Pentest MCP
by noyb8082
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_AUTH_MODE | No | Authentication mode. README example uses bearer. | |
| MCP_TRANSPORT | No | Transport mode for the MCP server. Default is stdio for local MCP clients. Use http for Streamable HTTP network transport, or sse for deprecated legacy SSE compatibility mode. | stdio |
| MCP_AUTH_SCOPES | No | Comma-separated authentication scopes, e.g. read,write. | |
| MCP_OIDC_ISSUER | No | OIDC issuer URL, e.g. https://issuer.example.com. | |
| MCP_SERVER_HOST | No | Host to bind the server to when using network transport, e.g. 0.0.0.0. | |
| MCP_SERVER_PORT | No | Port to bind the server to when using network transport, e.g. 8000 for http or 8001 for sse. | |
| MCP_AUTH_ENABLED | No | Enable bearer-token authentication when using MCP_TRANSPORT=http or sse. | |
| MCP_OAUTH_SCOPES | No | Legacy alias for MCP_AUTH_SCOPES, still accepted temporarily. | |
| MCP_AUTH_AUDIENCE | No | Authentication audience. Can be set to an empty value. | |
| MCP_OAUTH_ENABLED | No | Legacy alias for MCP_AUTH_ENABLED, still accepted temporarily. | |
| MCP_OIDC_JWKS_URL | No | OIDC JWKS URL used for bearer-token validation, e.g. https://issuer.example.com/.well-known/jwks.json. | |
| MCP_ALLOWED_ORIGINS | No | Allowed origins for HTTP Origin validation. When set, invalid Origin requests receive 403. | |
| MCP_OAUTH_CLIENT_ID | No | OAuth client ID used for introspection validation. | |
| MCP_OAUTH_PROVIDER_URL | No | Legacy alias for the OAuth/OIDC provider URL, still accepted temporarily. | |
| MCP_OAUTH_CLIENT_SECRET | No | OAuth client secret used for introspection validation. | |
| MCP_OIDC_INTROSPECTION_URL | No | Optional alternative or backup OIDC token introspection URL, e.g. https://issuer.example.com/oauth/introspect. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |