@masonator/coolify-mcp 2.8.1 → 2.10.0

package/dist/__tests__/coolify-client.test.js

@@ -1,12 +1,14 @@
 import { jest, describe, it, expect, beforeEach } from '@jest/globals';
 import { CoolifyClient } from '../lib/coolify-client.js';
 // Helper to create mock response
-function mockResponse(data, ok = true, status = 200) {
+function mockResponse(data, ok = true, status = 200, contentType = 'application/json') {
+    const body = contentType.includes('application/json') ? JSON.stringify(data) : String(data);
     return {
         ok,
         status,
         statusText: ok ? 'OK' : 'Error',
-        text: async () => JSON.stringify(data),
+        headers: new Headers({ 'Content-Type': contentType }),
+        text: async () => body,
     };
 }
 const mockFetch = jest.fn();
@@ -521,6 +523,21 @@ describe('CoolifyClient', () => {
             const result = await client.deleteServer('test-uuid');
             expect(result).toEqual({});
         });
+        it('should return plain text responses without JSON parsing', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse('log line 1\nlog line 2', true, 200, 'text/plain; charset=utf-8'));
+            const result = await client.getApplicationLogs('app-uuid', 50);
+            expect(result).toBe('log line 1\nlog line 2');
+        });
+        it('should fall back to raw text when JSON responses are malformed', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                status: 200,
+                headers: new Headers({ 'Content-Type': 'application/json' }),
+                text: async () => 'not valid json',
+            });
+            const result = await client.getApplicationLogs('app-uuid', 50);
+            expect(result).toBe('not valid json');
+        });
         it('should handle API errors without message', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse({}, false, 500));
             await expect(client.listServers()).rejects.toThrow('HTTP 500: Error');
@@ -952,6 +969,131 @@ describe('CoolifyClient', () => {
             expect(callBody.custom_docker_run_options).toBe('--network=my-net');
             expect(callBody.custom_labels).toBe('dHJhZWZpaw==');
         });
+        // Regression for #178 — verify build-config and health_check_* fields reach
+        // the wire, not just zod-accepted then silently stripped by the hand-pick.
+        it('should pass build-config and health_check fields through createApplicationPublic', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-app-uuid' }));
+            await client.createApplicationPublic({
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                git_repository: 'https://github.com/user/monorepo',
+                git_branch: 'main',
+                build_pack: 'dockerfile',
+                ports_exposes: '3000',
+                base_directory: '/apps/api',
+                publish_directory: '/dist',
+                install_command: 'pnpm install',
+                build_command: 'pnpm build',
+                start_command: 'node dist/main.js',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 3000,
+                health_check_start_period: 60,
+            });
+            const callBody = JSON.parse(mockFetch.mock.calls[0][1]?.body);
+            expect(callBody.base_directory).toBe('/apps/api');
+            expect(callBody.publish_directory).toBe('/dist');
+            expect(callBody.install_command).toBe('pnpm install');
+            expect(callBody.build_command).toBe('pnpm build');
+            expect(callBody.start_command).toBe('node dist/main.js');
+            expect(callBody.dockerfile_location).toBe('/apps/api/Dockerfile');
+            expect(callBody.watch_paths).toBe('apps/api/**');
+            expect(callBody.health_check_enabled).toBe(true);
+            expect(callBody.health_check_path).toBe('/health');
+            expect(callBody.health_check_port).toBe(3000);
+            expect(callBody.health_check_start_period).toBe(60);
+        });
+        it('should pass build-config and health_check fields through createApplicationPrivateGH', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-app-uuid' }));
+            await client.createApplicationPrivateGH({
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                github_app_uuid: 'gh-app-uuid',
+                git_repository: 'org/monorepo',
+                git_branch: 'main',
+                base_directory: '/apps/api',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+            });
+            const callBody = JSON.parse(mockFetch.mock.calls[0][1]?.body);
+            expect(callBody.base_directory).toBe('/apps/api');
+            expect(callBody.dockerfile_location).toBe('/apps/api/Dockerfile');
+            expect(callBody.watch_paths).toBe('apps/api/**');
+            expect(callBody.health_check_enabled).toBe(true);
+            expect(callBody.health_check_path).toBe('/health');
+        });
+        it('should pass build-config and health_check fields through createApplicationPrivateKey', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-app-uuid' }));
+            await client.createApplicationPrivateKey({
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                private_key_uuid: 'key-uuid',
+                git_repository: 'git@github.com:org/monorepo.git',
+                git_branch: 'main',
+                base_directory: '/apps/api',
+                publish_directory: '/dist',
+                install_command: 'pnpm install',
+                build_command: 'pnpm build',
+                start_command: 'node dist/main.js',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 3000,
+            });
+            const callBody = JSON.parse(mockFetch.mock.calls[0][1]?.body);
+            expect(callBody.base_directory).toBe('/apps/api');
+            expect(callBody.dockerfile_location).toBe('/apps/api/Dockerfile');
+            expect(callBody.watch_paths).toBe('apps/api/**');
+            expect(callBody.health_check_path).toBe('/health');
+            expect(callBody.health_check_port).toBe(3000);
+        });
+        it('should pass health_check fields through createApplicationDockerImage (build-config N/A)', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-app-uuid' }));
+            await client.createApplicationDockerImage({
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                docker_registry_image_name: 'traefik/whoami',
+                ports_exposes: '80',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 80,
+                health_check_method: 'GET',
+                health_check_scheme: 'http',
+                health_check_return_code: 200,
+                health_check_interval: 30,
+                health_check_timeout: 5,
+                health_check_retries: 3,
+                health_check_start_period: 60,
+            });
+            const callBody = JSON.parse(mockFetch.mock.calls[0][1]?.body);
+            expect(callBody.health_check_enabled).toBe(true);
+            expect(callBody.health_check_path).toBe('/health');
+            expect(callBody.health_check_port).toBe(80);
+            expect(callBody.health_check_method).toBe('GET');
+            expect(callBody.health_check_scheme).toBe('http');
+            expect(callBody.health_check_return_code).toBe(200);
+            expect(callBody.health_check_interval).toBe(30);
+            expect(callBody.health_check_timeout).toBe(5);
+            expect(callBody.health_check_retries).toBe(3);
+            expect(callBody.health_check_start_period).toBe(60);
+        });
+        it('should pass dockerfile_target_build through updateApplication (PATCH-only field)', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse(mockApplication));
+            await client.updateApplication('app-uuid', {
+                dockerfile_location: '/apps/api/Dockerfile',
+                dockerfile_target_build: 'production',
+                base_directory: '/apps/api',
+            });
+            const callBody = JSON.parse(mockFetch.mock.calls[0][1]?.body);
+            expect(callBody.dockerfile_location).toBe('/apps/api/Dockerfile');
