Skip to main content
Glama

EnvSpeak

MCP 서버 및 CLI로, .env 파일, Docker Compose, Kubernetes 전반의 config/env-var 캐스케이드를 해석합니다 — AI 에이전트(그리고 여러분)에게 변수가 런타임에 실제로 평가되는 값과 그 이유를 알려줍니다.

CSS 캐스케이드와 동일한 문제 형태 — 여러 소스, 비직관적인 우선순위 규칙, 정의된 위치 때문에 "승리"하는 값 — 을 스타일시트 대신 애플리케이션 구성에 적용한 것입니다. CSS에 대해 동일한 작업을 수행하는 stylesafestylespeak의 자매 프로젝트입니다.

문제

실제 앱의 구성은 .env, .env.local, .env.production, docker-compose.yml (environment: vs env_file:), Kubernetes ConfigMap/Secret 객체, 코드의 하드코딩된 폴백에서 비롯됩니다 — 5개 이상의 레이어로, 각각 예상한 대로 조합되지 않는 자체 우선순위 규칙을 가집니다. 가장 잘 알려진 함정: .env.production.local도 함께 있지 않다면 일반 .env.local.env.production을 덮어씁니다 — 관례적인 dotenv 캐스케이드에서 "local"이 "환경별"보다 우선하기 때문입니다. 구성을 편집하는 에이전트는 변수가 실제로 무엇으로 해석되는지, 또는 한 레이어를 변경하면 무엇이 깨지는지 알 방법이 없습니다.

Related MCP server: onboard-mcp

도구

  • resolve_variableDATABASE_URL이 실제로 평가되는 값은 무엇이며, 어떤 파일이 우선할까요?

  • trace_variable — 이 변수가 설정된 모든 위치를 모든 도메인과 환경에 걸쳐 추적합니다.

  • impact_preview — 이 파일에서 이 값을 변경하면 다운스트림에서 실제로 무엇이 바뀌며, 더 높은 우선순위의 무언가에 의해 보호되는 것은 무엇일까요?

  • config_manifest — 압축된 전체 프로젝트 요약: 모든 변수, 해당 소스, 위험 지점(추적되는 파일에 있는 비밀값, 폴백도 소스도 없이 코드에서 읽히는 변수).

  • diff_environments — 두 환경/서비스/워크로드에서 모든 변수를 해석하고 실제로 무엇이 다른지 확인합니다.

설치

npm install -g @patrizzos/envspeak

MCP 서버로

{
  "mcpServers": {
    "envspeak": {
      "command": "envspeak"
    }
  }
}

CLI로

envspeak resolve DATABASE_URL --environment production
envspeak trace LOG_LEVEL
envspeak impact --file .env --variable LOG_LEVEL --newValue debug
envspeak manifest
envspeak diff --a '{"nodeEnv":"development"}' --b '{"nodeEnv":"production"}'

--files를 생략하면 envspeak는 --projectRoot(기본값: 현재 디렉터리) 아래의 .env*, Compose, Kubernetes 매니페스트 파일을 자동으로 발견합니다. --files a,b,c를 전달하여 명시적으로 범위를 지정하세요 — MCP 호출에 권장되며, 에이전트가 정확히 무엇을 읽을지 제어할 수 있습니다.

인코딩된 우선순위 규칙

dotenv (Next.js/Vite 스타일, 사실상의 표준): process.env (셸) > .env.[env].local > .env.local > .env.[env] > .env > 코드 폴백 (process.env.X || 'default'). .env.local.env.[env]보다 우선한다는 점에 유의하세요 — 위에서 언급한 함정입니다.

Docker Compose: docker compose run -e (CLI) > environment: > env_file: (충돌 시 목록의 마지막 파일이 우선) > Dockerfile ENV (분석되지 않음).

Kubernetes: 인라인 env:는 항상 envFrom:을 덮어씁니다 (대량 ConfigMap/Secret 가져오기; 그중에서 목록의 마지막 항목이 우선). 환경 변수 값은 파드 시작 시 고정됩니다 — 참조된 ConfigMap/Secret을 편집해도 재시작이나 롤아웃 없이는 실행 중인 파드에 도달하지 않습니다. impact_preview가 이를 표시합니다.

