_err(|e| {
+                        de::Error::custom(format!(
+                            "invalid string value for object field: expected a JSON object, e.g. '{{\"key\":\"value\"}}': {e}"
+                        ))
+                    })
+            }
+        }
+    }
 }

 use secrets_core::models::ExportFormat;
@@ -229,7 +319,7 @@ struct FindInput {
    #[schemars(description = "Exact folder filter (e.g. 'refining', 'ricnsmart')")]
    folder: Option<String>,
    #[schemars(
-        description = "Exact type filter (recommended: 'server', 'service', 'person', 'document')"
+        description = "Exact type filter (e.g. 'server', 'service', 'account', 'person', 'document'). User-defined, any value accepted."
    )]
    #[serde(rename = "type")]
    entry_type: Option<String>,
@@ -240,10 +330,14 @@ struct FindInput {
    )]
    name_query: Option<String>,
    #[schemars(description = "Tag filters (all must match)")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    tags: Option<Vec<String>>,
    #[schemars(description = "Max results (default 20)")]
    #[serde(default, deserialize_with = "deser::option_u32_from_string")]
    limit: Option<u32>,
+    #[schemars(description = "Offset for pagination (default 0)")]
+    #[serde(default, deserialize_with = "deser::option_u32_from_string")]
+    offset: Option<u32>,
 }

 #[derive(Debug, Deserialize, JsonSchema)]
@@ -253,7 +347,7 @@ struct SearchInput {
    #[schemars(description = "Folder filter (e.g. 'refining', 'personal', 'family')")]
    folder: Option<String>,
    #[schemars(
-        description = "Type filter (recommended: 'server', 'service', 'person', 'document')"
+        description = "Type filter (e.g. 'server', 'service', 'account', 'person', 'document'). User-defined, any value accepted."
    )]
    #[serde(rename = "type")]
    entry_type: Option<String>,
@@ -264,8 +358,10 @@ struct SearchInput {
    )]
    name_query: Option<String>,
    #[schemars(description = "Tag filters (all must match)")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    tags: Option<Vec<String>>,
    #[schemars(description = "Return only summary fields (name/tags/notes/updated_at)")]
+    #[serde(default, deserialize_with = "deser::option_bool_from_string")]
    summary: Option<bool>,
    #[schemars(description = "Sort order: 'name' (default), 'updated', 'created'")]
    sort: Option<String>,
@@ -292,35 +388,42 @@ struct AddInput {
    #[schemars(description = "Folder for organization (optional, e.g. 'personal', 'refining')")]
    folder: Option<String>,
    #[schemars(
-        description = "Type/category of this entry (optional, recommended: 'server', 'service', 'person', 'document')"
+        description = "Type/category of this entry (optional, e.g. 'server', 'service', 'account', 'person', 'document'). Free-form, choose what best describes the entry."
    )]
    #[serde(rename = "type")]
    entry_type: Option<String>,
    #[schemars(description = "Free-text notes for this entry (optional)")]
    notes: Option<String>,
    #[schemars(description = "Tags for this entry")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    tags: Option<Vec<String>>,
    #[schemars(description = "Metadata fields as 'key=value' or 'key:=json' strings")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    meta: Option<Vec<String>>,
    #[schemars(
        description = "Metadata fields as a JSON object {\"key\": value}. Merged with 'meta' if both provided."
    )]
+    #[serde(default, deserialize_with = "deser::option_map_from_string")]
    meta_obj: Option<Map<String, Value>>,
    #[schemars(
        description = "Secret fields as 'key=value' strings. Reminder: non-sensitive endpoint/address fields should go to metadata.address instead of secrets."
    )]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    secrets: Option<Vec<String>>,
    #[schemars(
        description = "Secret fields as a JSON object {\"key\": \"value\"}. Merged with 'secrets' if both provided. Reminder: non-sensitive endpoint/address fields should go to metadata.address."
    )]
+    #[serde(default, deserialize_with = "deser::option_map_from_string")]
    secrets_obj: Option<Map<String, Value>>,
    #[schemars(
        description = "Secret types as {\"secret_name\": \"type\"}. Keys must match secret field names. Missing keys default to \"text\"."
    )]
+    #[serde(default, deserialize_with = "deser::option_map_from_string")]
    secret_types: Option<Map<String, Value>>,
    #[schemars(
        description = "Link existing secrets by secret name. Names must resolve uniquely under current user."
    )]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    link_secret_names: Option<Vec<String>>,
 }

@@ -339,38 +442,49 @@ struct UpdateInput {
    #[schemars(description = "Update the notes field")]
    notes: Option<String>,
    #[schemars(description = "Tags to add")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    add_tags: Option<Vec<String>>,
    #[schemars(description = "Tags to remove")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    remove_tags: Option<Vec<String>>,
    #[schemars(description = "Metadata fields to update/add as 'key=value' strings")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    meta: Option<Vec<String>>,
    #[schemars(
        description = "Metadata fields to update/add as a JSON object {\"key\": value}. Merged with 'meta' if both provided."
    )]
+    #[serde(default, deserialize_with = "deser::option_map_from_string")]
    meta_obj: Option<Map<String, Value>>,
    #[schemars(description = "Metadata field keys to remove")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    remove_meta: Option<Vec<String>>,
    #[schemars(
        description = "Secret fields to update/add as 'key=value' strings. Reminder: non-sensitive endpoint/address fields should go to metadata.address instead of secrets."
    )]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    secrets: Option<Vec<String>>,
    #[schemars(
        description = "Secret fields to update/add as a JSON object {\"key\": \"value\"}. Merged with 'secrets' if both provided. Reminder: non-sensitive endpoint/address fields should go to metadata.address."
    )]
+    #[serde(default, deserialize_with = "deser::option_map_from_string")]
    secrets_obj: Option<Map<String, Value>>,
    #[schemars(
        description = "Secret types as {\"secret_name\": \"type\"}. Keys must match secret field names. Missing keys default to \"text\"."
    )]
+    #[serde(default, deserialize_with = "deser::option_map_from_string")]
    secret_types: Option<Map<String, Value>>,
    #[schemars(description = "Secret field keys to remove")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    remove_secrets: Option<Vec<String>>,
    #[schemars(
        description = "Link existing secrets by name to this entry. Names must resolve uniquely under current user."
    )]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    link_secret_names: Option<Vec<String>>,
    #[schemars(
        description = "Unlink secrets by name from this entry. Orphaned secrets are auto-deleted."
    )]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    unlink_secret_names: Option<Vec<String>>,
 }