+            expect(callBody.dockerfile_target_build).toBe('production');
+            expect(callBody.base_directory).toBe('/apps/api');
+        });
         it('should pass destination_uuid through in createApplicationPublic', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-app-uuid' }));
             await client.createApplicationPublic({
@@ -1154,21 +1296,72 @@ describe('CoolifyClient', () => {
             uuid: 'env-var-uuid',
             key: 'API_KEY',
             value: 'secret123',
-            is_build_time: false,
+            is_buildtime: false,
+            is_runtime: true,
         };
-        it('should list application env vars', async () => {
+        it('should list application env vars with values masked by default (#159)', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse([mockEnvVar]));
             const result = await client.listApplicationEnvVars('app-uuid');
-            expect(result).toEqual([mockEnvVar]);
+            // value masked, metadata preserved
+            expect(result).toEqual([
+                {
+                    uuid: 'env-var-uuid',
+                    key: 'API_KEY',
+                    value: '***',
+                    is_buildtime: false,
+                    is_runtime: true,
+                },
+            ]);
             expect(mockFetch).toHaveBeenCalledWith('http://localhost:3000/api/v1/applications/app-uuid/envs', expect.any(Object));
         });
-        it('should list application env vars with summary', async () => {
+        it('should list application env vars with real_value also masked on the full projection (#159)', async () => {
             const fullEnvVar = {
                 id: 1,
                 uuid: 'env-var-uuid',
                 key: 'API_KEY',
                 value: 'secret123',
-                is_build_time: false,
+                real_value: 'secret123',
+                is_buildtime: false,
+                is_runtime: true,
+                is_literal: true,
+                is_multiline: false,
+                is_preview: false,
+                is_shared: false,
+                is_shown_once: false,
+                application_id: 1,
+                created_at: '2024-01-01',
+                updated_at: '2024-01-01',
+            };
+            mockFetch.mockResolvedValueOnce(mockResponse([fullEnvVar]));
+            const result = (await client.listApplicationEnvVars('app-uuid'));
+            expect(result[0].value).toBe('***');
+            expect(result[0].real_value).toBe('***');
+            // Metadata stays intact
+            expect(result[0]).toMatchObject({
+                uuid: 'env-var-uuid',
+                key: 'API_KEY',
+                is_buildtime: false,
+                is_runtime: true,
+                is_literal: true,
+                is_preview: false,
+                application_id: 1,
+                created_at: '2024-01-01',
+                updated_at: '2024-01-01',
+            });
+        });
+        it('should list application env vars with real values when reveal=true (#159)', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse([mockEnvVar]));
+            const result = await client.listApplicationEnvVars('app-uuid', { reveal: true });
+            expect(result).toEqual([mockEnvVar]);
+        });
+        it('should list application env vars with summary, masked by default (#159)', async () => {
+            const fullEnvVar = {
+                id: 1,
+                uuid: 'env-var-uuid',
+                key: 'API_KEY',
+                value: 'secret123',
+                is_buildtime: false,
+                is_runtime: true,
                 is_literal: true,
                 is_multiline: false,
                 is_preview: false,
@@ -1180,13 +1373,46 @@ describe('CoolifyClient', () => {
             };
             mockFetch.mockResolvedValueOnce(mockResponse([fullEnvVar]));
             const result = await client.listApplicationEnvVars('app-uuid', { summary: true });
-            // Summary should only include uuid, key, value, is_build_time
+            // Summary should only include uuid, key, value, is_buildtime, is_runtime — and value masked
+            expect(result).toEqual([
+                {
+                    uuid: 'env-var-uuid',
+                    key: 'API_KEY',
+                    value: '***',
+                    is_buildtime: false,
+                    is_runtime: true,
+                },
+            ]);
+        });
+        it('should list application env vars with summary and reveal=true returning real values (#159)', async () => {
+            const fullEnvVar = {
+                id: 1,
+                uuid: 'env-var-uuid',
+                key: 'API_KEY',
+                value: 'secret123',
+                is_buildtime: false,
+                is_runtime: true,
+                is_literal: true,
+                is_multiline: false,
+                is_preview: false,
+                is_shared: false,
+                is_shown_once: false,
+                application_id: 1,
+                created_at: '2024-01-01',
+                updated_at: '2024-01-01',
+            };
+            mockFetch.mockResolvedValueOnce(mockResponse([fullEnvVar]));
+            const result = await client.listApplicationEnvVars('app-uuid', {
+                summary: true,
+                reveal: true,
+            });
             expect(result).toEqual([
                 {
                     uuid: 'env-var-uuid',
                     key: 'API_KEY',
                     value: 'secret123',
-                    is_build_time: false,
+                    is_buildtime: false,
+                    is_runtime: true,
                 },
             ]);
         });
@@ -1195,10 +1421,31 @@ describe('CoolifyClient', () => {
             const result = await client.createApplicationEnvVar('app-uuid', {
                 key: 'NEW_VAR',
                 value: 'new-value',
-                is_build_time: true,
+                is_buildtime: true,
             });
             expect(result).toEqual({ uuid: 'new-env-uuid' });
         });
+        it('should create runtime-only env var (no Dockerfile ARG injection)', async () => {
+            // Regression for #135: setting is_buildtime=false avoids multiline values
+            // (PEM keys, etc.) being injected as Dockerfile ARG and breaking the build.
+            mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-env-uuid' }));
+            await client.createApplicationEnvVar('app-uuid', {
+                key: 'PASSPORT_PRIVATE_KEY',
+                value: '-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+            expect(mockFetch).toHaveBeenCalledWith('http://localhost:3000/api/v1/applications/app-uuid/envs', expect.objectContaining({
+                method: 'POST',
+                body: expect.stringContaining('"is_buildtime":false'),
+            }));
+            const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+            expect(body).toMatchObject({
+                key: 'PASSPORT_PRIVATE_KEY',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+        });
         it('should update application env var', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse({ message: 'Updated' }));
             const result = await client.updateApplicationEnvVar('app-uuid', {
@@ -1207,6 +1454,22 @@ describe('CoolifyClient', () => {
             });
             expect(result).toEqual({ message: 'Updated' });
         });
+        it('should update env var to runtime-only (flip is_buildtime=false)', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse({ message: 'Updated' }));
+            await client.updateApplicationEnvVar('app-uuid', {
+                key: 'NODE_ENV',
+                value: 'production',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+            const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+            expect(body).toEqual({
+                key: 'NODE_ENV',
+                value: 'production',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+        });
         it('should bulk update application env vars', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse({ message: 'Updated' }));
