Variables — MCP Tools

8 tools in the Variables group of the Routebase MCP server.

export_variables

Export an environment's variables as .env or JSON text. Secret values are ALWAYS masked — MCP has no path to decrypted secrets; use the web app if you need the real values. The output is suitable for review and for feeding back into import_variables.

Required scope: projects:read

Parameter	Type	Required	Description
environmentId	string	Yes	Public ID (GUID) of the environment
format	string	No (default "env")	Output format: 'env' (KEY=VALUE lines) or 'json'. Defaults to 'env'.
projectId	string	No	Public ID (GUID) of the project. If omitted, uses the active project context.

get_secret_audit_log

Read the audit trail for secret variables — who revealed, created, updated, deleted or exported which key, and when. Values are never recorded, only keys. Requires organization context.

Required scope: org:manage-governance

Parameter	Type	Required	Description
projectId	string	No	Limit to one project. Public ID (GUID); omit for the whole organization.
action	string	No	Limit to one action: 'revealed', 'created', 'updated', 'deleted' or 'exported'
from	string	No	Only entries at or after this UTC timestamp (ISO 8601, e.g. 2026-07-01T00:00:00Z)
to	string	No	Only entries at or before this UTC timestamp (ISO 8601)
page	integer	No (default 1)	Page number, 1-based. Defaults to 1.
pageSize	integer	No (default 50)	Entries per page. Defaults to 50.

import_variables

Import variables into an environment from .env or JSON text. With preview=true nothing is written: the parsed variables and the keys that look like secrets come back so you can check them first — run that before importing content you did not write yourself. duplicateStrategy decides what happens to keys that already exist.

Required scope: projects:write

Parameter	Type	Required	Description
content	string	Yes	The .env or JSON text to import
format	string	No (default "env")	Format of content: 'env' (KEY=VALUE lines) or 'json'. Defaults to 'env'.
preview	boolean	No (default false)	Parse and report only, write nothing. Defaults to false.
environmentId	string	No	Public ID (GUID) of the environment. Required unless preview is true.
duplicateStrategy	string	No (default "skip")	What to do with keys that already exist: 'skip' (keep the current value) or 'overwrite'. Defaults to 'skip'.
secretKeys	string	No	Comma-separated list of keys to store as secrets. Use the detectedSecretKeys from a preview run, or your own list.
projectId	string	No	Public ID (GUID) of the project. If omitted, uses the active project context.

list_org_variables

List the organization-wide variables. They are the base layer: project/environment variables override them by key, personal variables override both. Secret values are always masked. Requires organization context.

Required scope: org:manage-governance

No parameters.

list_personal_variables

List your personal variables for one environment. They override both organization and environment variables and are visible only to you. Secret values are always masked. Requires organization context.

Required scope: projects:read

Parameter	Type	Required	Description
environmentId	string	Yes	Public ID (GUID) of the environment
projectId	string	No	Public ID (GUID) of the project. If omitted, uses the active project context.

manage_org_variable

Create, update or delete an organization-wide variable. action: 'create' (needs key and value), 'update' (needs variableId and value), 'delete' (needs variableId). On update the value is REQUIRED — secret values are never readable through MCP, so the tool cannot keep an unspecified one; isSecret and description keep their stored value when omitted. Get variableId from list_org_variables. Requires organization context.

Required scope: org:manage-governance

Parameter	Type	Required	Description
action	string	Yes	What to do: 'create', 'update' or 'delete'
key	string	No	Variable key/name. Required for action 'create'.
value	string	No	Variable value. Required for actions 'create' and 'update'.
variableId	string	No	Public ID (GUID) of the variable. Required for actions 'update' and 'delete'.
isSecret	boolean	No	Store the value encrypted and mask it on every read. Defaults to false on create, unchanged on update.
description	string	No	Optional description. Pass an empty string to clear it.

manage_personal_variable

Create, update or delete one of YOUR personal variables in an environment. Other members never see them. action: 'create' (needs environmentId, key and value), 'update' (needs variableId and value), 'delete' (needs variableId). On update the value is REQUIRED — secret values are never readable through MCP. Get variableId from list_personal_variables.

Required scope: projects:write

Parameter	Type	Required	Description
action	string	Yes	What to do: 'create', 'update' or 'delete'
environmentId	string	No	Public ID (GUID) of the environment. Required for actions 'create' and 'update'.
key	string	No	Variable key/name. Required for action 'create'.
value	string	No	Variable value. Required for actions 'create' and 'update'.
variableId	string	No	Public ID (GUID) of the variable. Required for actions 'update' and 'delete'.
isSecret	boolean	No	Store the value encrypted and mask it on every read. Defaults to false on create, unchanged on update.
description	string	No	Optional description. Pass an empty string to clear it.
projectId	string	No	Public ID (GUID) of the project. If omitted, uses the active project context.

resolve_variables

Show the effective variable set for one environment after merging all three scopes — organization, then environment, then your personal overrides — with the scope each winning value came from. This is what a test run or mock request actually sees. Secret values are masked.

Required scope: projects:read

Parameter	Type	Required	Description
environmentId	string	Yes	Public ID (GUID) of the environment
projectId	string	No	Public ID (GUID) of the project. If omitted, uses the active project context.