@@ -390,6 +504,7 @@ struct DeleteInput {
    #[serde(rename = "type")]
    entry_type: Option<String>,
    #[schemars(description = "Preview deletions without writing")]
+    #[serde(default, deserialize_with = "deser::option_bool_from_string")]
    dry_run: Option<bool>,
 }

@@ -437,6 +552,7 @@ struct ExportInput {
    #[schemars(description = "Exact name filter")]
    name: Option<String>,
    #[schemars(description = "Tag filters")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    tags: Option<Vec<String>>,
    #[schemars(description = "Fuzzy query")]
    query: Option<String>,
@@ -454,8 +570,10 @@ struct EnvMapInput {
    #[schemars(description = "Exact name filter")]
    name: Option<String>,
    #[schemars(description = "Tag filters")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    tags: Option<Vec<String>>,
    #[schemars(description = "Only include these secret fields")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
    only_fields: Option<Vec<String>>,
    #[schemars(description = "Environment variable name prefix. \
        Variable names are built as UPPER(prefix)_UPPER(entry_name)_UPPER(field_name), \
@@ -480,6 +598,50 @@ fn map_to_kv_strings(map: Map<String, Value>) -> Vec<String> {
        .collect()
 }

+/// Check if any KV string would trigger a server-side file read.
+///
+/// `parse_kv` in secrets-core supports two file-read syntaxes:
+///   - `key=@path`  (has `=`, value starts with `@`)
+///   - `key@path`   (no `=`, split on `@`)
+///
+/// Both are legitimate for CLI usage but must be rejected in the MCP context
+/// where the server process runs remotely and the caller controls the path.
+///
+/// Note: `key:=json` is intentionally skipped here. Although the value may
+/// contain `@` characters (e.g. `config:=@/etc/passwd`), the `:=` branch in
+/// `parse_kv` treats the right-hand side as raw JSON and never performs file
+/// reads. The `@` in such cases is just data, not a file reference.
+///
+/// For entries without `=` that contain `@`, we only reject them if the `@`
+/// appears to be file-path syntax (i.e., the part after `@` starts with `/`,
+/// `~`, or `.`). This avoids false positives on values like `user@example.com`.
+fn contains_file_reference(entries: &[String]) -> Option<String> {
+    for entry in entries {
+        // key:=json — safe, skip before checking for `=`
+        if entry.contains(":=") {
+            continue;
+        }
+        // key=@path
+        if let Some((_, value)) = entry.split_once('=') {
+            if value.starts_with('@') {
+                return Some(entry.clone());
+            }
+            continue;
+        }
+        // key@path (no `=` present)
+        // Only reject if the `@` looks like file-path syntax: the segment after
+        // `@` starts with `/`, `~`, or `.`, which are common path prefixes.
+        // Values like "user@example.com" pass through safely.
+        if let Some((_, path_part)) = entry.split_once('@') {
+            let trimmed = path_part.trim_start();
+            if trimmed.starts_with('/') || trimmed.starts_with('~') || trimmed.starts_with('.') {
+                return Some(entry.clone());
+            }
+        }
+    }
+    None
+}
+
 /// Parse a UUID string, returning an MCP error on failure.
 fn parse_uuid(s: &str) -> Result<Uuid, rmcp::ErrorData> {
    s.parse::<Uuid>()
@@ -527,13 +689,33 @@ impl SecretsService {
                query: input.query.as_deref(),
                sort: "name",
                limit: input.limit.unwrap_or(20),
-                offset: 0,
+                offset: input.offset.unwrap_or(0),
                user_id: Some(user_id),
            },
        )
        .await
        .map_err(|e| mcp_err_internal_logged("secrets_find", Some(user_id), e))?;

+        let count_params = SearchParams {
+            folder: input.folder.as_deref(),
+            entry_type: input.entry_type.as_deref(),
+            name: input.name.as_deref(),
+            name_query: input.name_query.as_deref(),
+            tags: &tags,
+            query: input.query.as_deref(),
+            sort: "name",
+            limit: 0,
+            offset: 0,
+            user_id: Some(user_id),
+        };
+
+        let total_count = secrets_core::service::search::count_entries(&self.pool, &count_params)
+            .await
+            .inspect_err(
+                |e| tracing::warn!(tool = "secrets_find", error = %e, "count_entries failed"),
+            )
+            .unwrap_or(0);
+
        let entries: Vec<serde_json::Value> = result
            .entries
            .iter()
@@ -566,14 +748,20 @@ impl SecretsService {
            })
            .collect();

+        let output = serde_json::json!({
+            "total_count": total_count,
+            "entries": entries,
+        });
+
        tracing::info!(
            tool = "secrets_find",
            ?user_id,
            result_count = entries.len(),
+            total_count,
            elapsed_ms = t.elapsed().as_millis(),
            "tool call ok",
        );
-        let json = serde_json::to_string_pretty(&entries).unwrap_or_else(|_| "[]".to_string());
+        let json = serde_json::to_string_pretty(&output).unwrap_or_else(|_| "{}".to_string());
        Ok(CallToolResult::success(vec![Content::text(json)]))
    }

