{"name":"io.github.couchbase/mcp-server-couchbase","slug":"couchbase-mcp-server-couchbase","title":null,"description":"Couchbase MCP servers: Operational and Operational Insights clusters.","url":"https://mcp.market/server/couchbase-mcp-server-couchbase","rating":null,"grade":"A","score":85,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":48,"stars":34,"forks":34,"downloads_week":1096,"last_push_at":"2026-11-02T13:57:21.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/couchbase/mcp-server-couchbase","website":"https://docs.couchbase.com/mcp-server/1.1/reference/common-overview.html","version":"1.1.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"couchbase-mcp-server","version":"1.1.0","transport":{"type":"stdio"},"packageArguments":[{"description":"Runs the operational Couchbase cluster MCP server. Fixed; not user-configurable.","isRequired":true,"type":"positional","value":"operational","valueHint":"subcommand"},{"description":"Couchbase connection string. Required for connecting to the cluster.","format":"string","type":"named","name":"--connection-string"},{"description":"Couchbase database username. Required for basic authentication.","format":"string","type":"named","name":"--username"},{"description":"Couchbase database password. Required for basic authentication.","format":"string","isSecret":true,"type":"named","name":"--password"},{"description":"Couchbase CA certificate path. Required for TLS authentication in non Capella clusters.","format":"string","type":"named","name":"--ca-cert-path"},{"description":"Couchbase client certificate path. Required for mTLS authentication.","format":"string","type":"named","name":"--client-cert-path"},{"description":"Couchbase client key path. Required for mTLS authentication.","format":"string","type":"named","name":"--client-key-path"},{"description":"Couchbase read only mode. Set to true to disable write operations: KV document, scope/collection and index write tools are not loaded, and SQL++ queries that modify data are blocked. Set to false to allow them. Default is true.","format":"boolean","type":"named","name":"--read-only-mode"},{"description":"Transport mode for the server (stdio, http or sse). Default is stdio. OAuth is only honored with http.","format":"string","type":"named","name":"--transport"},{"description":"Host to run the MCP server on (default: 127.0.0.1). Used only for HTTP and SSE transport modes.","format":"string","type":"named","name":"--host"},{"description":"Port to run the MCP server on (default: 8000). Used only for HTTP and SSE transport modes.","format":"number","type":"named","name":"--port"},{"description":"Number of server worker processes (default: 1). Values above 1 use more CPU cores, require the http transport, run in stateless HTTP mode, and cannot be combined with --confirmation-required-tools. Each worker writes log files named with the host and process id.","format":"number","type":"named","name":"--workers"},{"description":"Handle each HTTP request without per-session state (default: true when workers > 1, otherwise false). Only honored with the http transport; cannot be combined with --confirmation-required-tools.","format":"boolean","type":"named","name":"--stateless-http"},{"description":"Tools to disable. Accepts comma-separated tool names (e.g., 'tool_1,tool_2') or a file path containing one tool name per line.","format":"string","type":"named","name":"--disabled-tools"},{"description":"Comma-separated tool names that require user confirmation before execution. Also accepts a file path containing one tool name per line. Requires the MCP client to support elicitation.","format":"string","type":"named","name":"--confirmation-required-tools"},{"description":"Logging level for the MCP server. One of off, debug, info, warning, error. Use 'off' to disable logging entirely. Invalid values fall back to info. Default is info.","format":"string","type":"named","name":"--log-level"},{"description":"Comma-separated list of log destinations. Allowed values: stderr, file. Include 'file' to write per-level log files; include 'stderr' to write to the console. Default is stderr.","format":"string","type":"named","name":"--log-sinks"},{"description":"Base path for the per-level log files. One rotating file is written per level (e.g. mcp_server.info.log, mcp_server.error.log). Only used when 'file' is in --log-sinks. Default is mcp_server.log.","format":"string","type":"named","name":"--log-file"},{"description":"Global maximum size in MB per-level log file before it rotates, inherited by every level unless overridden by a per-level --log-<level>-rotation-max-size-mb. A value of 0 is invalid and