             const result = await client.bulkUpdateApplicationEnvVars('app-uuid', {
@@ -1482,12 +1745,54 @@ describe('CoolifyClient', () => {
             key: 'SVC_KEY',
             value: 'svc-value',
         };
-        it('should list service env vars', async () => {
+        it('should list service env vars with values masked by default (#159)', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse([mockEnvVar]));
             const result = await client.listServiceEnvVars('test-uuid');
-            expect(result).toEqual([mockEnvVar]);
+            // value masked, metadata (uuid, key) preserved
+            expect(result).toEqual([
+                {
+                    uuid: 'svc-env-uuid',
+                    key: 'SVC_KEY',
+                    value: '***',
+                },
+            ]);
             expect(mockFetch).toHaveBeenCalledWith('http://localhost:3000/api/v1/services/test-uuid/envs', expect.any(Object));
         });
+        it('should list service env vars with real_value masked on the full projection (#159)', async () => {
+            const fullEnvVar = {
+                id: 1,
+                uuid: 'svc-env-uuid',
+                key: 'SVC_KEY',
+                value: 'svc-value',
+                real_value: 'svc-value',
+                is_buildtime: false,
+                is_runtime: true,
+                is_literal: true,
+                is_multiline: false,
+                is_preview: false,
+                is_shared: false,
+                is_shown_once: false,
+                service_id: 42,
+                created_at: '2024-01-01',
+                updated_at: '2024-01-01',
+            };
+            mockFetch.mockResolvedValueOnce(mockResponse([fullEnvVar]));
+            const result = await client.listServiceEnvVars('test-uuid');
+            expect(result[0].value).toBe('***');
+            expect(result[0].real_value).toBe('***');
+            expect(result[0]).toMatchObject({
+                uuid: 'svc-env-uuid',
+                key: 'SVC_KEY',
+                is_buildtime: false,
+                is_runtime: true,
+                service_id: 42,
+            });
+        });
+        it('should list service env vars with real values when reveal=true (#159)', async () => {
+            mockFetch.mockResolvedValueOnce(mockResponse([mockEnvVar]));
+            const result = await client.listServiceEnvVars('test-uuid', { reveal: true });
+            expect(result).toEqual([mockEnvVar]);
+        });
         it('should create service env var', async () => {
             mockFetch.mockResolvedValueOnce(mockResponse({ uuid: 'new-env-uuid' }));
             const result = await client.createServiceEnvVar('test-uuid', {
@@ -2008,9 +2313,17 @@ describe('CoolifyClient', () => {
                     uuid: 'env-1',
                     key: 'DATABASE_URL',
                     value: 'postgres://...',
-                    is_build_time: false,
+                    is_buildtime: false,
+                    is_runtime: true,
+                },
+                {
+                    id: 2,
+                    uuid: 'env-2',
+                    key: 'NODE_ENV',
+                    value: 'production',
+                    is_buildtime: true,
+                    is_runtime: true,
                 },
-                { id: 2, uuid: 'env-2', key: 'NODE_ENV', value: 'production', is_build_time: true },
             ];
             const mockDeployments = [
                 {
@@ -2057,12 +2370,28 @@ describe('CoolifyClient', () => {
                 expect(result.logs).toBe(mockLogs);
                 expect(result.environment_variables.count).toBe(2);
                 expect(result.environment_variables.variables).toEqual([
-                    { key: 'DATABASE_URL', is_build_time: false },
-                    { key: 'NODE_ENV', is_build_time: true },
+                    { key: 'DATABASE_URL', is_buildtime: false, is_runtime: true },
+                    { key: 'NODE_ENV', is_buildtime: true, is_runtime: true },
                 ]);
                 expect(result.recent_deployments).toHaveLength(2);
                 expect(result.errors).toBeUndefined();
             });
+            it('should apply default flags when env var omits is_buildtime/is_runtime', async () => {
+                // Hits the `?? false` / `?? true` fallback branches in the diagnose mapping
+                // for legacy Coolify responses that don't carry both flags explicitly.
+                const envVarsMissingFlags = [
+                    { id: 1, uuid: 'env-1', key: 'LEGACY_VAR', value: 'x' },
+                ];
+                mockFetch
+                    .mockResolvedValueOnce(mockResponse(mockApp))
+                    .mockResolvedValueOnce(mockResponse(mockLogs))
+                    .mockResolvedValueOnce(mockResponse(envVarsMissingFlags))
+                    .mockResolvedValueOnce(mockResponse({ count: 0, deployments: [] }));
+                const result = await client.diagnoseApplication(testAppUuid);
+                expect(result.environment_variables.variables).toEqual([
+                    { key: 'LEGACY_VAR', is_buildtime: false, is_runtime: true },
+                ]);
+            });
             it('should detect unhealthy application status', async () => {
                 const unhealthyApp = { ...mockApp, status: 'exited:unhealthy' };
                 mockFetch
@@ -2543,15 +2872,40 @@ describe('CoolifyClient', () => {
                 // No API calls should be made
                 expect(mockFetch).not.toHaveBeenCalled();
             });
-            it('should send build time flag when specified', async () => {
+            it('should send buildtime flag when specified', async () => {
                 mockFetch
                     .mockResolvedValueOnce(mockResponse(mockApps))
                     .mockResolvedValueOnce(mockResponse({ message: 'Updated' }));
                 await client.bulkEnvUpdate(['app-1'], 'BUILD_VAR', 'value', true);
-                // Verify the PATCH call was made with is_build_time
+                // Verify the PATCH call was made with is_buildtime (one word — Coolify API field name)
+                expect(mockFetch).toHaveBeenCalledWith('http://localhost:3000/api/v1/applications/app-1/envs', expect.objectContaining({
+                    method: 'PATCH',
+                    body: JSON.stringify({ key: 'BUILD_VAR', value: 'value', is_buildtime: true }),
+                }));
+            });
+            it('should send both buildtime and runtime flags for runtime-only vars', async () => {
+                mockFetch
+                    .mockResolvedValueOnce(mockResponse(mockApps))
+                    .mockResolvedValueOnce(mockResponse({ message: 'Updated' }));
+                await client.bulkEnvUpdate(['app-1'], 'PEM_KEY', 'multiline-value', false, true);
+                expect(mockFetch).toHaveBeenCalledWith('http://localhost:3000/api/v1/applications/app-1/envs', expect.objectContaining({
+                    method: 'PATCH',
+                    body: JSON.stringify({
+                        key: 'PEM_KEY',
+                        value: 'multiline-value',
+                        is_buildtime: false,
+                        is_runtime: true,
+                    }),
+                }));
+            });
+            it('should send only is_runtime when buildtime is left undefined', async () => {
+                mockFetch
+                    .mockResolvedValueOnce(mockResponse(mockApps))
+                    .mockResolvedValueOnce(mockResponse({ message: 'Updated' }));
+                await client.bulkEnvUpdate(['app-1'], 'API_KEY', 'val', undefined, false);
                 expect(mockFetch).toHaveBeenCalledWith('http://localhost:3000/api/v1/applications/app-1/envs', expect.objectContaining({
                     method: 'PATCH',
-                    body: JSON.stringify({ key: 'BUILD_VAR', value: 'value', is_build_time: true }),
+                    body: JSON.stringify({ key: 'API_KEY', value: 'val', is_runtime: false }),
                 }));
             });
         });