모든 결과에는 confidence 수준과 caveat 문자열이 포함됩니다. 셸에서 내보내거나 CLI로 전달된 오버라이드는 항상 가능하며 정적 분석에는 절대 보이지 않기 때문입니다 — envspeak는 가지지 못한 확신을 가장하기보다 이를 명시적으로 밝힙니다.

보안

  • 런타임 의존성 제로. Compose/Kubernetes 파일에 사용되는 YAML 부분집합 파서는 npm에서 가져오는 대신 직접 작성되었으므로 제3자 공급망 표면이 없습니다. npm audit은 구조적으로 깨끗합니다.

  • 경로 탐색 방지. 파일 읽기는 projectRoot를 기준으로 해석되며, 도구 호출에 조작된 상대 경로가 주어져도 이를 벗어나지 않습니다.

  • 프로토타입 오염 방지. YAML 콘텐츠에서 파싱된 객체 키(__proto__, constructor, prototype)는 속성 할당에 절대 사용되지 않습니다.

  • 비밀값은 기본적으로 마스킹됩니다. Kubernetes Secret 값은 어떤 도구가 표시하든 ab***yz 형태로만 표시되며 전체가 노출되지 않습니다.

  • 비밀값 가능성 휴리스틱. 변수 이름과 값 형태(AWS 키, GitHub 토큰, PEM 블록, 고엔트로피 자격 증명 형태 문자열)가 플래그로 표시되고, .gitignore와 교차 참조되어 조용히 통과되는 대신 secretFlag / 위험 지점으로 표면화됩니다.

  • 제한적이고 역추적 없는 정규식. 코드 기본값 스캔에 사용되는 패턴 매칭은 일치 길이를 제한하고 중첩 수량자를 피하여 대용량 파일에서 ReDoS를 방지합니다.

  • 이러한 보호 장치와 무관하게 envspeak는 지정한 파일을 모두 읽습니다 — 에이전트가 전달할 수 있는 files 목록의 범위를 파일시스템 접근 권한이 있는 도구를 범위 지정하는 것과 같은 방식으로 제한하세요.

개발

npm test   # zero dependencies — no install step needed

라이선스

MIT

Available Tools

5 tools
config_manifestB

Compressed, project-wide summary of every config variable found — sources, domains, and risk hotspots (likely secrets in tracked files, variables read in code with no source). Load once per session instead of repeated resolve_variable calls.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesYes
projectRootNo
maxVariablesNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the tool's output nature (compressed summary, sources, risk hotspots) and hints at performance ('load once per session'), suggesting it is a read-only aggregation operation. However, it does not explicitly state whether it modifies state, whether it performs file I/O that might have side effects, or any rate limits. The description is informative but not fully transparent about behavioral boundaries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that packs a lot of relevant information: purpose, content, and usage guidance. It front-loads the core purpose ('Compressed, project-wide summary') and then adds specifics. It is concise and well-structured, though it could be slightly less dense. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations, output schema, and parameter descriptions, the description must provide extensive context. It explains what the tool returns and gives a usage hint, but it omits essential details: what files are expected (input semantics), how projectRoot and maxVariables affect behavior, what the output format is, and when to use this versus other siblings beyond resolve_variable. The description is insufficient for an agent to confidently invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning the input schema provides no explanations for the three parameters. The description does not mention any of them (files, projectRoot, maxVariables). An agent has no clue from the description what values to provide or how the parameters affect the tool's behavior. The description completely fails to compensate for the schema gap, making parameter semantics severely deficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool's purpose: producing a compressed, project-wide summary of config variables, including sources, domains, and risk hotspots. It explicitly distinguishes itself from sibling resolve_variable by positioning as a session-level alternative, making it unambiguous what the tool does and when it differs from at least one sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: 'Load once per session instead of repeated resolve_variable calls.' This tells an agent when to prefer this tool over a specific sibling. However, it does not mention other siblings (trace_variable, impact_preview, diff_environments) or provide exclusions for when not to use this tool, so it's not fully comprehensive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diff_environmentsA

