rust-panosmcp
by mechubsec
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HOST | No | Numeric bind address for Streamable HTTP. Off-loopback HTTP requires TLS or --allow-insecure-bind. Equivalent to the --host option. | 127.0.0.1 |
| PORT | No | TCP port for Streamable HTTP. Equivalent to the --port option. | 30031 |
| TLS_KEY | No | Absolute PEM private-key path; requires TLS_CERT. Equivalent to the --tls-key option. | |
| LAB_MODE | No | Run without two-person control: change sets are approved on creation. Off by default. Equivalent to the --lab-mode option. | false |
| TLS_CERT | No | Absolute PEM certificate path; requires TLS_KEY. Equivalent to the --tls-cert option. | |
| TRANSPORT | No | MCP transport to use. Possible values: stdio, streamable-http. Equivalent to the --transport option. | stdio |
| STATE_FILE | No | Absolute private JSON file for persistent change-set and operation state. Equivalent to the --state-file option. | |
| TOKENS_FILE | No | Absolute digest-only bearer-token file path; the file must be mode 0600 or the server refuses to start. Equivalent to the --tokens-file option. | |
| ALLOWED_HOST | No | Additional accepted HTTP Host authority; repeat for multiple values. Equivalent to the --allowed-host option. | |
| AUDIT_FORMAT | No | Audit log format: text (default, human-readable) or json (machine-parseable). Equivalent to the --audit-format option. | text |
| AUDIT_REDACT | No | Per-field redaction policy (e.g., devices=hmac,host=drop). Equivalent to the --audit-redact option. | |
| ALLOW_NO_AUTH | No | Disable bearer auth for a loopback-only development listener. Equivalent to the --allow-no-auth option. | false |
| ALLOWED_ORIGIN | No | Accepted browser Origin URL; repeat for multiple values. Equivalent to the --allowed-origin option. | |
| AUDIT_JOURNALD | No | Enable the journald audit sink for target="audit" events. Equivalent to the --audit-journald option. | false |
| AUDIT_LOG_FILE | No | Optional dedicated JSON audit log file path. Equivalent to the --audit-log-file option. | |
| DEVICE_MAPPING | No | Path to the validated JSON device inventory. Equivalent to the --device-mapping option. | devices.json |
| ALLOW_DIRECT_COMMIT | No | Allow committing an operation with no change-set approval at all. Off by default. Equivalent to the --allow-direct-commit option. | false |
| ALLOW_INSECURE_BIND | No | Permit a non-loopback plaintext listener behind a trusted TLS proxy. Equivalent to the --allow-insecure-bind option. | false |
| AUDIT_HMAC_KEY_FILE | No | Path to the HMAC key file for audit redaction; required when audit redaction requests hmac. Equivalent to the --audit-hmac-key-file option. | |
| APPROVAL_TIMEOUT_SECS | No | Seconds a change-set approval stays valid before it expires. Equivalent to the --approval-timeout-secs option. | 900 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityActive
ResponsivenessResponsive