package/dist/__tests__/integration/diagnostics.integration.test.js

@@ -54,11 +54,12 @@ describeFn('Diagnostic Integration Tests', () => {
             expect(result.environment_variables).toBeDefined();
             expect(typeof result.environment_variables.count).toBe('number');
             expect(Array.isArray(result.environment_variables.variables)).toBe(true);
-            // Values should be hidden (only key and is_build_time exposed)
+            // Values should be hidden (only key, is_buildtime, is_runtime exposed)
             if (result.environment_variables.variables.length > 0) {
                 const firstVar = result.environment_variables.variables[0];
                 expect(firstVar).toHaveProperty('key');
-                expect(firstVar).toHaveProperty('is_build_time');
+                expect(firstVar).toHaveProperty('is_buildtime');
+                expect(firstVar).toHaveProperty('is_runtime');
                 expect(firstVar).not.toHaveProperty('value');
             }
             // Should have recent deployments array

package/dist/__tests__/mcp-server.test.js

@@ -6,7 +6,7 @@
  * These tests verify MCP server instantiation and structure.
  */
 import { createRequire } from 'module';
-import { describe, it, expect, beforeEach } from '@jest/globals';
+import { describe, it, expect, beforeEach, jest } from '@jest/globals';
 import { CoolifyMcpServer, VERSION, truncateLogs, getApplicationActions, getDeploymentActions, getPagination, } from '../lib/mcp-server.js';
 describe('CoolifyMcpServer v2', () => {
     let server;
@@ -161,6 +161,268 @@ describe('CoolifyMcpServer v2', () => {
             expect(client['accessToken']).toBe('test-token');
         });
     });
+    describe('env_vars tool handler', () => {
+        // Reach the SDK-registered handler so the is_buildtime / is_runtime
+        // passthrough lines are actually executed (not just type-checked).
+        const callEnvVars = async (srv, args) => {
+            const tool = srv._registeredTools['env_vars'];
+            return tool.handler(args, {});
+        };
+        it('forwards is_buildtime/is_runtime to createApplicationEnvVar', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'createApplicationEnvVar')
+                .mockResolvedValue({ uuid: 'env-1' });
+            await callEnvVars(server, {
+                resource: 'application',
+                action: 'create',
+                uuid: 'app-uuid',
+                key: 'PEM_KEY',
+                value: '-----BEGIN-----',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+            expect(spy).toHaveBeenCalledWith('app-uuid', {
+                key: 'PEM_KEY',
+                value: '-----BEGIN-----',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+        });
+        it('forwards is_buildtime/is_runtime to updateApplicationEnvVar', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'updateApplicationEnvVar')
+                .mockResolvedValue({ message: 'Updated' });
+            await callEnvVars(server, {
+                resource: 'application',
+                action: 'update',
+                uuid: 'app-uuid',
+                key: 'NODE_ENV',
+                value: 'production',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+            expect(spy).toHaveBeenCalledWith('app-uuid', {
+                key: 'NODE_ENV',
+                value: 'production',
+                is_buildtime: false,
+                is_runtime: true,
+            });
+        });
+        it('forwards is_buildtime/is_runtime to createServiceEnvVar', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'createServiceEnvVar')
+                .mockResolvedValue({ uuid: 'env-1' });
+            await callEnvVars(server, {
+                resource: 'service',
+                action: 'create',
+                uuid: 'svc-uuid',
+                key: 'API_KEY',
+                value: 'secret',
+                is_buildtime: true,
+                is_runtime: undefined,
+            });
+            expect(spy).toHaveBeenCalledWith('svc-uuid', {
+                key: 'API_KEY',
+                value: 'secret',
+                is_buildtime: true,
+                is_runtime: undefined,
+            });
+        });
+        it('returns key/value error when create is missing required fields', async () => {
+            const result = (await callEnvVars(server, {
+                resource: 'application',
+                action: 'create',
+                uuid: 'app-uuid',
+            }));
+            expect(result.content[0].text).toContain('key, value required');
+        });
+        it('returns key/value error when service create is missing required fields', async () => {
+            const result = (await callEnvVars(server, {
+                resource: 'service',
+                action: 'create',
+                uuid: 'svc-uuid',
+            }));
+            expect(result.content[0].text).toContain('key, value required');
+        });
+    });
+    describe('bulk_env_update tool handler', () => {
+        it('forwards is_buildtime/is_runtime to bulkEnvUpdate', async () => {
+            const spy = jest.spyOn(server['client'], 'bulkEnvUpdate').mockResolvedValue({
+                summary: { total: 2, succeeded: 2, failed: 0 },
+                succeeded: [],
+                failed: [],
+            });
+            const tool = server._registeredTools['bulk_env_update'];
+            await tool.handler({
+                app_uuids: ['app-1', 'app-2'],
+                key: 'PEM_KEY',
+                value: 'multiline',
+                is_buildtime: false,
+                is_runtime: true,
+            }, {});
+            expect(spy).toHaveBeenCalledWith(['app-1', 'app-2'], 'PEM_KEY', 'multiline', false, true);
+        });
+    });
+    describe('application tool handler', () => {
+        // Regression for #178 — verify the application tool's create_* hand-picks
+        // forward build-config and health_check_* fields to the client. Previously
+        // these fields were accepted by zod but silently dropped by the hand-pick.
+        const callApplication = async (srv, args) => {
+            const tool = srv._registeredTools['application'];
+            return tool.handler(args, {});
+        };
+        const baseCreatePublic = {
+            action: 'create_public',
+            project_uuid: 'proj-uuid',
+            server_uuid: 'server-uuid',
+            git_repository: 'https://github.com/org/monorepo',
+            git_branch: 'main',
+            build_pack: 'dockerfile',
+            ports_exposes: '3000',
+        };
+        it('forwards build-config and health_check fields in create_public', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'createApplicationPublic')
+                .mockResolvedValue({ uuid: 'app-1' });
+            await callApplication(server, {
+                ...baseCreatePublic,
+                base_directory: '/apps/api',
+                publish_directory: '/dist',
+                install_command: 'pnpm install',
+                build_command: 'pnpm build',
+                start_command: 'node dist/main.js',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 3000,
+                health_check_start_period: 60,
+            });
+            expect(spy).toHaveBeenCalledWith(expect.objectContaining({
+                base_directory: '/apps/api',
+                publish_directory: '/dist',
+                install_command: 'pnpm install',
+                build_command: 'pnpm build',
+                start_command: 'node dist/main.js',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 3000,
+                health_check_start_period: 60,
+            }));
+        });
+        it('forwards build-config and health_check fields in create_github', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'createApplicationPrivateGH')
+                .mockResolvedValue({ uuid: 'app-2' });
+            await callApplication(server, {
+                action: 'create_github',
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                github_app_uuid: 'gh-app-uuid',
+                git_repository: 'org/monorepo',
+                git_branch: 'main',
+                base_directory: '/apps/api',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+            });
+            expect(spy).toHaveBeenCalledWith(expect.objectContaining({
+                base_directory: '/apps/api',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+            }));
+        });
+        it('forwards build-config and health_check fields in create_key', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'createApplicationPrivateKey')
+                .mockResolvedValue({ uuid: 'app-3' });
+            await callApplication(server, {
+                action: 'create_key',
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                private_key_uuid: 'key-uuid',
+                git_repository: 'git@github.com:org/monorepo.git',
+                git_branch: 'main',
+                base_directory: '/apps/api',
+                publish_directory: '/dist',
+                install_command: 'pnpm install',
+                build_command: 'pnpm build',
+                start_command: 'node dist/main.js',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 3000,
+            });
+            expect(spy).toHaveBeenCalledWith(expect.objectContaining({
+                base_directory: '/apps/api',
+                publish_directory: '/dist',
+                install_command: 'pnpm install',
+                build_command: 'pnpm build',
+                start_command: 'node dist/main.js',
+                dockerfile_location: '/apps/api/Dockerfile',
+                watch_paths: 'apps/api/**',
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 3000,
+            }));
+        });
+        it('forwards health_check fields in create_dockerimage (build-config intentionally dropped)', async () => {
+            const spy = jest
+                .spyOn(server['client'], 'createApplicationDockerImage')
+                .mockResolvedValue({ uuid: 'app-4' });
+            // Caller passes both healthcheck AND build-config. Coolify's /applications/dockerimage
+            // endpoint doesn't accept build-config (pre-built image), so handler must drop those.
+            await callApplication(server, {
+                action: 'create_dockerimage',
+                project_uuid: 'proj-uuid',
+                server_uuid: 'server-uuid',
+                docker_registry_image_name: 'traefik/whoami',
+                ports_exposes: '80',
+                // Should be forwarded:
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 80,
+                // Should NOT be forwarded (build-config not applicable to prebuilt image):
+                base_directory: '/should-be-dropped',
+                install_command: 'should-be-dropped',
+                dockerfile_location: '/should-be-dropped',
+            });
+            const forwarded = spy.mock.calls[0]?.[0];
+            expect(forwarded).toEqual(expect.objectContaining({
+                health_check_enabled: true,
+                health_check_path: '/health',
+                health_check_port: 80,
+            }));
+            expect(forwarded).not.toHaveProperty('base_directory');
+            expect(forwarded).not.toHaveProperty('install_command');
+            expect(forwarded).not.toHaveProperty('dockerfile_location');
+        });
+        it('forwards dockerfile_target_build through update (PATCH-only)', async () => {
+            const spy = jest.spyOn(server['client'], 'updateApplication').mockResolvedValue({});
+            await callApplication(server, {
+                action: 'update',
+                uuid: 'app-uuid',
+                dockerfile_location: '/apps/api/Dockerfile',
+                dockerfile_target_build: 'production',
+                base_directory: '/apps/api',
+            });
+            expect(spy).toHaveBeenCalledWith('app-uuid', expect.objectContaining({
+                dockerfile_location: '/apps/api/Dockerfile',
+                dockerfile_target_build: 'production',
+                base_directory: '/apps/api',
+            }));
+            // Confirm the update spread strips routing fields.
+            const updateData = spy.mock.calls[0]?.[1];
+            expect(updateData).not.toHaveProperty('action');
+            expect(updateData).not.toHaveProperty('uuid');
+        });
+    });
 });
 describe('truncateLogs', () => {
     // Plain text log tests

