Skip to main content
Glama

BotSpot: AI Trading, Backtests and Bots

Manage saved environment variables

saved_env_vars
Destructive

List, create, update, enable, disable, or delete saved environment variables (one variable per record). Raw values are never returned. Names BotSpot sets for its own runs, such as LUMIBOT_SCHEDULED_*, cannot be saved here.

Set "action" to choose the operation. Only send the fields listed for that action.

action="list": List saved environment variables

No other fields required. Lists saved environment variable metadata for the authenticated user. Raw values are never returned. Each item should normally represent one saved variable. Use returned ids as start_deployment.envVarSetIds, update_deployment_revision.envVarSetIds or start_backtest.envVarSetIds. Returned metadata includes displayName, keyNames, status, and timestamps only; it never includes raw values or Vault secret ids. Reserved runtime names and prefixes are rejected: AWS_*, BOTSPOT_*, BOT_MANAGER_*, DEPLOY_*, MCP_*, AUTH0_*, DB_*, DATABASE_*, CUSTOM_JWT_*, AI_SERVICE_*, PYTHON*, LD_*, DYLD_*, PIP_*, UV_*, ECS_*, NODE_API_*, LUMIBOT_SCHEDULED_*, LUMIBOT_LIVE_ARTIFACTS_*, BACKTEST_CACHE_*, plus PATH, PYTHONPATH, NODE_ENV, PORT, HOME, LD_PRELOAD and other interpreter controls. LUMIBOT_SCHEDULED_* and LUMIBOT_LIVE_ARTIFACTS_* values are set only by BotSpot for its own scheduled runs; never tell a user to save them or pass them through envVarSetIds, because BotSpot rejects them and the runtime ignores them.

action="create": Create saved environment variable

Required fields: variableName, value. Stores one environment variable value in Vault and returns only metadata for the authenticated user. Use this for non-broker runtime secrets such as data-provider API keys. Do not store broker credentials here when a saved broker credential can represent the broker connection. Reserved runtime names and prefixes are rejected: AWS_*, BOTSPOT_*, BOT_MANAGER_*, DEPLOY_*, MCP_*, AUTH0_*, DB_*, DATABASE_*, CUSTOM_JWT_*, AI_SERVICE_*, PYTHON*, LD_*, DYLD_*, PIP_*, UV_*, ECS_*, NODE_API_*, LUMIBOT_SCHEDULED_*, LUMIBOT_LIVE_ARTIFACTS_*, BACKTEST_CACHE_*, plus PATH, PYTHONPATH, NODE_ENV, PORT, HOME, LD_PRELOAD and other interpreter controls. LUMIBOT_SCHEDULED_* and LUMIBOT_LIVE_ARTIFACTS_* values are set only by BotSpot for its own scheduled runs; never tell a user to save them or pass them through envVarSetIds, because BotSpot rejects them and the runtime ignores them.

action="update": Update saved environment variable

Required fields: id. Updates saved variable metadata and optionally replaces its Vault value. Values are encrypted at rest and never returned to MCP. If variableName is omitted when replacing a value, the existing single key name is reused.

action="enable": Enable saved environment variable

Required fields: id. Re-enables a disabled saved environment variable record for the authenticated user. Enabled records can be used for future backtest/deployment secret injection. Raw values are never returned.

action="disable": Disable saved environment variable

Required fields: id. Reversibly disables a saved environment variable record for the authenticated user. Disabled records are not eligible for backtest/deployment secret injection or automatic selection, but metadata remains visible and can be re-enabled. Raw values are never returned.

action="delete": Delete saved environment variable

Required fields: id. Deletes saved variable material from Vault and marks the authenticated user's metadata row deleted. Deletion is rejected while any saved runtime preference still references the variable; detach every reference first.

Input Schema

NameRequiredDescriptionDefault
idNoUsed with action="update", action="enable", action="disable", action="delete". Required for action="update", action="enable", action="disable", action="delete".
valueNoUsed with action="create", action="update". Required for action="create".
actionYesWhich operation to run: "list", "create", "update", "enable", "disable", "delete". See the tool description for each one.
displayNameNoUsed with action="create", action="update".
variableNameNoUsed with action="create", action="update". Required for action="create".

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations mark the tool destructive and non-idempotent, and the description adds substantial context beyond them: raw values are never returned in any response, values are stored in Vault and encrypted at rest, disable is explicitly reversible while delete destroys Vault material and tombstones the metadata row. It also documents the reserved-name rejection surface and that LUMIBOT_SCHEDULED_* values are BotSpot-managed, which an agent could not infer from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The per-action structure is front-loaded and scannable, but there is heavy duplication: the entire reserved-prefix block is repeated verbatim under both list and create, and 'Raw values are never returned' recurs in four separate sections. Roughly a third of the text is redundant, which costs a definition that is otherwise well organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-action tool with a single flat schema and no output schema, the description covers what it needs to: required fields per action, returned metadata fields (displayName, keyNames, status, timestamps), what is never returned, downstream consumers of the ids, and the delete-blocking condition. An agent has everything needed to pick an action and build a valid call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description adds real meaning on top: it maps each parameter to specific actions, explains that variableName may be omitted on update (existing single key name is reused), and clarifies the relationship between displayName metadata and the stored key. It does not add format or length guidance beyond the schema, which caps it below 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names the resource (saved environment variables) and every verb the tool supports, then reinforces it with a per-action heading for each of the six operations. It also distinguishes itself from a sibling by warning against storing broker credentials when create_broker_credential can represent them, and it states downstream use of returned ids (start_deployment.envVarSetIds, backtest equivalents).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Each action section states required fields and when that action is the right one, e.g. create is for 'non-broker runtime secrets such as data-provider API keys' and explicitly not for broker credentials. Exclusions and prerequisites are also spelled out: reserved prefixes are rejected, and delete is refused while any saved runtime preference still references the variable, so references must be detached first.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.