@@ -766,10 +954,33 @@ impl SecretsService {
        if let Some(obj) = input.meta_obj {
            meta.extend(map_to_kv_strings(obj));
        }
+        if let Some(offending) = contains_file_reference(&meta) {
+            return Err(rmcp::ErrorData::invalid_params(
+                format!("@file syntax is not allowed in MCP tools: '{}'", offending),
+                None,
+            ));
+        }
        let mut secrets = input.secrets.unwrap_or_default();
        if let Some(obj) = input.secrets_obj {
            secrets.extend(map_to_kv_strings(obj));
        }
+        if let Some(offending) = contains_file_reference(&secrets) {
+            return Err(rmcp::ErrorData::invalid_params(
+                format!("@file syntax is not allowed in MCP tools: '{}'", offending),
+                None,
+            ));
+        }
+
+        // Input length validation
+        validation::validate_input_lengths(
+            &input.name,
+            input.folder.as_deref(),
+            input.entry_type.as_deref(),
+            input.notes.as_deref(),
+        )?;
+        validation::validate_tags(&tags)?;
+        validation::validate_meta_entries(&meta)?;
+
        let secret_types = input.secret_types.unwrap_or_default();
        let secret_types_map: std::collections::HashMap<String, String> = secret_types
            .into_iter()
@@ -849,11 +1060,34 @@ impl SecretsService {
        if let Some(obj) = input.meta_obj {
            meta.extend(map_to_kv_strings(obj));
        }
+        if let Some(offending) = contains_file_reference(&meta) {
+            return Err(rmcp::ErrorData::invalid_params(
+                format!("@file syntax is not allowed in MCP tools: '{}'", offending),
+                None,
+            ));
+        }
        let remove_meta = input.remove_meta.unwrap_or_default();
        let mut secrets = input.secrets.unwrap_or_default();
        if let Some(obj) = input.secrets_obj {
            secrets.extend(map_to_kv_strings(obj));
        }
+        if let Some(offending) = contains_file_reference(&secrets) {
+            return Err(rmcp::ErrorData::invalid_params(
+                format!("@file syntax is not allowed in MCP tools: '{}'", offending),
+                None,
+            ));
+        }
+
+        // Input length validation
+        validation::validate_input_lengths(
+            &input.name,
+            input.folder.as_deref(),
+            None,
+            input.notes.as_deref(),
+        )?;
+        validation::validate_tags(&add_tags)?;
+        validation::validate_meta_entries(&meta)?;
+
        let secret_types = input.secret_types.unwrap_or_default();
        let secret_types_map: std::collections::HashMap<String, String> = secret_types
            .into_iter()
@@ -1286,3 +1520,202 @@ impl ServerHandler for SecretsService {
        info
    }
 }
+
+#[cfg(test)]
+mod deser_tests {
+    use super::deser;
+    use serde::Deserialize;
+    use serde_json::json;
+
+    #[derive(Deserialize)]
+    struct TestU32 {
+        #[serde(deserialize_with = "deser::option_u32_from_string")]
+        val: Option<u32>,
+    }
+
+    #[derive(Deserialize)]
+    struct TestI64 {
+        #[serde(deserialize_with = "deser::option_i64_from_string")]
+        val: Option<i64>,
+    }
+
+    #[derive(Deserialize)]
+    struct TestBool {
+        #[serde(deserialize_with = "deser::option_bool_from_string")]
+        val: Option<bool>,
+    }
+
+    #[derive(Debug, Deserialize)]
+    struct TestVec {
+        #[serde(deserialize_with = "deser::option_vec_string_from_string")]
+        val: Option<Vec<String>>,
+    }
+
+    #[derive(Debug, Deserialize)]
+    struct TestMap {
+        #[serde(deserialize_with = "deser::option_map_from_string")]
+        val: Option<serde_json::Map<String, serde_json::Value>>,
+    }
+
+    // option_u32_from_string
+    #[test]
+    fn u32_native_number() {
+        let v: TestU32 = serde_json::from_value(json!({"val": 42})).unwrap();
+        assert_eq!(v.val, Some(42));
+    }
+
+    #[test]
+    fn u32_string_number() {
+        let v: TestU32 = serde_json::from_value(json!({"val": "42"})).unwrap();
+        assert_eq!(v.val, Some(42));
+    }
+
+    #[test]
+    fn u32_empty_string() {
+        let v: TestU32 = serde_json::from_value(json!({"val": ""})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn u32_none() {
+        let v: TestU32 = serde_json::from_value(json!({"val": null})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    // option_i64_from_string
+    #[test]
+    fn i64_native_number() {
+        let v: TestI64 = serde_json::from_value(json!({"val": -100})).unwrap();
+        assert_eq!(v.val, Some(-100));
+    }
+
+    #[test]
+    fn i64_string_number() {
+        let v: TestI64 = serde_json::from_value(json!({"val": "999"})).unwrap();
+        assert_eq!(v.val, Some(999));
+    }
+
+    #[test]
+    fn i64_empty_string() {
+        let v: TestI64 = serde_json::from_value(json!({"val": ""})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn i64_none() {
+        let v: TestI64 = serde_json::from_value(json!({"val": null})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    // option_bool_from_string
+    #[test]
+    fn bool_native_true() {
+        let v: TestBool = serde_json::from_value(json!({"val": true})).unwrap();
+        assert_eq!(v.val, Some(true));
+    }
+
+    #[test]
+    fn bool_native_false() {
+        let v: TestBool = serde_json::from_value(json!({"val": false})).unwrap();
+        assert_eq!(v.val, Some(false));
+    }
+
+    #[test]
+    fn bool_string_true() {
+        let v: TestBool = serde_json::from_value(json!({"val": "true"})).unwrap();
+        assert_eq!(v.val, Some(true));
+    }
+
+    #[test]
+    fn bool_string_false() {
+        let v: TestBool = serde_json::from_value(json!({"val": "false"})).unwrap();
+        assert_eq!(v.val, Some(false));
+    }
+
+    #[test]
+    fn bool_empty_string() {
+        let v: TestBool = serde_json::from_value(json!({"val": ""})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn bool_none() {
+        let v: TestBool = serde_json::from_value(json!({"val": null})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    // option_vec_string_from_string
+    #[test]
+    fn vec_native_array() {
+        let v: TestVec = serde_json::from_value(json!({"val": ["a", "b"]})).unwrap();
+        assert_eq!(v.val, Some(vec!["a".to_string(), "b".to_string()]));
+    }
+
+    #[test]
+    fn vec_json_string_array() {
+        let v: TestVec = serde_json::from_value(json!({"val": "[\"x\",\"y\"]"})).unwrap();
+        assert_eq!(v.val, Some(vec!["x".to_string(), "y".to_string()]));
+    }
+
+    #[test]
+    fn vec_empty_string() {
+        let v: TestVec = serde_json::from_value(json!({"val": ""})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn vec_none() {
+        let v: TestVec = serde_json::from_value(json!({"val": null})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn vec_invalid_string_errors() {
+        let err = serde_json::from_value::<TestVec>(json!({"val": "not-json"}))
+            .expect_err("should fail on invalid JSON");
+        let msg = err.to_string();
+        assert!(msg.contains("invalid string value for array field"));
+        assert!(msg.contains("expected a JSON array"));
+    }
+
+    // option_map_from_string
+    #[test]
+    fn map_native_object() {
+        let v: TestMap = serde_json::from_value(json!({"val": {"key": "value"}})).unwrap();
+        assert!(v.val.is_some());
+        let m = v.val.unwrap();
+        assert_eq!(
