pwpush-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_HTTP_TOKEN | No | Bearer token required for HTTP transport (--listen mode). Required if using --listen. | |
| PWPUSH_TIMEOUT | No | HTTP request timeout in seconds. Default: 30 | 30 |
| PWPUSH_BASE_URL | No | Base URL of the Password Pusher instance. Default: https://pwpush.com | https://pwpush.com |
| PWPUSH_API_EMAIL | No | Email tied to the token for v1 instances. | |
| PWPUSH_API_TOKEN | No | API token for Password Pusher. Generate at <base-url>/api_tokens. Required for listing/audit, optional for create/preview/expire depending on instance. | |
| PWPUSH_AUDIT_LOG | No | Emit audit logs on stderr. Default: true | true |
| PWPUSH_CA_BUNDLE | No | Path to a CA bundle for SSL verification. | |
| PWPUSH_FILE_ROOT | No | Allowlist root directory for file uploads. If unset, file uploads disabled. | |
| PWPUSH_READ_ONLY | No | Remove write tools (create_push, expire_push). Default: false | false |
| PWPUSH_VERIFY_SSL | No | Verify SSL certificates. Default: true | true |
| PWPUSH_API_VERSION | No | API version: auto, v1, or v2. Default: auto | auto |
| PWPUSH_MAX_RETRIES | No | Number of retries on connection errors/429/5xx. Default: 2 | 2 |
| PWPUSH_ENABLED_TOOLS | No | Comma-separated fnmatch allowlist of tools to enable. Empty = all. | |
| PWPUSH_MAX_CONCURRENT | No | Maximum concurrent HTTP requests. 0 = unlimited. Default: 0 | 0 |
| MCP_HTTP_ALLOWED_HOSTS | No | Comma-separated allowed Host headers. Default: localhost,127.0.0.1,[::1] | |
| MCP_HTTP_ALLOW_UNAUTHENTICATED | No | Allow unauthenticated HTTP requests. Default: false | false |
| PWPUSH_PER_REQUEST_CREDENTIALS | No | Enable per-request pwpush credentials via headers. Default: false | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| create_pushA | Create a Password Pusher secret link and return its sharing URL. The secret payload is NOT echoed back. Share the returned |
| preview_pushA | Return the shareable secret URL for a push WITHOUT consuming a view. |
| expire_pushA | Permanently expire (delete) a push. IRREVERSIBLE. This destroys the payload and any attached files for good. Requires PWPUSH_API_TOKEN (or a push created with deletable_by_viewer). |
| get_push_auditA | Return the audit log (views, IPs, user agents) for a push. Requires auth. |
| list_active_pushesA | List the authenticated account's active (not yet expired) pushes. |
| list_expired_pushesA | List the authenticated account's expired pushes. |
| get_versionA | Return the target instance's version and enabled feature flags (no auth). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| create_push | Guided creation of a Password Pusher secret link. |
| preview_push | Fetch a push's share URL without consuming a view. |
| expire_push | Permanently expire (delete) a push — irreversible. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct resource or action: auditing a push, listing pushes by expiration status, checking server version, creating, previewing, or expiring a push. The overlap between list_active_pushes and list_expired_pushes is resolved by the explicit status distinction.
All tool names follow a consistent verb_noun pattern using snake_case: get_push_audit, list_active_pushes, create_push, preview_push, expire_push. The verbs are specific and the pattern is uniform across the set.
With 7 tools, the server is well-scoped for a secret-sharing service. Each tool covers a meaningful operation without redundancy or bloat.
The toolset covers the core lifecycle: create, preview (retrieve URL), expire (delete), audit, and list. A minor gap is the lack of a 'get_push' for retrieving full push metadata, but preview and audit provide sufficient insight for most workflows.