# Environments

The **Environments** page creates reusable environment configurations shared across MCP servers — most commonly for securely storing the secrets sources need to reach upstream systems. Open it from **Distribute > Environments** in the dashboard.

## Access requirements

<Callout type="info">
  Viewing this page requires the `project:read` (or `project:write`) scope. Creating an environment, adding, editing, or deleting a variable, and cloning an environment (which also needs `environment:read` on the source) require the `environment:write` scope, while **Fill for MCP Server** requires the `project:write` scope. All access is included in the [default Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions); Members can open the pages via `project:read`, but because environment values contain secrets, viewing values and all mutations require an explicit `environment:read` or `environment:write` grant.
</Callout>

## Environment list

Each environment card shows its name, description, and entry count, with actions to open or clone it. Create environments with **New Environment** (requires environment write access).

## Managing variables

Inside an environment, variables are listed with their keys and values. Sensitive entries are marked with a lock and a **Sensitive** badge; their values are masked, only ever return a redacted preview, and can't be copied out. A reveal toggle shows the masked preview inline.

Actions include adding, editing, and deleting variables, plus **Fill for MCP Server** — which prefills placeholder entries for everything a selected server needs: security variables, server variables, function variables, and headers.

Environments bind to hosted MCP servers so that secrets stay centralized instead of living in individual client configurations.