| GSC_SERVICE_ACCOUNT_KEY | No | Service account key as JSON, or base64-encoded JSON. One of the three credential options. Secret. |
| GSC_SERVICE_ACCOUNT_KEY_FILE | No | Path to a service account key file. Alternative to GSC_SERVICE_ACCOUNT_KEY. |
| GSC_CLIENT_ID | No | OAuth2 client id. Use together with GSC_CLIENT_SECRET and GSC_REFRESH_TOKEN. |
| GSC_CLIENT_SECRET | No | OAuth2 client secret. All three OAuth2 variables are required together. Secret. |
| GSC_REFRESH_TOKEN | No | OAuth2 refresh token. All three OAuth2 variables are required together. Secret. |
| GOOGLE_APPLICATION_CREDENTIALS | No | Path to application default credentials, used when no GSC_ credential is set. |
| GSC_SITE_URL | No | Default property, e.g. sc-domain:example.com or https://example.com/ — makes site_url optional |
| GSC_ALLOWED_SITES | No | Comma-separated properties this server may touch; anything else is refused |
| GSC_READ_ONLY | No | Set to true to register only the read tools (default: false) |
| GSC_ALLOW_TOOLS | No | Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools) |
| GSC_DENY_TOOLS | No | Comma-separated tool names or list_* prefixes to remove from whatever the allow list left |
| GSC_SERVICE_ACCOUNT_KEY | No | Service account key as JSON, or base64-encoded JSON. One of the three credential options. Secret. |
| GSC_SERVICE_ACCOUNT_KEY_FILE | No | Path to a service account key file. Alternative to GSC_SERVICE_ACCOUNT_KEY. |
| GSC_CLIENT_ID | No | OAuth2 client id. Use together with GSC_CLIENT_SECRET and GSC_REFRESH_TOKEN. |
| GSC_CLIENT_SECRET | No | OAuth2 client secret. All three OAuth2 variables are required together. Secret. |
| GSC_REFRESH_TOKEN | No | OAuth2 refresh token. All three OAuth2 variables are required together. Secret. |
| GOOGLE_APPLICATION_CREDENTIALS | No | Path to application default credentials, used when no GSC_ credential is set. |
| GSC_SITE_URL | No | Default property, e.g. sc-domain:example.com or https://example.com/ — makes site_url optional |
| GSC_ALLOWED_SITES | No | Comma-separated properties this server may touch; anything else is refused |
| GSC_READ_ONLY | No | Set to true to register only the read tools (default: false) |
| GSC_ALLOW_TOOLS | No | Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools) |
| GSC_DENY_TOOLS | No | Comma-separated tool names or list_* prefixes to remove from whatever the allow list left |