+            m.get("key"),
+            Some(&serde_json::Value::String("value".to_string()))
+        );
+    }
+
+    #[test]
+    fn map_json_string_object() {
+        let v: TestMap = serde_json::from_value(json!({"val": "{\"a\":1}"})).unwrap();
+        assert!(v.val.is_some());
+        let m = v.val.unwrap();
+        assert_eq!(m.get("a"), Some(&serde_json::Value::Number(1.into())));
+    }
+
+    #[test]
+    fn map_empty_string() {
+        let v: TestMap = serde_json::from_value(json!({"val": ""})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn map_none() {
+        let v: TestMap = serde_json::from_value(json!({"val": null})).unwrap();
+        assert_eq!(v.val, None);
+    }
+
+    #[test]
+    fn map_invalid_string_errors() {
+        let err = serde_json::from_value::<TestMap>(json!({"val": "not-json"}))
+            .expect_err("should fail on invalid JSON");
+        let msg = err.to_string();
+        assert!(msg.contains("invalid string value for object field"));
+        assert!(msg.contains("expected a JSON object"));
+    }
+}
--- a/crates/secrets-mcp/src/validation.rs
+++ b/crates/secrets-mcp/src/validation.rs
@@ -0,0 +1,149 @@
+/// Validation constants for input field lengths.
+pub const MAX_NAME_LENGTH: usize = 256;
+pub const MAX_FOLDER_LENGTH: usize = 128;
+pub const MAX_ENTRY_TYPE_LENGTH: usize = 64;
+pub const MAX_NOTES_LENGTH: usize = 10000;
+pub const MAX_TAG_LENGTH: usize = 64;
+pub const MAX_TAG_COUNT: usize = 50;
+pub const MAX_META_KEY_LENGTH: usize = 128;
+pub const MAX_META_VALUE_LENGTH: usize = 4096;
+pub const MAX_META_COUNT: usize = 100;
+
+/// Validate input field lengths for MCP tools.
+///
+/// Returns an error if any field exceeds its maximum length.
+pub fn validate_input_lengths(
+    name: &str,
+    folder: Option<&str>,
+    entry_type: Option<&str>,
+    notes: Option<&str>,
+) -> Result<(), rmcp::ErrorData> {
+    if name.chars().count() > MAX_NAME_LENGTH {
+        return Err(rmcp::ErrorData::invalid_params(
+            format!("name must be at most {} characters", MAX_NAME_LENGTH),
+            None,
+        ));
+    }
+    if let Some(folder) = folder
+        && folder.chars().count() > MAX_FOLDER_LENGTH
+    {
+        return Err(rmcp::ErrorData::invalid_params(
+            format!("folder must be at most {} characters", MAX_FOLDER_LENGTH),
+            None,
+        ));
+    }
+    if let Some(entry_type) = entry_type
+        && entry_type.chars().count() > MAX_ENTRY_TYPE_LENGTH
+    {
+        return Err(rmcp::ErrorData::invalid_params(
+            format!("type must be at most {} characters", MAX_ENTRY_TYPE_LENGTH),
+            None,
+        ));
+    }
+    if let Some(notes) = notes
+        && notes.chars().count() > MAX_NOTES_LENGTH
+    {
+        return Err(rmcp::ErrorData::invalid_params(
+            format!("notes must be at most {} characters", MAX_NOTES_LENGTH),
+            None,
+        ));
+    }
+    Ok(())
+}
+
+/// Validate the tags list.
+///
+/// Checks total count and per-tag character length.
+pub fn validate_tags(tags: &[String]) -> Result<(), rmcp::ErrorData> {
+    if tags.len() > MAX_TAG_COUNT {
+        return Err(rmcp::ErrorData::invalid_params(
+            format!("at most {} tags are allowed", MAX_TAG_COUNT),
+            None,
+        ));
+    }
+    for tag in tags {
+        if tag.chars().count() > MAX_TAG_LENGTH {
+            return Err(rmcp::ErrorData::invalid_params(
+                format!(
+                    "tag '{}' exceeds the maximum length of {} characters",
+                    tag, MAX_TAG_LENGTH
+                ),
+                None,
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// Validate metadata KV strings (key=value / key:=json format).
+///
+/// Checks total count and per-key/per-value character lengths.
+/// This is a best-effort check on the raw KV strings before parsing;
+/// keys containing `:` path separators are checked as a whole.
+pub fn validate_meta_entries(entries: &[String]) -> Result<(), rmcp::ErrorData> {
+    if entries.len() > MAX_META_COUNT {
+        return Err(rmcp::ErrorData::invalid_params(
+            format!("at most {} metadata entries are allowed", MAX_META_COUNT),
+            None,
+        ));
+    }
+    for entry in entries {
+        // key:=json — check both key and JSON value length
+        if let Some((key, value)) = entry.split_once(":=") {
+            if key.chars().count() > MAX_META_KEY_LENGTH {
+                return Err(rmcp::ErrorData::invalid_params(
+                    format!(
+                        "metadata key '{}' exceeds the maximum length of {} characters",
+                        key, MAX_META_KEY_LENGTH
+                    ),
+                    None,
+                ));
+            }
+            if value.chars().count() > MAX_META_VALUE_LENGTH {
+                return Err(rmcp::ErrorData::invalid_params(
+                    format!(
+                        "metadata JSON value for key '{}' exceeds the maximum length of {} characters",
+                        key, MAX_META_VALUE_LENGTH
+                    ),
+                    None,
+                ));
+            }
+            continue;
+        }
+        // key=value or key@path
+        if let Some((key, value)) = entry.split_once('=') {
+            if key.chars().count() > MAX_META_KEY_LENGTH {
+                return Err(rmcp::ErrorData::invalid_params(
+                    format!(
+                        "metadata key '{}' exceeds the maximum length of {} characters",
+                        key, MAX_META_KEY_LENGTH
+                    ),
+                    None,
+                ));
+            }
+            if value.chars().count() > MAX_META_VALUE_LENGTH {
+                return Err(rmcp::ErrorData::invalid_params(
+                    format!(
+                        "metadata value for key '{}' exceeds the maximum length of {} characters",
+                        key, MAX_META_VALUE_LENGTH
+                    ),
+                    None,
+                ));
+            }
+        } else {
+            // Fallback: entry without = or := — check total length
+            let max_total = MAX_META_KEY_LENGTH + MAX_META_VALUE_LENGTH;
+            if entry.chars().count() > max_total {
+                let preview = entry.chars().take(50).collect::<String>();
+                return Err(rmcp::ErrorData::invalid_params(
+                    format!(
+                        "metadata entry '{}' exceeds the maximum length of {} characters",
+                        preview, max_total
+                    ),
+                    None,
+                ));
+            }
+        }
+    }
+    Ok(())
+}
--- a/crates/secrets-mcp/src/web.rs
+++ b/crates/secrets-mcp/src/web.rs
@@ -20,9 +20,9 @@ use secrets_core::crypto::hex;
 use secrets_core::error::AppError;
 use secrets_core::service::{
    api_key::{ensure_api_key, regenerate_api_key},
-    audit_log::list_for_user,
+    audit_log::{count_for_user, list_for_user},
    delete::delete_by_id,
-    search::{SearchParams, fetch_secret_schemas, ilike_pattern, list_entries},
+    search::{SearchParams, count_entries, fetch_secret_schemas, ilike_pattern, list_entries},
    update::{UpdateEntryFieldsByIdParams, update_fields_by_id},
    user::{
        OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
@@ -72,6 +72,9 @@ struct AuditPageTemplate {
    user_name: String,
    user_email: String,
    entries: Vec<AuditEntryView>,
+    current_page: u32,
+    total_pages: u32,
+    total_count: i64,
    version: &'static str,
 }

