vsp360-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VSP360_URL | Yes | Base URL of the VSP 360 server, e.g. https://vsp360.example.com. Must be https:// unless VSP360_ALLOW_HTTP=true. (required) | |
| VSP360_SPEC | No | Path to a different OpenAPI file, YAML or JSON, e.g. a newer VSP 360 release. JSON loads faster. | bundled spec |
| VSP360_SCOPE | No | Optional OAuth scope. | |
| VSP360_CA_CERT | No | PEM file of the CA that signed the VSP 360 certificate. | |
| VSP360_EXAMPLES | No | Example user questions per operation, used to rank search results. Set to an empty string to turn them off. | bundled spec/examples.json |
| VSP360_TOOLSETS | No | Comma-separated API areas (tags) to expose as direct tools, e.g. "Device Registry,Platform Alerts". `all` exposes all 264, which is not recommended. | |
| VSP360_CLIENT_ID | Yes | Service account client ID. (required) | |
| VSP360_ALLOW_HTTP | No | Allow an http:// VSP360_URL, which sends the client secret and tokens unencrypted. | false |
| VSP360_TIMEOUT_MS | No | Request timeout in milliseconds; uploads are exempt. | 120000 |
| VSP360_UPLOAD_DIR | No | Only allow uploads from inside this folder. In read-only mode, uploads are refused unless it's set. | |
| VSP360_ALLOW_WRITES | No | Allow operations that change state (writes are read-only refused by default). | false |
| VSP360_DECISION_LOG | No | Path to a JSON Lines file. When set, each search, describe and call is logged locally. Not needed to use the server. | |
| VSP360_DOWNLOAD_DIR | No | Where binary downloads and save_to files are written. | ~/Downloads/vsp360-mcp |
| VSP360_INSECURE_TLS | No | Skip TLS verification (lab use only, e.g. self-signed certificates). | false |
| VSP360_CLIENT_SECRET | Yes | Service account client secret. (required) | |
| VSP360_DECISION_HINT | No | true adds the learned model's suggested next step to search results; `ab` does so in a random half of sessions. | false |
| VSP360_PATH_REWRITES | No | Path prefixes to rewrite, as comma-separated /from=/to pairs. Also lets older specs without the prefix work. | /api/v1/protection=/dataprotection/api/v1/protection |
| VSP360_SAVE_ANYWHERE | No | Let save_to write outside VSP360_DOWNLOAD_DIR. | false |
| VSP360_DECISION_MODEL | No | The learned model used by the hint. | bundled spec/decision-model.json |
| VSP360_ANALYTICS_FIELDS | No | MQL resource types and attributes added to analyticsRunQuery's description. | bundled spec/analytics-fields.json |
| VSP360_DECISION_COLLECT | No | true turns on collection mode (needs VSP360_DECISION_LOG). | false |
| VSP360_ALLOW_SECRET_READS | No | Allow the three operations that return a live client secret. | false |
| VSP360_MAX_RESPONSE_BYTES | No | Most bytes read into memory from one response, or from all pages of an all_pages call (64 MiB default); save_to downloads are streamed and not limited. | 67108864 |
| VSP360_MAX_RESPONSE_CHARS | No | Truncation limit for text responses. | 60000 |
| VSP360_DECISION_LINK_SECONDS | No | A describe or call is tied to the latest search only if it starts within this many seconds of it. | 120 |
| VSP360_DECISION_COLLECT_SECONDS | No | In collection mode, how long a search result keeps its operations callable. | 600 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| vsp360_list_operationsA | Browse the VSP 360 REST API. With no arguments, lists the API areas (tags) and how many operations each has. With |
| vsp360_describe_operationA | Show everything needed to call one VSP 360 operation: method and path, required permissions and prerequisites, parameters, request body schema and response schema. |
| vsp360_call_operationA | Call any VSP 360 REST API operation by operationId. Authentication is handled automatically. Pass path, query and header parameters by name in |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
The three tools form a clean discover-describe-invoke pipeline with no functional overlap: list returns operationIds, describe returns schemas, call executes. Descriptions explicitly state the intended ordering, so an agent can never mistake one for another.
All names use the identical vsp360_ prefix followed by a consistent verb_noun pattern (list_operations, describe_operation, call_operation). The singular/plural distinction on 'operation(s)' is meaningful rather than sloppy.
Three tools is exactly right for a generic API gateway: the full VSP 360 surface is reached dynamically through operationId rather than one tool per endpoint. Every tool earns its place with no filler.
Discovery, introspection, pagination handling, binary download handling, and automatic auth cover the read lifecycle thoroughly. The deliberate read-only restriction blocks all write operations, which is a real capability gap for the domain even though it is an intentional safety design.