diff --git a/src/cli/tests/commands/describe.test.ts b/src/cli/tests/commands/describe.test.ts
index 52a320d..3e26c1d 100644
--- a/src/cli/tests/commands/describe.test.ts
+++ b/src/cli/tests/commands/describe.test.ts
@@ -216,12 +216,27 @@ describe('describe command', () => {
   });
 
   it('shows secret detail with revealed values when --show-values', async () => {
-    const deps = makeDeps({
-      id: 'sec-1',
-      name: 'ha-creds',
-      data: { TOKEN: 'abc123' },
-      createdAt: '2025-01-01',
-    });
+    // --show-values takes the ?reveal=true path: bypasses fetchResource and
+    // calls deps.client.get('/api/v1/secrets/:id?reveal=true') directly so
+    // mcpd resolves through the backing driver. Mock that here.
+    const deps = makeDeps();
+    deps.client = {
+      get: vi.fn(async (path: string) => {
+        if (path.startsWith('/api/v1/secrets/sec-1')) {
+          return {
+            id: 'sec-1',
+            name: 'ha-creds',
+            data: { TOKEN: 'abc123' },
+            createdAt: '2025-01-01',
+          };
+        }
+        // resolveNameOrId path — return the matching list
+        if (path === '/api/v1/secrets') {
+          return [{ id: 'sec-1', name: 'sec-1' }];
+        }
+        return [];
+      }),
+    } as unknown as typeof deps.client;
     const cmd = createDescribeCommand(deps);
     await cmd.parseAsync(['node', 'test', 'secret', 'sec-1', '--show-values']);