diff --git a/core/Azure.Mcp.Core/src/Areas/Group/Commands/GroupListCommand.cs b/core/Azure.Mcp.Core/src/Areas/Group/Commands/GroupListCommand.cs
index 9f1a488d26..e8889293d9 100644
--- a/core/Azure.Mcp.Core/src/Areas/Group/Commands/GroupListCommand.cs
+++ b/core/Azure.Mcp.Core/src/Areas/Group/Commands/GroupListCommand.cs
@@ -27,7 +27,15 @@ returned as a JSON array.
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     public override async Task<CommandResponse> ExecuteAsync(CommandContext context, ParseResult parseResult)
     {
diff --git a/core/Azure.Mcp.Core/src/Areas/Subscription/Commands/SubscriptionListCommand.cs b/core/Azure.Mcp.Core/src/Areas/Subscription/Commands/SubscriptionListCommand.cs
index 76d8485873..3b5c6dabad 100644
--- a/core/Azure.Mcp.Core/src/Areas/Subscription/Commands/SubscriptionListCommand.cs
+++ b/core/Azure.Mcp.Core/src/Areas/Subscription/Commands/SubscriptionListCommand.cs
@@ -25,7 +25,15 @@ List all Azure subscriptions accessible to your account. Optionally specify {Opt
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     public override async Task<CommandResponse> ExecuteAsync(CommandContext context, ParseResult parseResult)
     {
diff --git a/core/Azure.Mcp.Core/src/Areas/Tools/Commands/ToolsListCommand.cs b/core/Azure.Mcp.Core/src/Areas/Tools/Commands/ToolsListCommand.cs
index a05579a65f..02cec3f76a 100644
--- a/core/Azure.Mcp.Core/src/Areas/Tools/Commands/ToolsListCommand.cs
+++ b/core/Azure.Mcp.Core/src/Areas/Tools/Commands/ToolsListCommand.cs
@@ -23,7 +23,15 @@ arguments. Use this to explore the CLI's functionality or to build interactive c
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     public override async Task<CommandResponse> ExecuteAsync(CommandContext context, ParseResult parseResult)
     {
diff --git a/servers/Azure.Mcp.Server/CHANGELOG.md b/servers/Azure.Mcp.Server/CHANGELOG.md
index 83a485a737..75f22b9689 100644
--- a/servers/Azure.Mcp.Server/CHANGELOG.md
+++ b/servers/Azure.Mcp.Server/CHANGELOG.md
@@ -18,6 +18,8 @@ The Azure MCP Server updates automatically by default whenever a new release com
 
 ### Bugs Fixed
 
+- Marked the secret hint of 'secret_create' tool to true. [[#430](https://github.com/microsoft/mcp/pull/430)]
+
 ### Other Changes
 
 ## 0.6.0 (2025-09-11)
diff --git a/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolGetCommand.cs b/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolGetCommand.cs
index 2496bc5781..e282f91292 100644
--- a/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolGetCommand.cs
+++ b/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolGetCommand.cs
@@ -27,7 +27,15 @@ public sealed class NodepoolGetCommand(ILogger<NodepoolGetCommand> logger) : Bas
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolListCommand.cs b/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolListCommand.cs
index 923aa01738..b2eca5c2f1 100644
--- a/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolListCommand.cs
+++ b/tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolListCommand.cs
@@ -26,7 +26,15 @@ public sealed class NodepoolListCommand(ILogger<NodepoolListCommand> logger) : B
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Azure.Mcp.Tools.AppLens/src/Commands/Resource/ResourceDiagnoseCommand.cs b/tools/Azure.Mcp.Tools.AppLens/src/Commands/Resource/ResourceDiagnoseCommand.cs
index 77de51c564..82c773cefe 100644
--- a/tools/Azure.Mcp.Tools.AppLens/src/Commands/Resource/ResourceDiagnoseCommand.cs
+++ b/tools/Azure.Mcp.Tools.AppLens/src/Commands/Resource/ResourceDiagnoseCommand.cs
@@ -42,7 +42,16 @@ Once proper input is provided this tool returns a list of insights and solutions
         """;
 
