ThreatByte-MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OPENAI_API_KEY | No | Fallback OpenAI API key if TBMCP_OPENAI_API_KEY is not set. | |
| TBMCP_SECRET_KEY | No | Flask secret key for session signing. | dev-secret-key-change-me |
| TBMCP_OPENAI_MODEL | No | OpenAI model for agent tasks. | gpt-4o-mini |
| TBMCP_MCP_SERVER_URL | No | MCP server JSON-RPC endpoint used by the web app proxy. | http://localhost:5002/mcp |
| TBMCP_OPENAI_API_KEY | No | Primary OpenAI API key used by agent endpoints. | |
| TBMCP_MCP_SERVER_TOKEN | No | Shared secret token between web app and MCP server. | tbmcp-mcp-token |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cases.createC | Create a new security case. |
| cases.listC | List cases. Accepts optional owner_id. |
| cases.list_allC | List all cases. |
| cases.getC | Get a case by id (ownership not enforced). |
| cases.renameC | Rename a case by id. |
| cases.set_statusC | Set case status (open | resolved | closed). |
| cases.deleteB | Delete a case by id. |
| notes.createC | Create a note for a case. |
| notes.listC | List notes for a case. |
| notes.updateC | Update a note by id (ownership not enforced). |
| notes.deleteB | Delete a note by id (ownership not enforced). |
| files.uploadC | Upload a file as base64. |
| files.listC | List files for a case. |
| files.getC | Get a file by id (returns base64). |
| files.read_pathC | Read a filesystem path. |
| indicators.searchC | Search mock IOC dataset. |
| agent.summarize_caseD | Summarize case notes. |
| agent.run_taskC | Run an analyst task over case context. |
| tools.registry.listB | List registered tools available to the agent. |
| tools.registry.registerC | Register or update a tool definition via schema JSON. |
| tools.registry.deleteC | Delete a registered tool by name. |
| tools.builtin.listB | List built-in tools bundled with the server. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 22 tools
Most tools have distinct purposes, with clear separation between cases, files, notes, indicators, and tools. However, cases.list and cases.list_all could cause confusion as their descriptions are similar, with list_all implying broader access but lacking clarity on how it differs from list with optional owner_id.
Tool names follow a highly consistent pattern using dot notation for grouping (e.g., cases.create, files.list) and verb_noun structure within groups. This makes the tool set predictable and easy to navigate, with no deviations in style.
With 22 tools, the count is on the higher side but reasonable for a security case management domain, covering multiple resource types like cases, files, notes, indicators, and tools. It might feel slightly heavy but each tool appears to serve a specific purpose.
The tool set provides comprehensive CRUD and lifecycle coverage for cases, files, and notes, along with search capabilities for indicators and tool management. There are no obvious gaps; agents can perform full workflows from case creation to resolution with file handling and note-taking.