# unset_env

Delete a DenkOps project's environment variable. Run redeploy to apply.

Agent View of the PolicyLayer registry record for `unset_env`. HTML page: https://policylayer.com/tools/denkopsai-mcp/unset-env

## Facts

- Tool: `unset_env`
- Server: Denkopsai (`@denkopsai/mcp`) — https://policylayer.com/tools/denkopsai-mcp.md
- Install: `npx -y @denkopsai/mcp`
- Homepage: https://www.npmjs.com/package/@denkopsai/mcp
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 2 (2 required)
- Recommended policy verdict: Hidden

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `key` | string | yes |  |
| `project_id` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "unset_env",
    "arguments": {
      "key": "<key>",
      "project_id": "<project_id>"
    }
  }
}
```

## Why unset_env is rated Critical

The tool permanently deletes an environment variable from a project. This is irreversible (the value is lost unless manually re-entered), and deleting environment variables can break running services, expose security gaps, or cause application failures. The instruction to 'Run redeploy to apply' confirms the change has real operational impact.

From the tool's own definition: "'Delete a DenkOps project's environment variable'"

## Use case

AI agents call unset_env to permanently remove resources in Denkopsai, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Denkopsai:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "unset_env"
  ]
}
```

## Other tools on Denkopsai (27)

- `delete_project` — Destructive — https://policylayer.com/tools/denkopsai-mcp/delete-project.md
- `remove_domain` — Destructive — https://policylayer.com/tools/denkopsai-mcp/remove-domain.md
- `revoke_connection` — Destructive — https://policylayer.com/tools/denkopsai-mcp/revoke-connection.md
- `deploy` — Execute — https://policylayer.com/tools/denkopsai-mcp/deploy.md
- `login` — Execute — https://policylayer.com/tools/denkopsai-mcp/login.md
- `redeploy` — Execute — https://policylayer.com/tools/denkopsai-mcp/redeploy.md
- `start_project` — Execute — https://policylayer.com/tools/denkopsai-mcp/start-project.md
- `stop_project` — Execute — https://policylayer.com/tools/denkopsai-mcp/stop-project.md
- `get_container_logs` — Read — https://policylayer.com/tools/denkopsai-mcp/get-container-logs.md
- `get_denkops_guide` — Read — https://policylayer.com/tools/denkopsai-mcp/get-denkops-guide.md
- `get_egress_policy` — Read — https://policylayer.com/tools/denkopsai-mcp/get-egress-policy.md
- `get_metrics` — Read — https://policylayer.com/tools/denkopsai-mcp/get-metrics.md
- `get_public_paths` — Read — https://policylayer.com/tools/denkopsai-mcp/get-public-paths.md
- `get_status` — Read — https://policylayer.com/tools/denkopsai-mcp/get-status.md
- `get_trace` — Read — https://policylayer.com/tools/denkopsai-mcp/get-trace.md
- `list_connections` — Read — https://policylayer.com/tools/denkopsai-mcp/list-connections.md
- `list_domains` — Read — https://policylayer.com/tools/denkopsai-mcp/list-domains.md
- `list_env` — Read — https://policylayer.com/tools/denkopsai-mcp/list-env.md
- `list_projects` — Read — https://policylayer.com/tools/denkopsai-mcp/list-projects.md
- `list_traces` — Read — https://policylayer.com/tools/denkopsai-mcp/list-traces.md
- `rollback` — Read — https://policylayer.com/tools/denkopsai-mcp/rollback.md
- `verify_domain` — Read — https://policylayer.com/tools/denkopsai-mcp/verify-domain.md
- `add_domain` — Write — https://policylayer.com/tools/denkopsai-mcp/add-domain.md
- `create_connection` — Write — https://policylayer.com/tools/denkopsai-mcp/create-connection.md
- `set_egress_policy` — Write — https://policylayer.com/tools/denkopsai-mcp/set-egress-policy.md
- `set_env` — Write — https://policylayer.com/tools/denkopsai-mcp/set-env.md
- `set_public_paths` — Write — https://policylayer.com/tools/denkopsai-mcp/set-public-paths.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=denkopsai-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/denkopsai-mcp