falls back to the default (1 MB) with a startup warning. Default is 1 (1 MB).","format":"number","type":"named","name":"--log-rotation-max-size-mb"},{"description":"[DEPRECATED] Global rotation size in bytes; use --log-rotation-max-size-mb (MB) instead. Still honored for backward compatibility but ignored when --log-rotation-max-size-mb is also set. A value of 0 is invalid and falls back to the default with a startup warning.","format":"number","type":"named","name":"--log-max-bytes"},{"description":"Rotation size in MB for the ERROR log file. Overrides --log-rotation-max-size-mb for ERROR; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-error-rotation-max-size-mb"},{"description":"Rotation size in MB for the WARNING log file. Overrides --log-rotation-max-size-mb for WARNING; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-warning-rotation-max-size-mb"},{"description":"Rotation size in MB for the INFO log file. Overrides --log-rotation-max-size-mb for INFO; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-info-rotation-max-size-mb"},{"description":"Rotation size in MB for the DEBUG log file. Overrides --log-rotation-max-size-mb for DEBUG; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-debug-rotation-max-size-mb"},{"description":"Number of rotated backup files kept per-level log file, excluding the live file. Applies to every level unless overridden per level. Set to 0 to keep only the live file (still capped by the rotation size). Default is 1.","format":"number","type":"named","name":"--log-retention-backup-count"},{"description":"Rotated backups kept for the ERROR log file. Overrides --log-retention-backup-count for ERROR; inherits it when unset.","format":"number","type":"named","name":"--log-error-retention-backup-count"},{"description":"Rotated backups kept for the WARNING log file. Overrides --log-retention-backup-count for WARNING; inherits it when unset.","format":"number","type":"named","name":"--log-warning-retention-backup-count"},{"description":"Rotated backups kept for the INFO log file. Overrides --log-retention-backup-count for INFO; inherits it when unset.","format":"number","type":"named","name":"--log-info-retention-backup-count"},{"description":"Rotated backups kept for the DEBUG log file. Overrides --log-retention-backup-count for DEBUG; inherits it when unset.","format":"number","type":"named","name":"--log-debug-retention-backup-count"},{"description":"JWKS endpoint of the identity provider used to verify bearer JWT signatures. Required to enable OAuth, along with --oauth-issuer and --oauth-audience. Only honored when --transport=http.","format":"string","type":"named","name":"--oauth-jwks-uri"},{"description":"Expected JWT 'iss' claim value. Also advertised as the authorization server in Protected Resource Metadata when --oauth-mcp-base-url is set. Required to enable OAuth.","format":"string","type":"named","name":"--oauth-issuer"},{"description":"Expected JWT 'aud' claim value. Required to enable OAuth.","format":"string","type":"named","name":"--oauth-audience"},{"description":"JWT signing algorithm. One of RS256/384/512, ES256/384/512, PS256/384/512. Default is RS256.","format":"string","type":"named","name":"--oauth-algorithm"},{"description":"Public base URL of this MCP server. When set, the server publishes RFC 9728 Protected Resource Metadata at <base_url>/.well-known/oauth-protected-resource/mcp so PRM-aware clients can discover the authorization server. Optional.","format":"string","type":"named","name":"--oauth-mcp-base-url"},{"description":"Override the OAuth scope label the server treats as 'read' access; advertised in PRM and matched against the token's scope/scp claim. Use when your IdP cannot emit the canonical form. Default is couchbase-mcp:read.","format":"string","type":"named","name":"--oauth-scope-read-label"},{"description":"Override the OAuth scope label the server treats as 'write' access; same semantics as --oauth-scope-read-label. Default is couchbase-mcp:write.","format":"string","type":"named","name":"--oauth-scope-write-label"},{"description":"Embedding provider for run_vector_query / run_vector_search: one of capella, openai, cohere, voyage, bedrock. Unset disables both tools' embedding step until configured.","format":"string","type":"named","name":"--embedding-model-provider"},{"description":"Model name/ID for the configured embedding provider.","format":"string","type":"named","name":"--embedding-model"},{"description":"API key for the configured embedding provider. Not used by bedrock (uses the AWS credential chain / --embedding-model-aws-* instead).","format":"string","isSecret":true,"type":"named","name":"--embedding-model-api-key"},{"description":"Base