Resolves every variable under two different environment/service/workload selectors and reports what differs between them.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesYes
variablesNoOptional subset; defaults to every variable discovered
projectRootNo
environmentAYes{ nodeEnv?, service?, workload?, container?, label? }
environmentBYes{ nodeEnv?, service?, workload?, container?, label? }

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral burden. It conveys that the operation resolves variables and reports differences, implying a read-only comparison. However, it does not disclose output format, possible failure modes, performance implications, or whether any resolution side effects occur.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one dense, purposeful sentence with no filler. It front-loads the core verb and resource, states the comparison scope, and communicates the output concept without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With five parameters, nested objects, no output schema, and no annotations, this description leaves important gaps: what 'files' represents, what values the selectors may contain, what a 'difference' report looks like, and when this tool is preferable to resolve_variable or trace_variable. The core idea is present, but an agent would struggle to call it correctly without guessing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 60%; variables and the two environment objects have descriptions, and the description reinforces that all discovered variables are included by default. However, the required 'files' parameter and 'projectRoot' have no schema descriptions and the description does not clarify their meaning, leaving a critical input unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Resolves every variable') and a distinct resource ('two different environment/service/workload selectors'), then states the comparison outcome ('reports what differs'). This clearly separates it from siblings like resolve_variable, which handles a single variable, and trace_variable, which traces rather than diffs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'under two different environment/service/workload selectors' gives clear context for when to invoke this tool: when an agent needs to compare resolved variables across two configurations. It does not explicitly exclude alternatives or name sibling tools, but the intended scenario is apparent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

impact_previewB

Predicts which environments/services/workloads are actually affected if a variable's value in one file is changed (or removed) — including which contexts are shielded by a higher-precedence source.

ParametersJSON Schema
NameRequiredDescriptionDefault
fileYesThe file that would be edited
filesYes
newValueNoOmit to simulate removing the assignment entirely
variableYes
projectRootNo

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. It adds one meaningful behavior (higher-precedence shielding) but does not disclose whether the tool is read-only, error behavior (e.g., variable not found), or what the output is (e.g., list of affected items). This is a clear gap, but the precedence detail provides partial transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is a single, tight sentence that front-loads the verb 'Predicts' and packs in the core purpose plus a behavioral nuance. There is no redundant phrasing or filler—every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's moderate complexity (impact prediction across environments with precedence), the description omits critical context: it does not explain how parameters like 'files' and 'projectRoot' influence behavior, nor what the return value looks like. An agent would struggle to construct a correct call without additional inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 40%, so the description must compensate for poorly documented parameters like 'files', 'variable', and 'projectRoot'. It only indirectly references 'file' and 'variable' and does not clarify the purpose of 'files' (plural) or why 'projectRoot' is needed. This fails to add meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Predicts') and identifies the exact resource (environments/services/workloads affected by a variable change). It also adds a distinguishing nuance about precedence shielding, which differentiates it from siblings like resolve_variable or trace_variable without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool does but gives no guidance on when to use it versus alternatives. It does not mention conditions, exclusions, or situations where another sibling tool would be more appropriate. This leaves the agent without direction for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resolve_variableA

Resolves what a config/env variable actually evaluates to across dotenv, docker-compose, and Kubernetes sources, and which source wins.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesYesPaths (relative to projectRoot) to .env*, compose, and k8s manifest files to consider
serviceNodocker-compose service name to resolve for
variableYesThe variable name, e.g. DATABASE_URL
workloadNoKubernetes workload (Deployment/Pod/etc.) name to resolve for
containerNoKubernetes container name within the workload
environmentNoTarget NODE_ENV-style value for dotenv resolution, e.g. "production"
projectRootNoDirectory the file paths are relative to

