get_project_variable

What get_project_variable does on Gitlab Mcp

AI agents call get_project_variable to retrieve information from Gitlab Mcp without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_project_variable is rated Low

This tool retrieves existing configuration data (a CI/CD variable) without creating, modifying, or deleting anything. It is a straightforward read operation. Severity is low because exposure of CI/CD variables could be a concern in some contexts, but the tool itself performs no destructive or harmful action—the risk depends entirely on what data the variable contains and whether the user has legitimate access to…

From the tool's definition The tool name is 'get_project_variable' and the description states it 'Get[s] a single CI/CD variable from a project'. The verb 'get' and the absence of any modification language indicate a retrieval operation with no side effects.

The rule that runs get_project_variable safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Gitlab Mcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_project_variable, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_project_variable": {}
  }
}

Questions about get_project_variable