# gitlab_delete_group_variable Delete a CI/CD variable from a group. Agent View of the PolicyLayer registry record for `gitlab_delete_group_variable`. HTML page: https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-delete-group-variable ## Facts - Tool: `gitlab_delete_group_variable` - Server: Gitlab (`dkeeno/gitlab-mcp-server`) — https://policylayer.com/tools/dkeeno-gitlab-mcp-server.md - Homepage: https://github.com/dkeeno/gitlab-mcp-server - Risk category: Destructive (Critical risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Hidden ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "gitlab_delete_group_variable", "arguments": {} } } ``` ## Why gitlab_delete_group_variable is rated Critical This tool permanently removes configuration data (CI/CD variables) without possibility of recovery through the tool itself. CI/CD variables frequently store credentials and secrets critical to deployment pipelines. Misuse by an AI agent could disable production deployments or expose security weaknesses by removing protective secrets. From the tool's own definition: "Tool name contains 'delete' and description states 'Delete a CI/CD variable from a group.' CI/CD variables often contain sensitive credentials, API keys, and secrets. Deletion is irreversible." ## Use case AI agents call gitlab_delete_group_variable to permanently remove resources in Gitlab, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo. ## Recommended policy (PolicyLayer) Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Gitlab: ```json { "version": "1", "default": "deny", "hide": [ "gitlab_delete_group_variable" ] } ``` ## Other tools on Gitlab (55) - `gitlab_delete_branch` — Destructive — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-delete-branch.md - `gitlab_delete_ci_variable` — Destructive — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-delete-ci-variable.md - `gitlab_revoke_group_access_token` — Destructive — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-revoke-group-access-token.md - `gitlab_revoke_personal_access_token` — Destructive — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-revoke-personal-access-token.md - `gitlab_revoke_project_access_token` — Destructive — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-revoke-project-access-token.md - `gitlab_cancel_pipeline` — Execute — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-cancel-pipeline.md - `gitlab_register_local_runner` — Execute — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-register-local-runner.md - `gitlab_retry_pipeline` — Execute — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-retry-pipeline.md - `gitlab_trigger_pipeline` — Execute — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-trigger-pipeline.md - `analyze_pipeline_failure` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/analyze-pipeline-failure.md - `gitlab_clone_repo` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-clone-repo.md - `gitlab_get_file` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-file.md - `gitlab_get_job_logs` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-job-logs.md - `gitlab_get_mr_diff` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-mr-diff.md - `gitlab_get_pipeline_artifacts` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-pipeline-artifacts.md - `gitlab_get_pipeline_jobs` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-pipeline-jobs.md - `gitlab_get_pipeline_status` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-pipeline-status.md - `gitlab_get_project` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-project.md - `gitlab_get_runner_status` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-runner-status.md - `gitlab_get_security_report` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-security-report.md - `gitlab_get_security_summary` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-get-security-summary.md - `gitlab_list_branches` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-branches.md - `gitlab_list_ci_variables` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-ci-variables.md - `gitlab_list_group_access_tokens` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-group-access-tokens.md - `gitlab_list_group_variables` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-group-variables.md - `gitlab_list_groups` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-groups.md - `gitlab_list_mrs` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-mrs.md - `gitlab_list_personal_access_tokens` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-personal-access-tokens.md - `gitlab_list_pipelines` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-pipelines.md - `gitlab_list_project_access_tokens` — Read — https://policylayer.com/tools/dkeeno-gitlab-mcp-server/gitlab-list-project-access-tokens.md - …and 25 more: https://policylayer.com/tools/dkeeno-gitlab-mcp-server.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dkeeno-gitlab-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dkeeno-gitlab-mcp-server