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral burden. It does disclose important behavior: resolution spans dotenv, docker-compose, and Kubernetes, and precedence is evaluated. However, it does not state side-effect freedom, error behavior, missing-file handling, or any operational prerequisites, leaving notable gaps for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One concise, front-loaded sentence delivers the core function and the key differentiator (which source wins). There is no filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity of 7 parameters, full schema coverage, and no output schema, the description is largely sufficient: it states what the tool returns conceptually (evaluated value and winning source) and all parameters are otherwise documented. It could be stronger by noting how to handle missing variables or by connecting to sibling tools, but the essential selection and invocation context is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter. The description adds conceptual context by naming the source types, which loosely ties to files/service/workload/container, but it does not add parameter-level detail beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb ('resolves') and identifies the exact resource: what a config/env variable evaluates to across dotenv, docker-compose, and Kubernetes, including which source wins. This clearly differentiates it from siblings by focusing on multi-source resolution and precedence, not tracing, manifest inspection, impact, or diffing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a clear usage context: use when you need the actual evaluated value of a variable across multiple config-source types and the winning source. It does not explicitly name alternatives or state when not to use it, so it stops short of the strongest guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trace_variableA

Lists every place a variable is defined or read across dotenv, compose, k8s, and code, and what wins in each discovered environment/service/workload context.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesYes
variableYes
projectRootNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden, and it does a solid job: it reveals that the tool is a read/analysis operation that returns locations and precedence outcomes. It does not discuss edge cases or failure modes, but it clearly communicates the core observable behavior and that it is non-mutating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is one dense, front-loaded sentence with no filler. Every clause contributes meaning: what is listed, where it is searched, and what result is produced.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The core purpose is clear, but the definition is incomplete for reliable invocation: there is no output schema, no annotations, no guidance on files/projectRoot semantics, and no differentiation from sibling tools. An agent would likely need to inspect the schema or guess to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It clarifies that 'variable' is the trace target, but it gives no meaning for 'files' or 'projectRoot'—what files should contain, whether they are required, or how projectRoot changes discovery. This is a significant gap for a schema with no inline descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Lists'), names the resource (variable definitions/reads), and defines scope across dotenv, compose, k8s, and code. It also conveys a distinct deliverable ('what wins in each discovered environment/service/workload context'), which separates it from siblings like resolve_variable or diff_environments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage context is implied rather than explicit: an agent can infer this is the tool to use when all definition/read locations and precedence are needed. However, it never states when not to use it or names alternative tools, leaving the agent to reason from sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.7/5.0
Disambiguation4/5

Most tools are clearly separated by purpose: manifest summarizes, impact previews, diff compares, and trace enumerates. The only real overlap is between resolve_variable and trace_variable, since both explain precedence and 'what wins,' though one targets the final value and the other targets all definition/read locations.

Naming Consistency3/5

resolve_variable and trace_variable follow a clean verb_noun pattern, but config_manifest and impact_preview are noun compounds, and diff_environments uses a terse verb. The names are readable and descriptive, but the naming convention is not uniform across the set.

Tool Count5/5

Five tools is well-scoped for a read-only environment/config analysis server. Each tool covers a distinct analytical need without redundancy or bloat, and the count feels intentional rather than thin or excessive.

Completeness5/5

The set covers the full analysis workflow: resolving a single variable, tracing all usages, generating a project-wide manifest, predicting change impact, and diffing environments. No obvious missing operation is needed for the stated domain.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Checks your local development environment for common issues like wrong Node version, missing Docker, missing git config, missing .env keys, and busy ports, and provides fixes.
    6
    17
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables LLM clients to inspect local dev environments—Docker container health, pnpm workspace integrity, and stuck process detection—without manual terminal copy-pasting.
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Provides AI coding agents with structured, evidence-based diagnostics about the local development environment, detecting tech stack, runtime mismatches, dependency state, services, ports, and Git status without exposing secrets or using network calls.
    10
    Apache 2.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Patrizzos/EnvSpeak'

If you have feedback or need assistance with the MCP directory API, please join our Discord server