Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OPENAI_API_KEY | No | Fallback OpenAI API key if TBMCP_OPENAI_API_KEY is not set. | |
| TBMCP_SECRET_KEY | No | Flask secret key for session signing. | dev-secret-key-change-me |
| TBMCP_OPENAI_MODEL | No | OpenAI model for agent tasks. | gpt-4o-mini |
| TBMCP_MCP_SERVER_URL | No | MCP server JSON-RPC endpoint used by the web app proxy. | http://localhost:5002/mcp |
| TBMCP_OPENAI_API_KEY | No | Primary OpenAI API key used by agent endpoints. | |
| TBMCP_MCP_SERVER_TOKEN | No | Shared secret token between web app and MCP server. | tbmcp-mcp-token |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cases.create | Create a new security case. |
| cases.list | List cases. Accepts optional owner_id. |
| cases.list_all | List all cases. |
| cases.get | Get a case by id (ownership not enforced). |
| cases.rename | Rename a case by id. |
| cases.set_status | Set case status (open | resolved | closed). |
| cases.delete | Delete a case by id. |
| notes.create | Create a note for a case. |
| notes.list | List notes for a case. |
| notes.update | Update a note by id (ownership not enforced). |
| notes.delete | Delete a note by id (ownership not enforced). |
| files.upload | Upload a file as base64. |
| files.list | List files for a case. |
| files.get | Get a file by id (returns base64). |
| files.read_path | Read a filesystem path. |
| indicators.search | Search mock IOC dataset. |
| agent.summarize_case | Summarize case notes. |
| agent.run_task | Run an analyst task over case context. |
| tools.registry.list | List registered tools available to the agent. |
| tools.registry.register | Register or update a tool definition via schema JSON. |
| tools.registry.delete | Delete a registered tool by name. |
| tools.builtin.list | List built-in tools bundled with the server. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |