decoy-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PORT | No | Fallback for the local HTTP port when DECOY_MCP_PORT is not set. | |
| NO_PROXY | No | The machine's proxy bypass variable, needed together with NODE_USE_ENV_PROXY=1 when the bridge runs behind a proxy. | |
| HF_ENDPOINT | No | Host the embedding model is downloaded from (a mirror). Default is https://huggingface.co. Each downloaded file is still checked against its pinned SHA-256 hash. | |
| HTTPS_PROXY | No | The machine's proxy variable, needed together with NODE_USE_ENV_PROXY=1 when the bridge runs behind a proxy. | |
| MCP_BIND_HOST | No | Loopback address to listen on (::1 or localhost; anything else is refused). Default is 127.0.0.1. | |
| DECOY_MCP_PORT | No | Local HTTP port for the MCP endpoint. Default is 3001 (PORT is still read if this isn't set). | |
| DECOY_AGENT_FOR | No | URL slug (?for=) so the pairing page shows the right agent (e.g. claude-code, cursor). Default is mcp. | |
| DECOY_AGENT_KEY | No | The agent's private key (PKCS#8 DER, base64, one line), supplied from a secret store on a runtime with no lasting disk. Used as a complete set with DECOY_AGENT_TOKEN. | |
| DECOY_AGENT_URI | No | The agent's https site, sent with the pairing; the Decoy app shows that site's icon for the connection. Replaces the site DECOY_AGENT_FOR sends. | |
| DECOY_CLIENT_ID | No | Optional: name the id of a connection whose key file is on this machine, so --reconnect here is offered as Reconnect. Only ever sent with an existing key. | |
| DECOY_AGENT_ICON | No | An icon name from the API reference's list for `icon` (e.g. robot), shown when the site has no icon. Replaces the icon DECOY_AGENT_FOR sends. | |
| DECOY_AGENT_NAME | No | Display name shown in the iOS approval prompt and under Connections in the Decoy app. Default is "MCP Server". | |
| DECOY_NO_BROWSER | No | true → don't open a browser; print pairing info as JSON (same as --no-browser). | |
| DECOY_AGENT_TOKEN | No | Explicit access token (skips interactive pairing). An access token only; with DECOY_AGENT_KEY it is a whole connection from the environment. | |
| DECOY_CONNECT_URL | No | Pairing page the bridge opens (required for a non-production API host). Default is https://decoys.me/connect. | |
| MCP_ALLOWED_HOSTS | No | Extra Host values the local guard accepts, comma-separated. | |
| DECOY_MCP_ADVANCED | No | true → also offer the advanced tool set (e.g. account_unlock, resolve, passkey_assert). | |
| DECOY_MEMORY_GRAPH | No | true → also offer the MCP Memory graph tools (create_entities, create_relations, read_graph, …). | |
| NODE_USE_ENV_PROXY | No | Set to 1 together with the proxy variables when the bridge runs behind a proxy as a supervised service (Node 24, or 22.21 and later). | |
| DECOY_AGENT_API_URL | No | Decoy agent API base (https; http only on localhost). Default is https://api.decoys.me/api/agent. Another host also needs DECOY_CONNECT_URL; keep its credentials in a separate HOME. | |
| DECOY_MEMORY_ENGINE | No | basic → skip mem0's local engine (no model download); memory search falls back to word overlap. | |
| MCP_ALLOWED_ORIGINS | No | Extra Origin values the local guard accepts, comma-separated. | |
| DECOY_MEMORY_POLL_MS | No | While a client is subscribed to the memory graph, how often to check for other agents' changes. Default is 15000. | |
| DECOY_CREDENTIALS_FILE | No | Optional: an absolute path the bridge may write. A renewed token pair is saved there (0600, atomically; the key is never written). | |
| DECOY_MEMORY_SAVE_EVENTS | No | On by default; false → the bridge saves no memory of its own when it creates an account or saves a login as a new account. | |
| DECOY_AGENT_REFRESH_TOKEN | No | Optional: the refresh token for a connection supplied from the environment. Needs DECOY_CREDENTIALS_FILE. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues