Environment variables

Start from the maintained template. Keep credentials in private local configuration and never paste secrets into assessment prompts or reports. Every value below is the template default, and credential variables are blank.

dotenv

# Docker Compose defaults to local stdio. HTTP is opt-in with --profile http.
# Compose binds evidence to this host directory, which must exist before startup.
PENTEST_DATA_HOST_DIR=./.pentest-data

# HTTP listener. Keep loopback unless a TLS reverse proxy and access policy are ready.
MCP_BIND_ADDRESS=127.0.0.1
MCP_SERVER_PORT=8000

# HTTP requires bearer validation and allowed origins. The Compose HTTP profile
# always enables authentication; it will fail closed until these are configured.
MCP_ALLOWED_ORIGINS=
MCP_PUBLIC_BASE_URL=
# Remote scanner execution is a separate opt-in for a dedicated trusted deployment.
MCP_REMOTE_EXECUTION_ENABLED=false
# Optional absolute read-only wordlist directory for trusted remote execution.
MCP_SHARED_WORDLIST_DIR=
MCP_AUTH_READ_SCOPE=read
MCP_AUTH_WRITE_SCOPE=write
MCP_AUTH_EXECUTE_SCOPE=execute
MCP_AUTH_AUDIENCE=

# OIDC/JWT verification
MCP_OIDC_ISSUER=
MCP_OIDC_JWKS_URL=
MCP_OIDC_INTROSPECTION_URL=

# Optional OAuth client credentials for introspection endpoints
MCP_OAUTH_CLIENT_ID=
MCP_OAUTH_CLIENT_SECRET=

# Command controls
MCP_COMMAND_TIMEOUT_MS=900000
MCP_COMMAND_OUTPUT_LIMIT_BYTES=2097152

# Nuclei is opt-in: mount an operator-reviewed, signed HTTP template directory.
# Set this to its absolute path inside the container.
MCP_NUCLEI_TEMPLATES_DIR=
# Only for docker-compose.nuclei.yml; path to the reviewed templates on the host.
MCP_NUCLEI_TEMPLATES_HOST_DIR=

# Optional private JSON profile file for context-quarantined assessment and
# report agents. Local Codex/Claude profiles use their CLI credentials and do
# not need an API key. API profiles read only the dedicated variables below;
# never put keys in the JSON. OPENAI_COMPATIBLE_API_KEY is optional for a
# loopback llama.cpp-style server and required for a remote compatible server.
PENTEST_AGENT_PROFILES_FILE=
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
OPENAI_COMPATIBLE_API_KEY=
OPENROUTER_API_KEY=
# Only for an operator-controlled loopback proxy used with an openrouter profile.
# The real OpenRouter key is never sent to a custom endpoint.
OPENROUTER_PROXY_API_KEY=

DEBUG=

Environment variables ​

Environment variables