PR #272 merged: fix: honor key filter on env_vars list so reveal exposes only the requested variable

Fixes #271

Problem

The env_vars tool schema accepts key on every action, but the list branches ignored it and always returned the full env list. Combined with reveal: true, a caller asking "what is FLAG set to?" received every secret on the resource (API keys, DB passwords, private keys) in plaintext into the MCP client context.

Fix

• action=list now filters the response to the requested key across all three resources (application / service / database). Filtering happens in the tool handler after the client fetch, so it applies to both masked and revealed projections.
• Tool description documents the key + reveal pattern ("always combine reveal with key so only the requested value is exposed").
• Behaviour without key is unchanged (full list, masked by default).

Tests

Three new cases in mcp-server.test.ts:

• list + key returns only the matching variable (application)
• list + key + reveal — response contains the requested value and does not contain the other variable's plaintext (service)
• list without key still returns all variables (database)

npm test — 420 passed, npm run lint — 0 errors, prettier clean.

🤖 Generated with Claude Code