Pentest MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_AUTH_MODE | No | Authentication mode, e.g. bearer. | |
| MCP_TRANSPORT | No | Transport mode for the MCP server. Supported values: stdio (default for local clients), http (Streamable HTTP, recommended for network), sse (legacy/deprecated compatibility mode). | stdio |
| MCP_AUTH_SCOPES | No | Comma-separated auth scopes, e.g. read,write. | |
| MCP_OIDC_ISSUER | No | OIDC issuer URL used for bearer-token auth, e.g. https://issuer.example.com. | |
| MCP_SERVER_HOST | No | Host to bind when using a network transport, e.g. 0.0.0.0 for Streamable HTTP. | |
| MCP_SERVER_PORT | No | Port to bind when using a network transport, e.g. 8000 for Streamable HTTP or 8001 for legacy SSE. | |
| MCP_AUTH_ENABLED | No | Enable bearer-token authentication when using MCP_TRANSPORT=http or sse, e.g. true. | |
| MCP_OAUTH_SCOPES | No | Legacy alias for OAuth scopes, accepted temporarily. | |
| MCP_AUTH_AUDIENCE | No | Expected auth audience for bearer-token validation. | |
| MCP_OAUTH_ENABLED | No | Legacy alias for enabling OAuth/auth, accepted temporarily. | |
| MCP_OIDC_JWKS_URL | No | OIDC JWKS URL used for bearer-token validation, e.g. https://issuer.example.com/.well-known/jwks.json. | |
| MCP_ALLOWED_ORIGINS | No | Comma-separated allowed origins for HTTP origin validation. When set, requests with an invalid Origin receive 403. | |
| MCP_OAUTH_CLIENT_ID | No | OAuth client ID used for OIDC token introspection. | |
| MCP_OAUTH_PROVIDER_URL | No | Legacy alias for OAuth provider URL, accepted temporarily. | |
| MCP_OAUTH_CLIENT_SECRET | No | OAuth client secret used for OIDC token introspection. | |
| MCP_OIDC_INTROSPECTION_URL | No | Optional OIDC token introspection URL used as an alternative or backup validation mode, e.g. https://issuer.example.com/oauth/introspect. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityActive
ResponsivenessNo issues