     public override string Title => CommandTitle;
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Azure.Mcp.Tools.AzureManagedLustre/src/Commands/FileSystem/Sku/SkuGetCommand.cs b/tools/Azure.Mcp.Tools.AzureManagedLustre/src/Commands/FileSystem/Sku/SkuGetCommand.cs
index abfa120ca6..4931f7a453 100644
--- a/tools/Azure.Mcp.Tools.AzureManagedLustre/src/Commands/FileSystem/Sku/SkuGetCommand.cs
+++ b/tools/Azure.Mcp.Tools.AzureManagedLustre/src/Commands/FileSystem/Sku/SkuGetCommand.cs
@@ -26,9 +26,10 @@ public sealed class SkuGetCommand(ILogger<SkuGetCommand> logger)
     public override ToolMetadata Metadata => new()
     {
         Destructive = false,
-        OpenWorld = true,
         Idempotent = true,
+        OpenWorld = true,
         ReadOnly = true,
+        LocalRequired = false,
         Secret = false
     };
 
diff --git a/tools/Azure.Mcp.Tools.Extension/src/Commands/AzqrCommand.cs b/tools/Azure.Mcp.Tools.Extension/src/Commands/AzqrCommand.cs
index 0c478d095a..7bcc14465c 100644
--- a/tools/Azure.Mcp.Tools.Extension/src/Commands/AzqrCommand.cs
+++ b/tools/Azure.Mcp.Tools.Extension/src/Commands/AzqrCommand.cs
@@ -31,7 +31,15 @@ Note that Azure Quick Review CLI (azqr) is different from Azure CLI (az).
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Azure.Mcp.Tools.KeyVault/src/Commands/Secret/SecretCreateCommand.cs b/tools/Azure.Mcp.Tools.KeyVault/src/Commands/Secret/SecretCreateCommand.cs
index 7583c1bd34..ca2e861822 100644
--- a/tools/Azure.Mcp.Tools.KeyVault/src/Commands/Secret/SecretCreateCommand.cs
+++ b/tools/Azure.Mcp.Tools.KeyVault/src/Commands/Secret/SecretCreateCommand.cs
@@ -29,7 +29,7 @@ public sealed class SecretCreateCommand(ILogger<SecretCreateCommand> logger) : S
         OpenWorld = true,
         ReadOnly = false,
         LocalRequired = false,
-        Secret = false
+        Secret = true
     };
 
     public override string Description =>
diff --git a/tools/Azure.Mcp.Tools.KeyVault/tests/Azure.Mcp.Tools.KeyVault.LiveTests/KeyVaultCommandTests.cs b/tools/Azure.Mcp.Tools.KeyVault/tests/Azure.Mcp.Tools.KeyVault.LiveTests/KeyVaultCommandTests.cs
index fc2c2a2348..78d14d5864 100644
--- a/tools/Azure.Mcp.Tools.KeyVault/tests/Azure.Mcp.Tools.KeyVault.LiveTests/KeyVaultCommandTests.cs
+++ b/tools/Azure.Mcp.Tools.KeyVault/tests/Azure.Mcp.Tools.KeyVault.LiveTests/KeyVaultCommandTests.cs
@@ -115,30 +115,6 @@ public async Task Should_get_secret()
         Assert.NotNull(value.GetString());
     }
 
-    [Fact]
-    public async Task Should_create_secret()
-    {
-        var secretName = Settings.ResourceBaseName + Random.Shared.NextInt64();
-        var secretValue = "test-value-" + Random.Shared.NextInt64();
-        var result = await CallToolAsync(
-            "azmcp_keyvault_secret_create",
-            new()
-            {
-                { "subscription", Settings.SubscriptionId },
-                { "vault", Settings.ResourceBaseName },
-                { "secret", secretName},
-                { "value", secretValue }
-            });
-
-        var createdSecretName = result.AssertProperty("name");
-        Assert.Equal(JsonValueKind.String, createdSecretName.ValueKind);
-        Assert.Equal(secretName, createdSecretName.GetString());
-
-        var returnedValue = result.AssertProperty("value");
-        Assert.Equal(JsonValueKind.String, returnedValue.ValueKind);
-        Assert.Equal(secretValue, returnedValue.GetString());
-    }
-
     [Fact]
     public async Task Should_list_certificates()
     {
diff --git a/tools/Azure.Mcp.Tools.ResourceHealth/src/Commands/ServiceHealthEvents/ServiceHealthEventsListCommand.cs b/tools/Azure.Mcp.Tools.ResourceHealth/src/Commands/ServiceHealthEvents/ServiceHealthEventsListCommand.cs
index 7b9b6b6cb8..c0afa46cd7 100644
--- a/tools/Azure.Mcp.Tools.ResourceHealth/src/Commands/ServiceHealthEvents/ServiceHealthEventsListCommand.cs
+++ b/tools/Azure.Mcp.Tools.ResourceHealth/src/Commands/ServiceHealthEvents/ServiceHealthEventsListCommand.cs
@@ -30,7 +30,15 @@ public sealed class ServiceHealthEventsListCommand(ILogger<ServiceHealthEventsLi
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = true,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetBestPracticesCommand.cs b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetBestPracticesCommand.cs
index 02f904a2d4..742234d385 100644
--- a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetBestPracticesCommand.cs
+++ b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetBestPracticesCommand.cs
@@ -29,7 +29,15 @@ public sealed class GetBestPracticesCommand(ILogger<GetBestPracticesCommand> log
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetExamplesCommand.cs b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetExamplesCommand.cs
index e701802af4..b337ee8e4b 100644
--- a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetExamplesCommand.cs
+++ b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetExamplesCommand.cs
@@ -29,7 +29,15 @@ examples to help with API integration and development.
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetWorkloadDefinitionCommand.cs b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetWorkloadDefinitionCommand.cs
index 93ecb305ae..08aa7c0ebe 100644
--- a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetWorkloadDefinitionCommand.cs
+++ b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/BestPractices/GetWorkloadDefinitionCommand.cs
@@ -26,7 +26,15 @@ public sealed class GetWorkloadDefinitionCommand(ILogger<GetWorkloadDefinitionCo
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetPlatformApisCommand.cs b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetPlatformApisCommand.cs
index 0892ab7570..92db6fe5a5 100644
--- a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetPlatformApisCommand.cs
+++ b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetPlatformApisCommand.cs
@@ -25,7 +25,15 @@ complete API specification in JSON format with supplementary definition files.
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     public override async Task<CommandResponse> ExecuteAsync(CommandContext context, ParseResult parseResult)
     {
diff --git a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetWorkloadApisCommand.cs b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetWorkloadApisCommand.cs
index b20ca6c4ed..977a704aa0 100644
--- a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetWorkloadApisCommand.cs
+++ b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/GetWorkloadApisCommand.cs
@@ -27,7 +27,15 @@ command first to see available workload types.
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     protected override void RegisterOptions(Command command)
     {
diff --git a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/ListWorkloadsCommand.cs b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/ListWorkloadsCommand.cs
index 10be292c72..8212b023d8 100644
--- a/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/ListWorkloadsCommand.cs
+++ b/tools/Fabric.Mcp.Tools.PublicApi/src/Commands/PublicApis/ListWorkloadsCommand.cs
@@ -25,7 +25,15 @@ with other commands to retrieve their specific API documentation.
 
     public override string Title => CommandTitle;
 
-    public override ToolMetadata Metadata => new() { Destructive = false, ReadOnly = true };
+    public override ToolMetadata Metadata => new()
+    {
+        Destructive = false,
+        Idempotent = true,
+        OpenWorld = false,
+        ReadOnly = true,
+        LocalRequired = false,
+        Secret = false
+    };
 
     public override async Task<CommandResponse> ExecuteAsync(CommandContext context, ParseResult parseResult)
     {