URL override for the configured embedding provider (e.g. an OpenAI-compatible local server, or a Capella Model Service deployment's own URL). Required when --embedding-model-provider=capella.","format":"string","type":"named","name":"--embedding-model-endpoint"},{"description":"AWS access key ID, bedrock provider only. Omit to use the default AWS credential chain.","format":"string","isSecret":true,"type":"named","name":"--embedding-model-aws-access-key-id"},{"description":"AWS secret access key, bedrock provider only.","format":"string","isSecret":true,"type":"named","name":"--embedding-model-aws-secret-access-key"},{"description":"AWS region, bedrock provider only. Falls back to the AWS SDK's own region resolution if unset.","format":"string","type":"named","name":"--embedding-model-aws-region"},{"description":"Enable audit logging. Audit output is a separate sink from the CB_MCP_LOG_* operational logs, with a stable schema, its own retention, and events that cannot be filtered out. Default is false.","format":"boolean","type":"named","name":"--audit-log-enabled"},{"description":"Comma-separated audit destinations: console, file, or both. 'console' writes to stderr, never stdout, because stdout carries the JSON-RPC protocol under the stdio transport. Default is console.","format":"boolean","type":"named","name":"--audit-log-sinks"},{"description":"Path to the audit log file, required when 'file' is in CB_MCP_AUDIT_LOG_SINKS. Each server process writes its own file with the host and process id inserted before the extension (audit.log becomes audit.myhost.1234.log), because a stdio deployment runs one process per client. If the path is missing the server still starts, with the file sink dropped and an error recorded.","format":"boolean","type":"named","name":"--audit-log-file-path"},{"description":"Maximum size in MB the live audit file may reach before it rotates. 0 turns size-based rotation off. Default is 10 MB.","format":"boolean","type":"named","name":"--audit-log-rotation-max-size-mb"},{"description":"Age the live audit file may reach before it rotates, as <value><unit> where the unit is 'd' (24 hours) or 'w' (7 days) - for example 1d, 30d, 1w, 8w. 0 turns interval-based rotation off. Size and interval are independent: whichever falls due first rotates the file. Default is 1d.","format":"boolean","type":"named","name":"--audit-log-rotation-interval"},{"description":"Number of rotated audit files retained, excluding the live file. Rotated files are gzipped and named with the UTC rotation time. Set to 0 to keep no backups: the live file is truncated at each rotation. Default is 10.","format":"boolean","type":"named","name":"--audit-log-retention-max-backups"},{"description":"Record tool argument values in the audit log. Off by default: there is no redaction in this release, so enabling this writes arguments verbatim, including the full document bodies passed to document-write tools. Review the audit file's retention and access controls before enabling it.","format":"boolean","type":"named","name":"--audit-log-tool-args"},{"description":"Audit events to suppress, as comma-separated numeric event ids (for example '61490,61492'), or a path to a file with one id per line. Ids are listed in the audit descriptor shipped with the package. Only filterable events can be suppressed: write and security events are always recorded, and an attempt to disable one is refused with a warning.","format":"boolean","type":"named","name":"--audit-log-disabled-events"}],"environmentVariables":[{"description":"Couchbase connection string. Required for connecting to the cluster.","format":"string","name":"CB_CONNECTION_STRING"},{"description":"Couchbase database username. Required for basic authentication.","format":"string","name":"CB_USERNAME"},{"description":"Couchbase database password. Required for basic authentication.","format":"string","isSecret":true,"name":"CB_PASSWORD"},{"description":"Couchbase CA certificate path. Required for TLS authentication in non Capella clusters.","format":"string","name":"CB_CA_CERT_PATH"},{"description":"Couchbase client certificate path. Required for mTLS authentication.","format":"string","name":"CB_CLIENT_CERT_PATH"},{"description":"Couchbase client key path. Required for mTLS authentication.","format":"string","name":"CB_CLIENT_KEY_PATH"},{"description":"Couchbase read only mode. Set to true to disable write operations: KV document, scope/collection and index write tools are not loaded, and SQL++ queries that modify data are blocked. Set to false to allow them. Default is true.","format":"boolean","name":"CB_MCP_READ_ONLY_MODE"},{"description":"Transport