Environment and storage
| Tool | Permission | Purpose |
|---|---|---|
list_env_keys | read | List environment-variable key names for an application, database, or service. Never returns values. |
list_shared_env_keys | read | List shared key names at project or environment scope. Never returns values. |
get_env_values | read:sensitive | Return environment values. The token owner must be a team admin or owner. Values marked as shown once are never returned. |
list_storages | read | List persistent and file storage mounts. Never returns file contents. |
Change variables and storage
| Tool | Actions |
|---|---|
manage_env | create, update, bulk_update (write); delete (write, confirm). Values are returned only with read:sensitive. |
manage_shared_env | create, update (write); delete (write, confirm). |
manage_storage | create, update, set_backup (write); delete and remove_backup (write, confirm); run_backup (deploy, confirm). File content changes need deploy. |
Actions marked confirm need confirm=true. Ask the user before your client sends it.
remove_backup deletes the backup schedule and its local and S3 archives. run_backup can stop the resource when the schedule uses stop_during_backup.
Task command bodies and supported sensitive fields require read:sensitive.