create_group_variable

What create_group_variable does on Gitlab Mcp

AI agents use create_group_variable to create or update resources in Gitlab Mcp, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Gitlab Mcp environment.

Why create_group_variable is rated Medium

This tool creates (Write) new CI/CD variables at the group level, which can include sensitive data like API keys, tokens, and credentials. While not destructive or financial, misuse could allow an attacker to inject malicious variables into CI/CD pipelines affecting all projects in the group, potentially leading to code execution or data exfiltration.

From the tool's definition Tool description states 'Create a CI/CD variable for a group', which involves creating new configuration that persists in GitLab. CI/CD variables are used to store secrets, configuration values, and credentials that are passed to pipelines.

The rule that runs create_group_variable safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Gitlab Mcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_group_variable, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_group_variable": {
      "limits": [
        {
          "counter": "create_group_variable_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about create_group_variable