mode for the server (stdio, http or sse). Default is stdio. OAuth is only honored with http.","format":"string","name":"CB_MCP_TRANSPORT"},{"description":"Host to run the MCP server on (default: 127.0.0.1). Used only for HTTP and SSE transport modes.","format":"string","name":"CB_MCP_HOST"},{"description":"Port to run the MCP server on (default: 8000). Used only for HTTP and SSE transport modes.","format":"number","name":"CB_MCP_PORT"},{"description":"Number of server worker processes (default: 1). Values above 1 use more CPU cores, require the http transport, run in stateless HTTP mode, and cannot be combined with CB_MCP_CONFIRMATION_REQUIRED_TOOLS. Each worker writes log files named with the host and process id.","format":"number","name":"CB_MCP_WORKERS"},{"description":"Handle each HTTP request without per-session state (default: true when workers > 1, otherwise false). Only honored with the http transport; cannot be combined with CB_MCP_CONFIRMATION_REQUIRED_TOOLS.","format":"boolean","name":"CB_MCP_STATELESS_HTTP"},{"description":"Tools to disable. Accepts comma-separated tool names (e.g., 'tool_1,tool_2') or a file path containing one tool name per line.","format":"string","name":"CB_MCP_DISABLED_TOOLS"},{"description":"Comma-separated tool names that require user confirmation before execution. Also accepts a file path containing one tool name per line. Requires the MCP client to support elicitation.","format":"string","name":"CB_MCP_CONFIRMATION_REQUIRED_TOOLS"},{"description":"Logging level for the MCP server. One of off, debug, info, warning, error. Use 'off' to disable logging entirely. Invalid values fall back to info. Default is info.","format":"string","name":"CB_MCP_LOG_LEVEL"},{"description":"Comma-separated list of log destinations. Allowed values: stderr, file. Include 'file' to write per-level log files; include 'stderr' to write to the console. Default is stderr.","format":"string","name":"CB_MCP_LOG_SINKS"},{"description":"Base path for the per-level log files. One rotating file is written per level (e.g. mcp_server.info.log, mcp_server.error.log). Only used when 'file' is in CB_MCP_LOG_SINKS. Default is mcp_server.log.","format":"string","name":"CB_MCP_LOG_FILE"},{"description":"Global maximum size in MB per-level log file before it rotates, inherited by every level unless overridden by a per-level CB_MCP_LOG_<LEVEL>_ROTATION_MAX_SIZE_MB. A value of 0 is invalid and falls back to the default (1 MB) with a startup warning. Default is 1 (1 MB).","format":"number","name":"CB_MCP_LOG_ROTATION_MAX_SIZE_MB"},{"description":"[DEPRECATED] Global rotation size in bytes; use CB_MCP_LOG_ROTATION_MAX_SIZE_MB (MB) instead. Still honored for backward compatibility but ignored when CB_MCP_LOG_ROTATION_MAX_SIZE_MB is also set. A value of 0 is invalid and falls back to the default with a startup warning.","format":"number","name":"CB_MCP_LOG_MAX_BYTES"},{"description":"Rotation size in MB for the ERROR log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for ERROR; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_ERROR_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the WARNING log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for WARNING; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_WARNING_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the INFO log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for INFO; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_INFO_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the DEBUG log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for DEBUG; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_DEBUG_ROTATION_MAX_SIZE_MB"},{"description":"Number of rotated backup files kept per-level log file, excluding the live file. Applies to every level unless overridden per level. Set to 0 to keep only the live file (still capped by the rotation size). Default is 1.","format":"number","name":"CB_MCP_LOG_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the ERROR log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for ERROR; inherits it when unset.","format":"number","name":"CB_MCP_LOG_ERROR_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the WARNING log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for WARNING; inherits it when unset.","format":"number","name":"CB_MCP_LOG_WARNING_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the INFO log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for INFO; inherits it when unset.","format":"number","name":"CB_MCP_LOG_INFO_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the DEBUG log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for DEBUG; inherits it when unset.","format":"number","name":"CB_MCP_LOG_DEBUG_RETENTION_BACKUP_COUNT"},{"description":"JWKS endpoint of the identity provider used to verify bearer JWT signatures. Required to enable OAuth, along with CB_MCP_OAUTH_JWT_ISSUER and CB_MCP_OAUTH_JWT_AUDIENCE. Only honored when CB_MCP_TRANSPORT=http.","format":"string","name":"CB_MCP_OAUTH_JWT_JWKS_URI"},{"description":"Expected JWT 'iss' claim value. Also advertised as the authorization server in Protected Resource Metadata when CB_MCP_OAUTH_MCP_BASE_URL is set. