The Box
by horizonfps
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | Higher NVD rate limit during intel ingest. | |
| THEBOX_LOGS_DIR | No | Bridge, tool and intel logs. | ~/.thebox/logs |
| THEBOX_STATE_DIR | No | Databases, token, sessions. | ~/.thebox/state |
| WPSCAN_API_TOKEN | No | WPScan vulnerability database token. | |
| ANTHROPIC_BASE_URL | No | Base URL for Anthropic-compatible endpoint (default: https://api.anthropic.com). | |
| THEBOX_BRIDGE_HOST | No | Bind address. Leave it local. | 127.0.0.1 |
| THEBOX_BRIDGE_PORT | No | Daemon port. | 7070 |
| THEBOX_SCRATCH_DIR | No | Per-target working directories. | ~/.thebox/scratch |
| THEBOX_BROWSER_MODE | No | Launch a browser or attach to one. | |
| ANTHROPIC_AUTH_TOKEN | No | Authentication token for Anthropic-compatible endpoint (required for subagent tools). | |
| THEBOX_BROWSER_CDP_URL | No | CDP URL to attach to an existing browser instance. | |
| THEBOX_INTEL_EMBED_GPU | No | GPU acceleration for embeddings. | 0 |
| THEBOX_INTEL_LANCE_DIR | No | Vector store location. | |
| THEBOX_ADVERSARIAL_REVIEW | No | Adversarial refuter panel before a finding ships. | on |
| THEBOX_TOOL_LOOP_MAX_ITER | No | Cap on the internal tool loop (0 means unlimited). | 0 |
| THEBOX_OOB_PUBLIC_DNS_BIND | No | Bind address for the public DNS listener. | |
| THEBOX_PROXY_IMPERSONATE_BIN | No | Path to curl-impersonate for TLS parity. | |
| THEBOX_PROXY_PASSTHROUGH_HOSTS | No | Hosts the MITM proxy must not intercept. | |
| THEBOX_OOB_PUBLIC_TRUSTED_PROXY | No | Upstream proxy allowed to set forwarded headers. |
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/horizonfps/the-box-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server