| MCP_LOG_LEVEL | No | Sets the minimum log level for output (e.g., 'debug', 'info', 'warn'). |
| CISA_KEV_REFRESH_CRON | No | Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup. |
| CISA_CSAF_MIRROR_PATH | No | Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows. |
| CISA_CSAF_MIRROR_AUTO_INIT | No | Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band. |
| CISA_CSAF_REFRESH_CRON | No | Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup. |
| CISA_VULNRICHMENT_CACHE_TTL_SECONDS | No | Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value. |
| CISA_FEED_CACHE_TTL_SECONDS | No | Seconds a parsed RSS feed window stays cached. |
| CISA_HTTP_TIMEOUT_MS | No | Per-request timeout in milliseconds for every upstream fetch. |
| MCP_TRANSPORT_TYPE | No | Selects the HTTP transport. |
| MCP_HTTP_HOST | No | The hostname for the HTTP server. |
| MCP_HTTP_PORT | No | The port to run the HTTP server on. |
| MCP_HTTP_ENDPOINT_PATH | No | The endpoint path for the MCP server. |
| MCP_AUTH_MODE | No | Authentication mode to use: 'none', 'jwt', or 'oauth'. |
| MCP_LOG_LEVEL | No | Sets the minimum log level for output (e.g., 'debug', 'info', 'warn'). |
| CISA_KEV_REFRESH_CRON | No | Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup. |
| CISA_CSAF_MIRROR_PATH | No | Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows. |
| CISA_CSAF_MIRROR_AUTO_INIT | No | Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band. |
| CISA_CSAF_REFRESH_CRON | No | Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup. |
| CISA_VULNRICHMENT_CACHE_TTL_SECONDS | No | Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value. |
| CISA_FEED_CACHE_TTL_SECONDS | No | Seconds a parsed RSS feed window stays cached. |
| CISA_HTTP_TIMEOUT_MS | No | Per-request timeout in milliseconds for every upstream fetch. |