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_ISSUER"},{"description":"Expected JWT 'aud' claim value. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_AUDIENCE"},{"description":"JWT signing algorithm. One of RS256/384/512, ES256/384/512, PS256/384/512. Default is RS256.","format":"string","name":"CB_MCP_OAUTH_JWT_ALGORITHM"},{"description":"Public base URL of this MCP server. When set, the server publishes RFC 9728 Protected Resource Metadata at <base_url>/.well-known/oauth-protected-resource/mcp so PRM-aware clients can discover the authorization server. Optional.","format":"string","name":"CB_MCP_OAUTH_MCP_BASE_URL"},{"description":"Override the OAuth scope label the server treats as 'read' access; advertised in PRM and matched against the token's scope/scp claim. Use when your IdP cannot emit the canonical form. Default is couchbase-mcp:read.","format":"string","name":"CB_MCP_OAUTH_SCOPE_READ_LABEL"},{"description":"Override the OAuth scope label the server treats as 'write' access; same semantics as CB_MCP_OAUTH_SCOPE_READ_LABEL. Default is couchbase-mcp:write.","format":"string","name":"CB_MCP_OAUTH_SCOPE_WRITE_LABEL"},{"description":"Enable audit logging. Audit output is a separate sink from the CB_MCP_LOG_* operational logs, with a stable schema, its own retention, and events that cannot be filtered out. Default is false.","format":"boolean","name":"CB_MCP_AUDIT_LOG_ENABLED"},{"description":"Comma-separated audit destinations: console, file, or both. 'console' writes to stderr, never stdout, because stdout carries the JSON-RPC protocol under the stdio transport. Default is console.","format":"string","name":"CB_MCP_AUDIT_LOG_SINKS"},{"description":"Embedding provider for run_vector_query / run_vector_search: one of capella, openai, cohere, voyage, bedrock. Unset disables both tools' embedding step until configured.","format":"string","name":"CB_MCP_EMBEDDING_MODEL_PROVIDER"},{"description":"Path to the audit log file, required when 'file' is in CB_MCP_AUDIT_LOG_SINKS. Each server process writes its own file with the host and process id inserted before the extension (audit.log becomes audit.myhost.1234.log), because a stdio deployment runs one process per client. If the path is missing the server still starts, with the file sink dropped and an error recorded.","format":"filepath","name":"CB_MCP_AUDIT_LOG_FILE_PATH"},{"description":"Maximum size in MB the live audit file may reach before it rotates. 0 turns size-based rotation off. Default is 10 MB.","format":"number","name":"CB_MCP_AUDIT_LOG_ROTATION_MAX_SIZE_MB"},{"description":"Age the live audit file may reach before it rotates, as <value><unit> where the unit is 'd' (24 hours) or 'w' (7 days) - for example 1d, 30d, 1w, 8w. 0 turns interval-based rotation off. Size and interval are independent: whichever falls due first rotates the file. Default is 1d.","format":"string","name":"CB_MCP_AUDIT_LOG_ROTATION_INTERVAL"},{"description":"Model name/ID for the configured embedding provider.","format":"string","name":"CB_MCP_EMBEDDING_MODEL"},{"description":"Number of rotated audit files retained, excluding the live file. Rotated files are gzipped and named with the UTC rotation time. Set to 0 to keep no backups: the live file is truncated at each rotation. Default is 10.","format":"number","name":"CB_MCP_AUDIT_LOG_RETENTION_MAX_BACKUPS"},{"description":"Record tool argument values in the audit log. Off by default: there is no redaction in this release, so enabling this writes arguments verbatim, including the full document bodies passed to document-write tools. Review the audit file's retention and access controls before enabling it.","format":"boolean","name":"CB_MCP_AUDIT_LOG_TOOL_ARGS"},{"description":"Audit events to suppress, as comma-separated numeric event ids (for example '61490,61492'), or a path to a file with one id per line. Ids are listed in the audit descriptor shipped with the package. Only filterable events can be suppressed: write and security events are always recorded, and an attempt to disable one is refused with a