@@ -95,6 +98,9 @@ struct EntriesPageTemplate {
    filter_folder: String,
    filter_name: String,
    filter_type: String,
+    current_page: u32,
+    total_pages: u32,
+    total_count: i64,
    version: &'static str,
 }

@@ -131,7 +137,8 @@ struct FolderTabView {
 }

 /// Cap for HTML list (avoids loading unbounded rows into memory).
-const ENTRIES_PAGE_LIMIT: u32 = 5_000;
+const ENTRIES_PAGE_LIMIT: u32 = 50;
+const AUDIT_PAGE_LIMIT: i64 = 10;

 #[derive(Deserialize)]
 struct EntriesQuery {
@@ -140,6 +147,7 @@ struct EntriesQuery {
    /// URL query key is `type` (maps to DB column `entries.type`).
    #[serde(rename = "type")]
    entry_type: Option<String>,
+    page: Option<u32>,
 }

 // ── App state helpers ─────────────────────────────────────────────────────────
@@ -191,6 +199,15 @@ fn request_user_agent(headers: &HeaderMap) -> Option<String> {
        .map(ToOwned::to_owned)
 }

+fn paginate(page: u32, total_count: i64, page_size: u32) -> (u32, u32, u32) {
+    let page_size = page_size.max(1);
+    let safe_total_count = u32::try_from(total_count.max(0)).unwrap_or(u32::MAX);
+    let total_pages = safe_total_count.div_ceil(page_size).max(1);
+    let current_page = page.max(1).min(total_pages);
+    let offset = (current_page - 1).saturating_mul(page_size);
+    (current_page, total_pages, offset)
+}
+
 // ── Routes ────────────────────────────────────────────────────────────────────

 pub fn web_router() -> Router<AppState> {
@@ -596,7 +613,8 @@ async fn entries_page(
        .map(|s| s.trim())
        .filter(|s| !s.is_empty())
        .map(|s| s.to_string());
-    let params = SearchParams {
+    let page = q.page.unwrap_or(1).max(1);
+    let count_params = SearchParams {
        folder: folder_filter.as_deref(),
        entry_type: type_filter.as_deref(),
        name: None,
@@ -609,7 +627,18 @@ async fn entries_page(
        user_id: Some(user_id),
    };

-    let rows = list_entries(&state.pool, params).await.map_err(|e| {
+    let total_count = count_entries(&state.pool, &count_params)
+        .await
+        .inspect_err(|e| tracing::warn!(error = %e, "count_entries failed for web entries page"))
+        .unwrap_or(0);
+    let (current_page, total_pages, offset) = paginate(page, total_count, ENTRIES_PAGE_LIMIT);
+
+    let list_params = SearchParams {
+        offset,
+        ..count_params
+    };
+
+    let rows = list_entries(&state.pool, list_params).await.map_err(|e| {
        tracing::error!(error = %e, "failed to load entries list for web");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
@@ -681,7 +710,12 @@ async fn entries_page(
        type_options.sort_unstable();
    }