package/dist/lib/coolify-client.d.ts

@@ -125,8 +125,16 @@ export declare class CoolifyClient {
     }): Promise<ApplicationActionResponse>;
     stopApplication(uuid: string): Promise<ApplicationActionResponse>;
     restartApplication(uuid: string): Promise<ApplicationActionResponse>;
+    /**
+     * List env vars for an application.
+     *
+     * Default behaviour masks `value` (and `real_value` on the full projection)
+     * with a sentinel string so secrets are not leaked to MCP clients. Pass
+     * `reveal: true` when the caller explicitly needs the plaintext value.
+     */
     listApplicationEnvVars(uuid: string, options?: {
         summary?: boolean;
+        reveal?: boolean;
     }): Promise<EnvironmentVariable[] | EnvVarSummary[]>;
     createApplicationEnvVar(uuid: string, data: CreateEnvVarRequest): Promise<UuidResponse>;
     updateApplicationEnvVar(uuid: string, data: UpdateEnvVarRequest): Promise<MessageResponse>;
@@ -155,7 +163,16 @@ export declare class CoolifyClient {
     startService(uuid: string): Promise<MessageResponse>;
     stopService(uuid: string): Promise<MessageResponse>;
     restartService(uuid: string): Promise<MessageResponse>;
-    listServiceEnvVars(uuid: string): Promise<EnvironmentVariable[]>;
+    /**
+     * List env vars for a service.
+     *
+     * Default behaviour masks `value` (and `real_value`) with a sentinel string
+     * so secrets are not leaked to MCP clients. Pass `reveal: true` when the
+     * caller explicitly needs the plaintext value.
+     */
+    listServiceEnvVars(uuid: string, options?: {
+        reveal?: boolean;
+    }): Promise<EnvironmentVariable[]>;
     createServiceEnvVar(uuid: string, data: CreateEnvVarRequest): Promise<UuidResponse>;
     updateServiceEnvVar(uuid: string, data: UpdateEnvVarRequest): Promise<MessageResponse>;
     deleteServiceEnvVar(uuid: string, envUuid: string): Promise<MessageResponse>;
@@ -257,9 +274,10 @@ export declare class CoolifyClient {
      * @param appUuids - Array of application UUIDs
      * @param key - Environment variable key
      * @param value - Environment variable value
-     * @param isBuildTime - Whether this is a build-time variable (default: false)
+     * @param isBuildtime - Sets the build-time flag on the variable when provided
+     * @param isRuntime - Sets the runtime flag on the variable when provided
      */
-    bulkEnvUpdate(appUuids: string[], key: string, value: string, isBuildTime?: boolean): Promise<BatchOperationResult>;
+    bulkEnvUpdate(appUuids: string[], key: string, value: string, isBuildtime?: boolean, isRuntime?: boolean): Promise<BatchOperationResult>;
     /**
      * Emergency stop all running applications across entire infrastructure.
      */

package/dist/lib/coolify-client.js

@@ -142,7 +142,42 @@ function toEnvVarSummary(envVar) {
         uuid: envVar.uuid,
         key: envVar.key,
         value: envVar.value,
-        is_build_time: envVar.is_build_time,
+        is_buildtime: envVar.is_buildtime,
+        is_runtime: envVar.is_runtime,
+    };
+}
+/**
+ * Sentinel string used to replace plaintext env var values when masking.
+ * Exported via behaviour, not as a public API — clients should treat any
+ * non-real string as "value not returned".
+ */
+const MASKED_VALUE = '***';
+/**
+ * Mask the `value` and `real_value` fields on a full {@link EnvironmentVariable}.
+ * All other metadata (uuid, key, flags, timestamps, ids) is preserved verbatim.
+ *
+ * Applied at the API boundary so callers cannot accidentally leak secrets to
+ * an LLM client by forgetting to strip values downstream. Pair with the
+ * `reveal: true` opt-in on list methods when the caller genuinely needs the
+ * plaintext (e.g. "what is FOO set to right now?").
+ */
+function maskEnvVar(envVar) {
+    const masked = {
+        ...envVar,
+        value: MASKED_VALUE,
+    };
+    if (envVar.real_value !== undefined) {
+        masked.real_value = MASKED_VALUE;
+    }
+    return masked;
+}
+/**
+ * Mask the `value` field on an {@link EnvVarSummary}. Metadata is preserved.
+ */
+function maskEnvVarSummary(envVar) {
+    return {
+        ...envVar,
+        value: MASKED_VALUE,
     };
 }
 /**
@@ -192,7 +227,22 @@ export class CoolifyClient {
             });
             // Handle empty responses (204 No Content, etc.)
             const text = await response.text();
-            const data = text ? JSON.parse(text) : {};
+            const contentType = response.headers?.get('Content-Type')?.toLowerCase() ?? '';
+            const isJsonResponse = !contentType || contentType.includes('application/json') || contentType.includes('+json');
+            let data = {};
+            if (text) {
+                if (isJsonResponse) {
+                    try {
+                        data = JSON.parse(text);
+                    }
+                    catch {
+                        data = text;
+                    }
+                }
+                else {
+                    data = text;
+                }
+            }
             if (!response.ok) {
                 const error = data;
                 // Include validation errors if present
@@ -476,9 +526,21 @@ export class CoolifyClient {
     // ===========================================================================
     // Application Environment Variables
     // ===========================================================================
+    /**
+     * List env vars for an application.
+     *
+     * Default behaviour masks `value` (and `real_value` on the full projection)
+     * with a sentinel string so secrets are not leaked to MCP clients. Pass
+     * `reveal: true` when the caller explicitly needs the plaintext value.
+     */
     async listApplicationEnvVars(uuid, options) {
         const envVars = await this.request(`/applications/${uuid}/envs`);
-        return options?.summary ? envVars.map(toEnvVarSummary) : envVars;
+        const reveal = options?.reveal === true;
+        if (options?.summary) {
+            const summaries = envVars.map(toEnvVarSummary);
+            return reveal ? summaries : summaries.map(maskEnvVarSummary);
+        }
+        return reveal ? envVars : envVars.map(maskEnvVar);
     }
     async createApplicationEnvVar(uuid, data) {
         return this.request(`/applications/${uuid}/envs`, {
@@ -661,8 +723,16 @@ export class CoolifyClient {
     // ===========================================================================
     // Service Environment Variables
     // ===========================================================================
-    async listServiceEnvVars(uuid) {
-        return this.request(`/services/${uuid}/envs`);
+    /**
+     * List env vars for a service.
+     *
+     * Default behaviour masks `value` (and `real_value`) with a sentinel string
+     * so secrets are not leaked to MCP clients. Pass `reveal: true` when the
+     * caller explicitly needs the plaintext value.
+     */
+    async listServiceEnvVars(uuid, options) {
+        const envVars = await this.request(`/services/${uuid}/envs`);
+        return options?.reveal === true ? envVars : envVars.map(maskEnvVar);
     }
     async createServiceEnvVar(uuid, data) {
         return this.request(`/services/${uuid}/envs`, {
@@ -1026,7 +1096,8 @@ export class CoolifyClient {
                 count: envVars?.length || 0,
                 variables: (envVars || []).map((v) => ({
                     key: v.key,
-                    is_build_time: v.is_build_time ?? false,
+                    is_buildtime: v.is_buildtime ?? false,
+                    is_runtime: v.is_runtime ?? true,
                 })),
             },
             recent_deployments: (deployments || []).slice(0, 5).map((d) => ({
@@ -1292,9 +1363,10 @@ export class CoolifyClient {
      * @param appUuids - Array of application UUIDs
      * @param key - Environment variable key
      * @param value - Environment variable value
-     * @param isBuildTime - Whether this is a build-time variable (default: false)
+     * @param isBuildtime - Sets the build-time flag on the variable when provided
+     * @param isRuntime - Sets the runtime flag on the variable when provided
      */
-    async bulkEnvUpdate(appUuids, key, value, isBuildTime = false) {
+    async bulkEnvUpdate(appUuids, key, value, isBuildtime, isRuntime) {
         // Early return for empty array - avoid unnecessary API call
         if (appUuids.length === 0) {
             return {
@@ -1311,7 +1383,12 @@ export class CoolifyClient {
             uuid,
             name: appMap.get(uuid) || uuid,
         }));
-        const results = await Promise.allSettled(appUuids.map((uuid) => this.updateApplicationEnvVar(uuid, { key, value, is_build_time: isBuildTime })));
+        const results = await Promise.allSettled(appUuids.map((uuid) => this.updateApplicationEnvVar(uuid, {
+            key,
+            value,
+            is_buildtime: isBuildtime,
+            is_runtime: isRuntime,
+        })));
         return this.aggregateBatchResults(resources, results);
     }
     /**