warning.","format":"string","name":"CB_MCP_AUDIT_LOG_DISABLED_EVENTS"},{"description":"API key for the configured embedding provider. Not used by bedrock (uses the AWS credential chain / CB_MCP_EMBEDDING_MODEL_AWS_* instead).","format":"string","isSecret":true,"name":"CB_MCP_EMBEDDING_MODEL_API_KEY"},{"description":"Base URL override for the configured embedding provider (e.g. an OpenAI-compatible local server, or a Capella Model Service deployment's own URL). Required when CB_MCP_EMBEDDING_MODEL_PROVIDER=capella.","format":"string","name":"CB_MCP_EMBEDDING_MODEL_ENDPOINT"},{"description":"AWS access key ID, bedrock provider only. Omit to use the default AWS credential chain.","format":"string","isSecret":true,"name":"CB_MCP_EMBEDDING_MODEL_AWS_ACCESS_KEY_ID"},{"description":"AWS secret access key, bedrock provider only.","format":"string","isSecret":true,"name":"CB_MCP_EMBEDDING_MODEL_AWS_SECRET_ACCESS_KEY"},{"description":"AWS region, bedrock provider only. Falls back to the AWS SDK's own region resolution if unset.","format":"string","name":"CB_MCP_EMBEDDING_MODEL_AWS_REGION"}]},{"registryType":"pypi","identifier":"couchbase-mcp-server","version":"1.1.0","transport":{"type":"stdio"},"packageArguments":[{"description":"Runs the Couchbase Operational Insights MCP server. Fixed; not user-configurable.","isRequired":true,"type":"positional","value":"operational-insights","valueHint":"subcommand"},{"description":"Operational Insights (Enterprise Analytics) endpoint URL, e.g. http://localhost:8095 (local) or https://<host>:18095 (Capella). An HTTP(S) URL, not a couchbase:// connection string.","format":"string","type":"named","name":"--connection-string"},{"description":"Operational Insights database username. Required for basic authentication.","format":"string","type":"named","name":"--username"},{"description":"Operational Insights database password. Required for basic authentication.","format":"string","isSecret":true,"type":"named","name":"--password"},{"description":"Operational Insights CA certificate (trust store) path, used to verify the server certificate over https://.","format":"string","type":"named","name":"--ca-cert-path"},{"description":"Client certificate path for mTLS: a PEM certificate (paired with the client key path) or a PKCS#12 bundle (.p12/.pfx). Requires an https:// connection string. When set, username/password are ignored.","format":"string","type":"named","name":"--client-cert-path"},{"description":"Client private key path (PEM) for mTLS. Leave unset when the client certificate is a PKCS#12 bundle that already contains the key.","format":"string","type":"named","name":"--client-key-path"},{"description":"Decryption password for the client key or PKCS#12 bundle, if it is encrypted. Omit if the file is unencrypted.","format":"string","isSecret":true,"type":"named","name":"--client-cert-password"},{"description":"Operational Insights read only mode. Set to true to disable write operations: the operational_insights_create_index and operational_insights_cancel_async_query tools are not loaded, and queries that modify data are blocked. Set to false to allow them. Default is true.","format":"boolean","type":"named","name":"--read-only-mode"},{"description":"Transport mode for the server (stdio, http or sse). Default is stdio. OAuth is only honored with http.","format":"string","type":"named","name":"--transport"},{"description":"Host to run the MCP server on (default: 127.0.0.1). Used only for HTTP and SSE transport modes.","format":"string","type":"named","name":"--host"},{"description":"Port to run the MCP server on (default: 8001). Used only for HTTP and SSE transport modes.","format":"number","type":"named","name":"--port"},{"description":"Handle each HTTP request without per-session state (default: true when workers > 1, otherwise false). Only honored with the http transport; cannot be combined with --confirmation-required-tools.","format":"boolean","type":"named","name":"--stateless-http"},{"description":"Tools to disable. Accepts comma-separated tool names (e.g., 'tool_1,tool_2') or a file path containing one tool name per line.","format":"string","type":"named","name":"--disabled-tools"},{"description":"Comma-separated tool names that require user confirmation before execution. Also accepts a file path containing one tool name per line. Requires the MCP client to support elicitation.","format":"string","type":"named","name":"--confirmation-required-tools"},{"description":"Logging level for the MCP server. One of off, debug, info, warning, error. Use 'off' to disable logging entirely. Invalid values fall back to info. Default is info.","format":"string","type":"named","name":"--log-level"},{"description":"Comma-separated