-    fn entries_href(folder: Option<&str>, entry_type: Option<&str>, name: Option<&str>) -> String {
+    fn entries_href(
+        folder: Option<&str>,
+        entry_type: Option<&str>,
+        name: Option<&str>,
+        page: Option<u32>,
+    ) -> String {
        let mut pairs: Vec<String> = Vec::new();
        if let Some(f) = folder
            && !f.is_empty()
@@ -698,6 +732,9 @@ async fn entries_page(
        {
            pairs.push(format!("name={}", urlencoding::encode(n)));
        }
+        if let Some(p) = page {
+            pairs.push(format!("page={}", p));
+        }
        if pairs.is_empty() {
            "/entries".to_string()
        } else {
@@ -710,13 +747,23 @@ async fn entries_page(
    folder_tabs.push(FolderTabView {
        name: "全部".to_string(),
        count: all_count,
-        href: entries_href(None, type_filter.as_deref(), name_filter.as_deref()),
+        href: entries_href(
+            None,
+            type_filter.as_deref(),
+            name_filter.as_deref(),
+            Some(1),
+        ),
        active: folder_filter.is_none(),
    });
    for r in folder_rows {
        let name = r.folder;
        folder_tabs.push(FolderTabView {
-            href: entries_href(Some(&name), type_filter.as_deref(), name_filter.as_deref()),
+            href: entries_href(
+                Some(&name),
+                type_filter.as_deref(),
+                name_filter.as_deref(),
+                Some(1),
+            ),
            active: folder_filter.as_deref() == Some(name.as_str()),
            name,
            count: r.count,
@@ -773,15 +820,24 @@ async fn entries_page(
        filter_folder: folder_filter.unwrap_or_default(),
        filter_name: name_filter.unwrap_or_default(),
        filter_type: type_filter.unwrap_or_default(),
+        current_page,
+        total_pages,
+        total_count,
        version: env!("CARGO_PKG_VERSION"),
    };

    render_template(tmpl)
 }

+#[derive(Deserialize)]
+struct AuditQuery {
+    page: Option<u32>,
+}
+
 async fn audit_page(
    State(state): State<AppState>,
    session: Session,
+    Query(aq): Query<AuditQuery>,
 ) -> Result<Response, StatusCode> {
    let Some(user_id) = current_user_id(&session).await else {
        return Ok(Redirect::to("/login").into_response());
@@ -795,7 +851,17 @@ async fn audit_page(
        None => return Ok(Redirect::to("/login").into_response()),
    };

-    let rows = list_for_user(&state.pool, user_id, 100)
+    let page = aq.page.unwrap_or(1).max(1);
+
+    let total_count = count_for_user(&state.pool, user_id).await.map_err(|e| {
+        tracing::error!(error = %e, "failed to count audit log for user");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+
+    let (current_page, total_pages, offset) = paginate(page, total_count, AUDIT_PAGE_LIMIT as u32);
+    let actual_offset = i64::from(offset);
+
+    let rows = list_for_user(&state.pool, user_id, AUDIT_PAGE_LIMIT, actual_offset)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to load audit log for user");
@@ -816,6 +882,9 @@ async fn audit_page(
        user_name: user.name.clone(),
        user_email: user.email.clone().unwrap_or_default(),
        entries,
+        current_page,
+        total_pages,
+        total_count,
        version: env!("CARGO_PKG_VERSION"),
    };

@@ -1134,10 +1203,16 @@ fn map_app_error(err: &AppError, lang: UiLang) -> EntryApiError {
            StatusCode::CONFLICT,
            Json(json!({ "error": err.to_string() })),
        ),
-        AppError::NotFoundEntry => (
+        AppError::NotFoundEntry | AppError::NotFoundUser | AppError::NotFoundSecret => (
            StatusCode::NOT_FOUND,
            Json(
-                json!({ "error": tr(lang, "条目不存在或无权访问", "條目不存在或無權存取", "Entry not found or no access") }),
+                json!({ "error": tr(lang, "资源不存在或无权访问", "資源不存在或無權存取", "Resource not found or no access") }),
+            ),
+        ),
+        AppError::AuthenticationFailed | AppError::Unauthorized => (
+            StatusCode::UNAUTHORIZED,
+            Json(
+                json!({ "error": tr(lang, "认证失败或无权访问", "認證失敗或無權存取", "Authentication failed or unauthorized") }),
            ),
        ),
        AppError::Validation { message } => {
@@ -1155,6 +1230,12 @@ fn map_app_error(err: &AppError, lang: UiLang) -> EntryApiError {
                json!({ "error": tr(lang, "解密失败，请检查密码短语", "解密失敗，請檢查密碼短語", "Decryption failed — please check your passphrase") }),
            ),
        ),
+        AppError::EncryptionKeyNotSet => (
+            StatusCode::BAD_REQUEST,
+            Json(
+                json!({ "error": tr(lang, "请先设置密码短语后再使用此功能", "請先設定密碼短語再使用此功能", "Please set a passphrase before using this feature") }),
+            ),
+        ),
        AppError::Internal(_) => {
            tracing::error!(error = %err, "internal error in entry mutation");
            (
@@ -1679,4 +1760,29 @@ mod tests {

        assert!(matches!(request_ui_lang(&headers), UiLang::ZhTw));
    }
+
+    #[test]
+    fn paginate_clamps_page_before_computing_offset() {
+        let (current_page, total_pages, offset) = paginate(100, 12, 10);
+
+        assert_eq!(current_page, 2);
+        assert_eq!(total_pages, 2);
+        assert_eq!(offset, 10);
+    }
+
+    #[test]
+    fn paginate_handles_large_page_without_overflow() {
+        let (current_page, total_pages, offset) = paginate(u32::MAX, 1, ENTRIES_PAGE_LIMIT);
+
+        assert_eq!(current_page, 1);
+        assert_eq!(total_pages, 1);
+        assert_eq!(offset, 0);
+    }
+
+    #[test]
+    fn paginate_saturates_large_total_count() {
+        let (_, total_pages, _) = paginate(1, i64::MAX, ENTRIES_PAGE_LIMIT);
+
+        assert_eq!(total_pages, u32::MAX.div_ceil(ENTRIES_PAGE_LIMIT));
+    }
 }
--- a/crates/secrets-mcp/templates/audit.html
+++ b/crates/secrets-mcp/templates/audit.html
@@ -50,8 +50,25 @@
        .main { padding: 32px 24px 40px; flex: 1; }
        .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
                padding: 24px; width: 100%; max-width: 1180px; margin: 0 auto; }
-        .card-title { font-size: 20px; font-weight: 600; margin-bottom: 8px; }
-        .card-subtitle { color: var(--text-muted); font-size: 13px; margin-bottom: 20px; }
+        .card-title-row {
+            display: flex; align-items: center; flex-wrap: wrap; gap: 8px;
+            margin-bottom: 20px;
+        }
+        .card-title { font-size: 20px; font-weight: 600; margin: 0; }
+        .card-title-count {
+            display: inline-flex;
+            align-items: center;
+            min-height: 24px;
+            padding: 0 8px;
+            border: 1px solid var(--border);
+            border-radius: 999px;
+            background: var(--bg);
+            color: var(--text-muted);
+            font-size: 12px;
+            font-weight: 600;
+            line-height: 1;
+            font-family: 'JetBrains Mono', monospace;
+        }
        .empty { color: var(--text-muted); font-size: 14px; padding: 20px 0; }
        table { width: 100%; border-collapse: collapse; }
        th, td { text-align: left; vertical-align: top; padding: 12px 10px; border-top: 1px solid var(--border); }
@@ -85,6 +102,24 @@
            }
            .detail { max-width: none; }
        }
+        .pagination {
+            display: flex; align-items: center; gap: 8px; margin-top: 20px;
+            justify-content: center; padding: 12px 0;
+        }
+        .page-btn {
+            padding: 6px 14px; border-radius: 6px; border: 1px solid var(--border);
+            background: var(--surface); color: var(--text); text-decoration: none;
+            font-size: 13px; cursor: pointer;
+        }
+        .page-btn:hover { background: var(--surface2); }
+        .page-btn-disabled {
+            padding: 6px 14px; border-radius: 6px; border: 1px solid var(--border);
+            background: var(--surface); color: var(--text-muted); font-size: 13px;
+            opacity: 0.5; cursor: not-allowed;
+        }
+        .page-info {
+            color: var(--text-muted); font-size: 13px; font-family: 'JetBrains Mono', monospace;
+        }
    </style>
 </head>
 <body>
@@ -114,8 +149,10 @@

