Transport and authentication

• stdio is the default local transport.
• http uses Streamable HTTP at /mcp with a /health endpoint. Direct local use binds to 127.0.0.1 by default.
• Legacy sse is disabled because its shared session cannot isolate clients.

For direct local HTTP use:

MCP_TRANSPORT=http MCP_SERVER_HOST=127.0.0.1 MCP_SERVER_PORT=8000 pentest-mcp

A non-loopback HTTP listener requires MCP_AUTH_ENABLED=true, an exact MCP_ALLOWED_ORIGINS list, MCP_OIDC_ISSUER, MCP_AUTH_AUDIENCE, and an HTTPS MCP_PUBLIC_BASE_URL. Issuer and audience are required for authenticated HTTP even when a reverse proxy publishes a loopback-bound listener. Bearer tokens must be verified through an OIDC JWKS URL or introspection endpoint. A request that supplies an Origin header is rejected unless it matches the allowed list. Put remote access behind TLS and an explicit network policy.

Authenticated HTTP scanner execution has a separate default-off gate: MCP_REMOTE_EXECUTION_ENABLED=true. Enable it only for a dedicated, trusted deployment with the engagement's authorization and access policy in place. When false, authenticated clients cannot launch assessment commands. Bearer tokens need the read scope for discovery and evidence retrieval, write for engagement and report changes, and execute for scanners and command cancellation. Each tool checks its own required scope; batched calls need every scope they use. The scope names can be mapped to provider-specific tokens with MCP_AUTH_READ_SCOPE, MCP_AUTH_WRITE_SCOPE, and MCP_AUTH_EXECUTE_SCOPE. The old MCP_AUTH_SCOPES setting is ignored. Remote gobuster, ffufScan, and Hydra list inputs may read only wordlists generated for that token owner or files under an operator-configured absolute MCP_SHARED_WORDLIST_DIR. Mount a shared directory read-only in Docker. Hash cracking, host packet capture, and host privilege audit remain local stdio tools.

MCP_TRANSPORT=http
MCP_SERVER_HOST=127.0.0.1
MCP_SERVER_PORT=8000
MCP_AUTH_ENABLED=true
MCP_AUTH_MODE=bearer
MCP_ALLOWED_ORIGINS=https://research.example.com
MCP_PUBLIC_BASE_URL=https://research.example.com
MCP_OIDC_ISSUER=https://issuer.example.com
MCP_OIDC_JWKS_URL=https://issuer.example.com/.well-known/jwks.json
MCP_AUTH_AUDIENCE=pentest-mcp
MCP_AUTH_READ_SCOPE=read
MCP_AUTH_WRITE_SCOPE=write
MCP_AUTH_EXECUTE_SCOPE=execute
MCP_REMOTE_EXECUTION_ENABLED=true

MCP_OIDC_INTROSPECTION_URL can be used instead of JWKS, with MCP_OAUTH_CLIENT_ID and MCP_OAUTH_CLIENT_SECRET when the provider requires them. Legacy MCP_OAUTH_* aliases remain accepted but should be migrated. The Docker HTTP profile always enables authentication, including when it publishes only to loopback.