gocertius

MCP server for GoCertius: certified evidence, dossiers, notifications and chats via AI agents.

stdioofficialservice

Package Details

@g-digital/mcp-gocertius

1.3.4•https://www.npmjs.com/package/@g-digital/mcp-gocertius

Transportstdio

Environment Variables

MCP_ALLOW_INSECURE_FILE_URL

Set to "true" to allow plain http:// fileUrl downloads in evidence_create (default https-only). Private/internal addresses are always rejected regardless.

MCP_ALLOWED_HOSTS

Comma-separated allowed Host headers. Empty = Host validation disabled (default). When set, requests with a Host outside the list are rejected.

MCP_ALLOWED_ORIGINS

Comma-separated allowed browser Origins (DNS-rebinding defense). Empty = reject any request carrying an Origin header; non-browser clients (CLI/SDK) send no Origin and are always allowed. Use '*' to allow all.

MCP_AUTH_EMAIL

Your GoCertius account email (Flow 1). Configure one of Flow 1 or Flow 2.

MCP_AUTH_PASSWORD

Secret

Your GoCertius account password (Flow 1, email/password accounts) (See https://www.gocertius.io for credential acquisition.)

MCP_HTTP_HOST

Interface the HTTP transport binds to. Default 127.0.0.1 (localhost only). Set 0.0.0.0 to expose on all interfaces (containers do this automatically).

MCP_HTTP_PUBLIC

Set to "true" for public/multi-tenant deployments. Activates Host validation and refuses to start unless MCP_ALLOWED_ORIGINS or MCP_ALLOWED_HOSTS is set (fail-closed).

MCP_OPENID_CLIENT_ID

OpenID Connect client ID (Flow 2)

MCP_OPENID_ISSUER

OpenID Connect issuer URL (Flow 2)

MCP_OPENID_REFRESH_TOKEN

Secret

OpenID Connect refresh token (Flow 2) (See https://www.gocertius.io for credential acquisition.)

PORT

HTTP port when running in hosted (HTTP) mode; ignored in stdio mode