 <main class="main">
    <section class="card">
-        <div class="card-title" data-i18n="auditTitle">我的审计</div>
-        <div class="card-subtitle" data-i18n="auditSubtitle">展示最近 100 条与当前用户相关的新审计记录。时间为浏览器本地时区。</div>
+        <div class="card-title-row">
+            <div class="card-title" data-i18n="auditTitle">我的审计</div>
+            <span class="card-title-count">{{ total_count }}</span>
+        </div>

        {% if entries.is_empty() %}
        <div class="empty" data-i18n="emptyAudit">暂无审计记录。</div>
@@ -140,6 +177,22 @@
                {% endfor %}
            </tbody>
        </table>
+
+        {% if total_count > 0 %}
+        <div class="pagination">
+            {% if current_page > 1 %}
+            <a href="?page={{ current_page - 1 }}" class="page-btn" data-i18n="prevPage">上一页</a>
+            {% else %}
+            <span class="page-btn page-btn-disabled" data-i18n="prevPage">上一页</span>
+            {% endif %}
+            <span class="page-info">{{ current_page }} / {{ total_pages }}</span>
+            {% if current_page < total_pages %}
+            <a href="?page={{ current_page + 1 }}" class="page-btn" data-i18n="nextPage">下一页</a>
+            {% else %}
+            <span class="page-btn page-btn-disabled" data-i18n="nextPage">下一页</span>
+            {% endif %}
+        </div>
+        {% endif %}
        {% endif %}
    </section>
 </main>
@@ -149,9 +202,9 @@
 <script>
 (function () {
  I18N_PAGE = {
-    'zh-CN': { pageTitle: 'Secrets — 审计', auditTitle: '我的审计', auditSubtitle: '展示最近 100 条与当前用户相关的新审计记录。时间为浏览器本地时区。', emptyAudit: '暂无审计记录。', colTime: '时间', colAction: '动作', colTarget: '目标', colDetail: '详情' },
-    'zh-TW': { pageTitle: 'Secrets — 審計', auditTitle: '我的審計', auditSubtitle: '顯示最近 100 筆與目前使用者相關的新審計記錄。時間為瀏覽器本地時區。', emptyAudit: '暫無審計記錄。', colTime: '時間', colAction: '動作', colTarget: '目標', colDetail: '詳情' },
-    en: { pageTitle: 'Secrets — Audit', auditTitle: 'My audit', auditSubtitle: 'Shows the latest 100 audit records related to the current user. Time is in browser local timezone.', emptyAudit: 'No audit records.', colTime: 'Time', colAction: 'Action', colTarget: 'Target', colDetail: 'Detail' }
+    'zh-CN': { pageTitle: 'Secrets — 审计', auditTitle: '我的审计', emptyAudit: '暂无审计记录。', colTime: '时间', colAction: '动作', colTarget: '目标', colDetail: '详情', prevPage: '上一页', nextPage: '下一页' },
+    'zh-TW': { pageTitle: 'Secrets — 審計', auditTitle: '我的審計', emptyAudit: '暫無審計記錄。', colTime: '時間', colAction: '動作', colTarget: '目標', colDetail: '詳情', prevPage: '上一頁', nextPage: '下一頁' },
+    en: { pageTitle: 'Secrets — Audit', auditTitle: 'My audit', emptyAudit: 'No audit records.', colTime: 'Time', colAction: 'Action', colTarget: 'Target', colDetail: 'Detail', prevPage: 'Previous', nextPage: 'Next' }
  };

