Issue #271 opened: env_vars list ignores the key parameter — reveal=true dumps every secret on the resource

What happens

The env_vars tool schema accepts key on every action, so an MCP client (LLM) that wants a single value naturally calls:

{ "resource": "application", "action": "list", "uuid": "<uuid>", "key": "MY_FLAG", "reveal": true }

But the three list branches in src/lib/mcp-server.ts never use key — they always return the full env list. With reveal: true that means asking "what is MY_FLAG set to?" returns every variable on the resource in plaintext (API keys, DB passwords, PEM private keys) straight into the LLM context/transcript.

Observed in practice: an agent checking two boolean flags on an app with ~100 env vars received the complete plaintext dump three times into its transcript.

Why it matters

The masking-by-default design (***) exists precisely to keep secrets out of MCP clients, and the tool description encourages reveal=true for the "what is FOO set to?" case — but that case is exactly the one where the caller only needs one value and instead gets all of them. The blast radius of a single innocuous read is the entire secret set of the resource.

Expected

action=list + key=FOO returns only the FOO variable (masked, or plaintext with reveal=true). Without key, behaviour unchanged.

Environment

@masonator/coolify-mcp 2.14.0 (also reproducible from current main, d81f281), Coolify v4 self-hosted.

I have a small PR ready with the fix + tests — will link it here.