Pentest MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_AUTH_MODE | No | Auth mode, e.g. `bearer`. | |
| MCP_TRANSPORT | No | Transport mode for the server. `stdio` is the default for local MCP clients, `http` is the modern network transport (Streamable HTTP, recommended), and `sse` is a deprecated compatibility mode. | stdio |
| MCP_AUTH_SCOPES | No | Comma-separated list of required auth scopes, e.g. `read,write`. | |
| MCP_OIDC_ISSUER | No | OIDC issuer URL, e.g. `https://issuer.example.com`. | |
| MCP_SERVER_HOST | No | Host the server binds to when running over the network (Streamable HTTP), e.g. `0.0.0.0`. | |
| MCP_SERVER_PORT | No | Port the server listens on when running over the network (Streamable HTTP or SSE), e.g. `8000` for http or `8001` for sse. | |
| MCP_AUTH_ENABLED | No | Set to `true` to enable bearer-token auth (OIDC). Typically set when using `MCP_TRANSPORT=http` (or `sse` if needed). | |
| MCP_OAUTH_SCOPES | No | Legacy alias for `MCP_AUTH_SCOPES`, still accepted temporarily. | |
| MCP_AUTH_AUDIENCE | No | Expected token audience for bearer auth validation. | |
| MCP_OAUTH_ENABLED | No | Legacy alias for `MCP_AUTH_ENABLED`, still accepted temporarily. | |
| MCP_OIDC_JWKS_URL | No | OIDC JWKS URL used for local token validation, e.g. `https://issuer.example.com/.well-known/jwks.json`. | |
| MCP_ALLOWED_ORIGINS | No | Allowed origins for HTTP origin validation. When set, invalid Origin requests receive a 403. | |
| MCP_OAUTH_CLIENT_ID | No | OAuth client ID used with the introspection endpoint. | |
| MCP_OAUTH_PROVIDER_URL | No | Legacy alias for `MCP_OIDC_ISSUER`, still accepted temporarily. | |
| MCP_OAUTH_CLIENT_SECRET | No | OAuth client secret used with the introspection endpoint. | |
| MCP_OIDC_INTROSPECTION_URL | No | Optional alternative/backup validation mode via OIDC token introspection endpoint, e.g. `https://issuer.example.com/oauth/introspect`. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityActive
ResponsivenessNo issues