package/dist/lib/mcp-server.js

@@ -340,6 +340,18 @@ export class CoolifyMcpServer extends McpServer {
             health_check_timeout: z.number().optional(),
             health_check_retries: z.number().optional(),
             health_check_start_period: z.number().optional(),
+            // Build configuration fields (accepted on create_public/github/key + update;
+            // create_dockerimage ignores these — pre-built image, no build step)
+            base_directory: z.string().optional(),
+            publish_directory: z.string().optional(),
+            install_command: z.string().optional(),
+            build_command: z.string().optional(),
+            start_command: z.string().optional(),
+            dockerfile_location: z.string().optional(),
+            watch_paths: z.string().optional(),
+            // Update-only: Coolify strips dockerfile_target_build on every create endpoint
+            // (controller $allowedFields line 1014) but accepts on PATCH (line 2497).
+            dockerfile_target_build: z.string().optional(),
             // Delete fields
             delete_volumes: z.boolean().optional(),
         }, async (args) => {
@@ -375,6 +387,25 @@ export class CoolifyMcpServer extends McpServer {
                         description: args.description,
                         fqdn: args.fqdn,
                         domains: args.domains,
+                        base_directory: args.base_directory,
+                        publish_directory: args.publish_directory,
+                        install_command: args.install_command,
+                        build_command: args.build_command,
+                        start_command: args.start_command,
+                        dockerfile_location: args.dockerfile_location,
+                        watch_paths: args.watch_paths,
+                        health_check_enabled: args.health_check_enabled,
+                        health_check_path: args.health_check_path,
+                        health_check_port: args.health_check_port,
+                        health_check_host: args.health_check_host,
+                        health_check_method: args.health_check_method,
+                        health_check_return_code: args.health_check_return_code,
+                        health_check_scheme: args.health_check_scheme,
+                        health_check_response_text: args.health_check_response_text,
+                        health_check_interval: args.health_check_interval,
+                        health_check_timeout: args.health_check_timeout,
+                        health_check_retries: args.health_check_retries,
+                        health_check_start_period: args.health_check_start_period,
                         custom_docker_run_options: args.custom_docker_run_options,
                         custom_labels: args.custom_labels,
                         instant_deploy: args.instant_deploy,
@@ -409,6 +440,25 @@ export class CoolifyMcpServer extends McpServer {
                         description: args.description,
                         fqdn: args.fqdn,
                         domains: args.domains,
+                        base_directory: args.base_directory,
+                        publish_directory: args.publish_directory,
+                        install_command: args.install_command,
+                        build_command: args.build_command,
+                        start_command: args.start_command,
+                        dockerfile_location: args.dockerfile_location,
+                        watch_paths: args.watch_paths,
+                        health_check_enabled: args.health_check_enabled,
+                        health_check_path: args.health_check_path,
+                        health_check_port: args.health_check_port,
+                        health_check_host: args.health_check_host,
+                        health_check_method: args.health_check_method,
+                        health_check_return_code: args.health_check_return_code,
+                        health_check_scheme: args.health_check_scheme,
+                        health_check_response_text: args.health_check_response_text,
+                        health_check_interval: args.health_check_interval,
+                        health_check_timeout: args.health_check_timeout,
+                        health_check_retries: args.health_check_retries,
+                        health_check_start_period: args.health_check_start_period,
                         custom_docker_run_options: args.custom_docker_run_options,
                         custom_labels: args.custom_labels,
                         instant_deploy: args.instant_deploy,
@@ -443,6 +493,25 @@ export class CoolifyMcpServer extends McpServer {
                         description: args.description,
                         fqdn: args.fqdn,
                         domains: args.domains,
+                        base_directory: args.base_directory,
+                        publish_directory: args.publish_directory,
+                        install_command: args.install_command,
+                        build_command: args.build_command,
+                        start_command: args.start_command,
+                        dockerfile_location: args.dockerfile_location,
+                        watch_paths: args.watch_paths,
+                        health_check_enabled: args.health_check_enabled,
+                        health_check_path: args.health_check_path,
+                        health_check_port: args.health_check_port,
+                        health_check_host: args.health_check_host,
+                        health_check_method: args.health_check_method,
+                        health_check_return_code: args.health_check_return_code,
+                        health_check_scheme: args.health_check_scheme,
+                        health_check_response_text: args.health_check_response_text,
+                        health_check_interval: args.health_check_interval,
+                        health_check_timeout: args.health_check_timeout,
+                        health_check_retries: args.health_check_retries,
+                        health_check_start_period: args.health_check_start_period,
                         custom_docker_run_options: args.custom_docker_run_options,
                         custom_labels: args.custom_labels,
                         instant_deploy: args.instant_deploy,
@@ -474,6 +543,21 @@ export class CoolifyMcpServer extends McpServer {
                         description: args.description,
                         fqdn: args.fqdn,
                         domains: args.domains,
+                        // Build-config fields (base_directory, install_command, etc.)
+                        // are intentionally NOT forwarded: /applications/dockerimage is
+                        // for pre-built registry images and has no build step.
+                        health_check_enabled: args.health_check_enabled,
+                        health_check_path: args.health_check_path,
+                        health_check_port: args.health_check_port,
+                        health_check_host: args.health_check_host,
+                        health_check_method: args.health_check_method,
+                        health_check_return_code: args.health_check_return_code,
+                        health_check_scheme: args.health_check_scheme,
+                        health_check_response_text: args.health_check_response_text,
+                        health_check_interval: args.health_check_interval,
+                        health_check_timeout: args.health_check_timeout,
+                        health_check_retries: args.health_check_retries,
+                        health_check_start_period: args.health_check_start_period,
                         custom_docker_run_options: args.custom_docker_run_options,
                         custom_labels: args.custom_labels,
                         instant_deploy: args.instant_deploy,
@@ -682,27 +766,39 @@ export class CoolifyMcpServer extends McpServer {
         // =========================================================================
         // Environment Variables (1 tool - consolidated)
         // =========================================================================
-        this.tool('env_vars', 'Manage env vars for app or service', {
+        this.tool('env_vars', "Manage env vars for app or service. Values are masked by default (returned as '***') to avoid leaking secrets to MCP clients; pass reveal=true on the list action when the caller explicitly needs the plaintext (e.g. 'what is FOO set to?'). Set is_buildtime=false (and/or is_runtime=true) for runtime-only vars to avoid Dockerfile ARG issues with multiline values like PEM keys.", {
             resource: z.enum(['application', 'service']),
             action: z.enum(['list', 'create', 'update', 'delete']),
             uuid: z.string(),
             key: z.string().optional(),
             value: z.string().optional(),
             env_uuid: z.string().optional(),
-        }, async ({ resource, action, uuid, key, value, env_uuid }) => {
+            is_buildtime: z.boolean().optional(),
+            is_runtime: z.boolean().optional(),
+            reveal: z.boolean().optional(),
+        }, async ({ resource, action, uuid, key, value, env_uuid, is_buildtime, is_runtime, reveal, }) => {
             if (resource === 'application') {
                 switch (action) {
                     case 'list':
-                        return wrap(() => this.client.listApplicationEnvVars(uuid, { summary: true }));
+                        return wrap(() => this.client.listApplicationEnvVars(uuid, { summary: true, reveal }));
                     case 'create':
                         if (!key || !value)
                             return { content: [{ type: 'text', text: 'Error: key, value required' }] };
-                        // Note: is_build_time is not passed - Coolify API rejects it for create action
-                        return wrap(() => this.client.createApplicationEnvVar(uuid, { key, value }));
+                        return wrap(() => this.client.createApplicationEnvVar(uuid, {
+                            key,
+                            value,
+                            is_buildtime,
+                            is_runtime,
+                        }));
                     case 'update':
                         if (!key || !value)
                             return { content: [{ type: 'text', text: 'Error: key, value required' }] };
-                        return wrap(() => this.client.updateApplicationEnvVar(uuid, { key, value }));
+                        return wrap(() => this.client.updateApplicationEnvVar(uuid, {
+                            key,
+                            value,
+                            is_buildtime,
+                            is_runtime,
+                        }));
                     case 'delete':
                         if (!env_uuid)
                             return { content: [{ type: 'text', text: 'Error: env_uuid required' }] };
@@ -712,11 +808,16 @@ export class CoolifyMcpServer extends McpServer {
             else {
                 switch (action) {
                     case 'list':
-                        return wrap(() => this.client.listServiceEnvVars(uuid));
+                        return wrap(() => this.client.listServiceEnvVars(uuid, { reveal }));
                     case 'create':
                         if (!key || !value)
                             return { content: [{ type: 'text', text: 'Error: key, value required' }] };
-                        return wrap(() => this.client.createServiceEnvVar(uuid, { key, value }));
+                        return wrap(() => this.client.createServiceEnvVar(uuid, {
+                            key,
+                            value,
+                            is_buildtime,
+                            is_runtime,
+                        }));
                     case 'update':
                         return {
                             content: [
@@ -1056,8 +1157,9 @@ export class CoolifyMcpServer extends McpServer {
             app_uuids: z.array(z.string()),
             key: z.string(),
             value: z.string(),
-            is_build_time: z.boolean().optional(),
-        }, async ({ app_uuids, key, value, is_build_time }) => wrap(() => this.client.bulkEnvUpdate(app_uuids, key, value, is_build_time)));
+            is_buildtime: z.boolean().optional(),
+            is_runtime: z.boolean().optional(),
+        }, async ({ app_uuids, key, value, is_buildtime, is_runtime }) => wrap(() => this.client.bulkEnvUpdate(app_uuids, key, value, is_buildtime, is_runtime)));
         this.tool('stop_all_apps', 'EMERGENCY: Stop all running apps', { confirm: z.literal(true) }, async ({ confirm }) => {
             if (!confirm)
                 return { content: [{ type: 'text', text: 'Error: confirm=true required' }] };

package/dist/types/coolify.d.ts

@@ -224,6 +224,20 @@ export interface CreateApplicationPublicRequest {
     install_command?: string;
     build_command?: string;
     start_command?: string;
+    dockerfile_location?: string;
+    watch_paths?: string;
+    health_check_enabled?: boolean;
+    health_check_path?: string;
+    health_check_port?: number;
+    health_check_host?: string;
+    health_check_method?: string;
+    health_check_return_code?: number;
+    health_check_scheme?: string;
+    health_check_response_text?: string;
+    health_check_interval?: number;
+    health_check_timeout?: number;
+    health_check_retries?: number;
+    health_check_start_period?: number;
     custom_docker_run_options?: string;
     custom_labels?: string;
     instant_deploy?: boolean;
@@ -271,6 +285,18 @@ export interface CreateApplicationDockerImageRequest {
     docker_registry_image_tag?: string;
     ports_exposes: string;
     ports_mappings?: string;
+    health_check_enabled?: boolean;
+    health_check_path?: string;
+    health_check_port?: number;
+    health_check_host?: string;
+    health_check_method?: string;
+    health_check_return_code?: number;
+    health_check_scheme?: string;
+    health_check_response_text?: string;
+    health_check_interval?: number;
+    health_check_timeout?: number;
+    health_check_retries?: number;
+    health_check_start_period?: number;
     custom_docker_run_options?: string;
     custom_labels?: string;
     instant_deploy?: boolean;
@@ -316,6 +342,8 @@ export interface UpdateApplicationRequest {
     install_command?: string;
     build_command?: string;
     start_command?: string;
+    dockerfile_target_build?: string;
+    watch_paths?: string;
     health_check_enabled?: boolean;
     health_check_path?: string;
     health_check_port?: number;
@@ -344,7 +372,8 @@ export interface EnvironmentVariable {
     uuid: string;
     key: string;
     value: string;
-    is_build_time: boolean;
+    is_buildtime: boolean;
+    is_runtime: boolean;
     is_literal: boolean;
     is_multiline: boolean;
     is_preview: boolean;
@@ -365,7 +394,8 @@ export interface CreateEnvVarRequest {
     is_literal?: boolean;
     is_multiline?: boolean;
     is_shown_once?: boolean;
-    is_build_time?: boolean;
+    is_buildtime?: boolean;
+    is_runtime?: boolean;
 }
 export interface UpdateEnvVarRequest {
     key: string;
@@ -374,7 +404,8 @@ export interface UpdateEnvVarRequest {
     is_literal?: boolean;
     is_multiline?: boolean;
     is_shown_once?: boolean;
-    is_build_time?: boolean;
+    is_buildtime?: boolean;
+    is_runtime?: boolean;
 }
 export interface BulkUpdateEnvVarsRequest {
     data: CreateEnvVarRequest[];
@@ -383,7 +414,8 @@ export interface EnvVarSummary {
     uuid: string;
     key: string;
     value: string;
-    is_build_time: boolean;
+    is_buildtime: boolean;
+    is_runtime: boolean;
 }
 export type DatabaseType = 'postgresql' | 'mysql' | 'mariadb' | 'mongodb' | 'redis' | 'keydb' | 'clickhouse' | 'dragonfly';
 export interface DatabaseLimits {
@@ -844,7 +876,8 @@ export interface ApplicationDiagnostic {
         count: number;
         variables: Array<{
             key: string;
-            is_build_time: boolean;
+            is_buildtime: boolean;
+            is_runtime: boolean;
         }>;
     };
     recent_deployments: Array<{

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@masonator/coolify-mcp",
   "scope": "@masonator",
-  "version": "2.8.1",
+  "version": "2.10.0",
   "mcpName": "io.github.StuMason/coolify",
   "description": "MCP server for Coolify — 38 optimized tools for infrastructure management, diagnostics, and documentation search",
   "type": "module",
@@ -75,8 +75,8 @@
     "globals": "^17.0.0",
     "husky": "^9.0.11",
     "jest": "^30.3.0",
-    "jest-junit": "^16.0.0",
-    "lint-staged": "^16.2.7",
+    "jest-junit": "^17.0.0",
+    "lint-staged": "^17.0.4",
     "markdownlint-cli2": "^0.22.0",
     "prettier": "^3.5.3",
     "shx": "^0.4.0",