gitlab_list_group_variables

What gitlab_list_group_variables does on Gitlab

AI agents call gitlab_list_group_variables to retrieve information from Gitlab without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why gitlab_list_group_variables is rated Low

This tool retrieves CI/CD variables at the group level, which are configuration secrets and settings used across pipelines. While the operation itself is read-only and reversible, CI/CD variables often contain sensitive information (API keys, credentials, tokens) that could expose organizational secrets if an agent queries and exfiltrates them.

From the tool's definition Tool name is 'gitlab_list_group_variables' and description states it 'List[s] all CI/CD variables set at the group level.' The verb 'list' and action of retrieving/querying variables without modification confirms a Read operation.

The rule that runs gitlab_list_group_variables safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Gitlab, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For gitlab_list_group_variables, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "gitlab_list_group_variables": {}
  }
}

Questions about gitlab_list_group_variables