  window.applyPageLang = function () {
--- a/crates/secrets-mcp/templates/entries.html
+++ b/crates/secrets-mcp/templates/entries.html
@@ -350,6 +350,24 @@
            }
            .detail, .notes-scroll, .secret-list { max-width: none; }
        }
+        .pagination {
+            display: flex; align-items: center; gap: 8px; margin-top: 20px;
+            justify-content: center; padding: 12px 0;
+        }
+        .page-btn {
+            padding: 6px 14px; border-radius: 6px; border: 1px solid var(--border);
+            background: var(--surface); color: var(--text); text-decoration: none;
+            font-size: 13px; cursor: pointer;
+        }
+        .page-btn:hover { background: var(--surface2); }
+        .page-btn-disabled {
+            padding: 6px 14px; border-radius: 6px; border: 1px solid var(--border);
+            background: var(--surface); color: var(--text-muted); font-size: 13px;
+            opacity: 0.5; cursor: not-allowed;
+        }
+        .page-info {
+            color: var(--text-muted); font-size: 13px; font-family: 'JetBrains Mono', monospace;
+        }
    </style>
 </head>
 <body>
@@ -456,6 +474,22 @@
            </tbody>
        </table>
        </div>
+
+        {% if total_count > 0 %}
+        <div class="pagination">
+            {% if current_page > 1 %}
+            <a href="?{% if !filter_folder.is_empty() %}folder={{ filter_folder | urlencode }}&{% endif %}{% if !filter_type.is_empty() %}type={{ filter_type | urlencode }}&{% endif %}{% if !filter_name.is_empty() %}name={{ filter_name | urlencode }}&{% endif %}page={{ current_page - 1 }}" class="page-btn" data-i18n="prevPage">上一页</a>
+            {% else %}
+            <span class="page-btn page-btn-disabled" data-i18n="prevPage">上一页</span>
+            {% endif %}
+            <span class="page-info">{{ current_page }} / {{ total_pages }}</span>
+            {% if current_page < total_pages %}
+            <a href="?{% if !filter_folder.is_empty() %}folder={{ filter_folder | urlencode }}&{% endif %}{% if !filter_type.is_empty() %}type={{ filter_type | urlencode }}&{% endif %}{% if !filter_name.is_empty() %}name={{ filter_name | urlencode }}&{% endif %}page={{ current_page + 1 }}" class="page-btn" data-i18n="nextPage">下一页</a>
+            {% else %}
+            <span class="page-btn page-btn-disabled" data-i18n="nextPage">下一页</span>
+            {% endif %}
+        </div>
+        {% endif %}
        {% endif %}
    </section>
 </main>
@@ -554,7 +588,9 @@ var SECRET_TYPE_OPTIONS = JSON.parse(document.getElementById('secret-type-option
      secretNameCheckError: '校验失败，请重试',
      secretNameFixBeforeSave: '请先修复密文名称校验问题后再保存',
      secretTypePlaceholder: '选择类型',
-      secretTypeInvalid: '类型不能为空'
+      secretTypeInvalid: '类型不能为空',
+      prevPage: '上一页',
+      nextPage: '下一页',
    },
    'zh-TW': {
      pageTitle: 'Secrets — 條目',
@@ -610,7 +646,9 @@ var SECRET_TYPE_OPTIONS = JSON.parse(document.getElementById('secret-type-option
      secretNameCheckError: '校驗失敗，請重試',
      secretNameFixBeforeSave: '請先修復密文名稱校驗問題後再儲存',
      secretTypePlaceholder: '選擇類型',
-      secretTypeInvalid: '類型不能為空'
+      secretTypeInvalid: '類型不能為空',
+      prevPage: '上一頁',
+      nextPage: '下一頁',
    },
    en: {
      pageTitle: 'Secrets — Entries',
@@ -666,7 +704,9 @@ var SECRET_TYPE_OPTIONS = JSON.parse(document.getElementById('secret-type-option
      secretNameCheckError: 'Validation failed, please retry',
      secretNameFixBeforeSave: 'Fix secret name validation errors before saving',
      secretTypePlaceholder: 'Select type',
-      secretTypeInvalid: 'Type cannot be empty'
+      secretTypeInvalid: 'Type cannot be empty',
+      prevPage: 'Previous',
+      nextPage: 'Next'
    }
  };

--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -30,8 +30,3 @@ GOOGLE_CLIENT_SECRET=

 # ─── 日志（可选）──────────────────────────────────────────────────────
 # RUST_LOG=secrets_mcp=debug
-
-# ─── 注意 ─────────────────────────────────────────────────────────────
-# SERVER_MASTER_KEY 已不再需要。
-# 新架构（E2EE）中，加密密钥由用户密码短语在客户端本地派生，服务端不持有原始密钥。
-# 仅在需要迁移旧版 wrapped_key 数据时临时启用。
--- a/scripts/release-check.sh
+++ b/scripts/release-check.sh
@@ -11,7 +11,7 @@ tag="secrets-mcp-${version}"
 echo "==> 当前 secrets-mcp 版本: ${version}"
 echo "==> 检查是否已存在 tag: ${tag}"

-if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
+if jj log --no-graph --revisions "tag(${tag})" --limit 1 >/dev/null 2>&1; then
  echo "提示: 已存在 tag ${tag}，将按重复构建处理，不阻断检查。"
  echo "如需创建新的发布版本，请先 bump crates/secrets-mcp/Cargo.toml 中的 version。"
 else
Author	SHA1	Message	Date
voson	2b994141b8	release(secrets-mcp): 0.5.5 — 生产 CORS 显式 allow_methods，修复 tower-http 启动 panic All checks were successful Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 4m59s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Successful in 6s Details credentials + wildcard methods/headers 被 tower-http 禁止；生产环境改为 GET/POST/PATCH/DELETE/OPTIONS 白名单。	2026-04-05 12:27:40 +08:00
voson	9d6ac5c13a	release(secrets-mcp): 0.5.4 — Web 分页修正与 hex 解码；批量删除上限；MCP @ 路径检测 Some checks failed Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 4m55s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Failing after 6s Details	2026-04-05 12:14:40 +08:00
voson	1860cce86c	release(secrets-mcp): 0.5.3 — 审计日志分页与 Web；CONTRIBUTING；文档与模板修正	2026-04-05 11:34:04 +08:00
agent	dd24f7cc44	release: secrets-mcp 0.5.2 Some checks failed Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 6m7s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Failing after 6s Details Bump version: secrets-mcp-0.5.1 tag already existed while crates had further changes. Made-with: Cursor	2026-04-05 10:38:50 +08:00
voson	aefad33870	chore(secrets-mcp): 0.5.1 — 移除 entry type 归一化，MCP 参数兼容字符串形式 All checks were successful Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 4m22s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Successful in 6s Details - 去掉 taxonomy 对 entry type 的自动映射与 metadata.subtype 回填；仅 trim 后入库 - MCP tools：Vec/Map/bool 等可选字段支持 JSON 内嵌字符串解析，并改进解析失败提示 - 新增 deser 单元测试；README/AGENTS 与 models 注释同步 Made-with: Cursor	2026-04-04 21:27:33 +08:00