Cisa Cybersecurity

Host a copy with our keys and logs.

• CISA_CLAMP_OVERSIZED_INPUTS — Return bounded results and explicit unprocessed CVE IDs for oversized reads. Set false to reject requests above each tool's workload cap.
• MCP_LOG_LEVEL — Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').
• CISA_KEV_REFRESH_CRON — Cron expression for the KEV catalog conditional-refresh poll, on every transport. Set off to disable it; an invalid expression fails startup.
• CISA_CSAF_MIRROR_PATH — Filesystem path to the local SQLite index of ICS advisories. Unset, it is csaf.sqlite3 under cisa-cybersecurity-mcp-server in the per-user cache directory: ~/Library/Caches on macOS, $XDG_CACHE_HOME or ~/.cache on Linux, %LOCALAPPDATA% on Windows.
• CISA_CSAF_MIRROR_AUTO_INIT — Seed the ICS advisory index in the background at startup when it has never completed a sync, and re-ingest it in place when an older server version built it. Accepts true or false; set false where seeding runs out of band.
• CISA_CSAF_REFRESH_CRON — Cron expression for the incremental ICS advisory refresh, on every transport; the refresh also runs once at startup. Set off to disable both; an invalid expression fails startup.
• CISA_VULNRICHMENT_CACHE_TTL_SECONDS — Seconds a fetched SSVC record stays cached. Negative results use one sixth of this value.
• CISA_FEED_CACHE_TTL_SECONDS — Seconds a parsed RSS feed window stays cached.
• CISA_HTTP_TIMEOUT_MS — Per-request timeout in milliseconds for every upstream fetch.