list of log destinations. Allowed values: stderr, file. Include 'file' to write per-level log files; include 'stderr' to write to the console. Default is stderr.","format":"string","type":"named","name":"--log-sinks"},{"description":"Base path for the per-level log files. One rotating file is written per level (e.g. mcp_server_operational_insights.info.log, mcp_server_operational_insights.error.log). Only used when 'file' is in --log-sinks. Default is mcp_server_operational_insights.log.","format":"string","type":"named","name":"--log-file"},{"description":"Global maximum size in MB per-level log file before it rotates, inherited by every level unless overridden by a per-level --log-<level>-rotation-max-size-mb. A value of 0 is invalid and falls back to the default (1 MB) with a startup warning. Default is 1 (1 MB).","format":"number","type":"named","name":"--log-rotation-max-size-mb"},{"description":"[DEPRECATED] Global rotation size in bytes; use --log-rotation-max-size-mb (MB) instead. Still honored for backward compatibility but ignored when --log-rotation-max-size-mb is also set. A value of 0 is invalid and falls back to the default with a startup warning.","format":"number","type":"named","name":"--log-max-bytes"},{"description":"Rotation size in MB for the ERROR log file. Overrides --log-rotation-max-size-mb for ERROR; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-error-rotation-max-size-mb"},{"description":"Rotation size in MB for the WARNING log file. Overrides --log-rotation-max-size-mb for WARNING; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-warning-rotation-max-size-mb"},{"description":"Rotation size in MB for the INFO log file. Overrides --log-rotation-max-size-mb for INFO; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-info-rotation-max-size-mb"},{"description":"Rotation size in MB for the DEBUG log file. Overrides --log-rotation-max-size-mb for DEBUG; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","type":"named","name":"--log-debug-rotation-max-size-mb"},{"description":"Number of rotated backup files kept per-level log file, excluding the live file. Applies to every level unless overridden per level. Set to 0 to keep only the live file (still capped by the rotation size). Default is 1.","format":"number","type":"named","name":"--log-retention-backup-count"},{"description":"Rotated backups kept for the ERROR log file. Overrides --log-retention-backup-count for ERROR; inherits it when unset.","format":"number","type":"named","name":"--log-error-retention-backup-count"},{"description":"Rotated backups kept for the WARNING log file. Overrides --log-retention-backup-count for WARNING; inherits it when unset.","format":"number","type":"named","name":"--log-warning-retention-backup-count"},{"description":"Rotated backups kept for the INFO log file. Overrides --log-retention-backup-count for INFO; inherits it when unset.","format":"number","type":"named","name":"--log-info-retention-backup-count"},{"description":"Rotated backups kept for the DEBUG log file. Overrides --log-retention-backup-count for DEBUG; inherits it when unset.","format":"number","type":"named","name":"--log-debug-retention-backup-count"},{"description":"JWKS endpoint of the identity provider used to verify bearer JWT signatures. Required to enable OAuth, along with --oauth-issuer and --oauth-audience. Only honored when --transport=http.","format":"string","type":"named","name":"--oauth-jwks-uri"},{"description":"Expected JWT 'iss' claim value. Also advertised as the authorization server in Protected Resource Metadata when --oauth-mcp-base-url is set. Required to enable OAuth.","format":"string","type":"named","name":"--oauth-issuer"},{"description":"Expected JWT 'aud' claim value. Required to enable OAuth.","format":"string","type":"named","name":"--oauth-audience"},{"description":"JWT signing algorithm. One of RS256/384/512, ES256/384/512, PS256/384/512. Default is RS256.","format":"string","type":"named","name":"--oauth-algorithm"},{"description":"Public base URL of this MCP server. When set, the server publishes RFC 9728 Protected Resource Metadata at <base_url>/.well-known/oauth-protected-resource/mcp so PRM-aware clients can discover the authorization server. Optional.","format":"string","type":"named","name":"--oauth-mcp-base-url"},{"description":"Override the OAuth scope label the server treats as 'read' access; advertised in PRM and matched against the token's scope/scp claim. Use when your IdP cannot emit the canonical form. Default is couchbase-mcp:read.","format":"string","type":"named","name":"--oauth-scope-read-label"},{"description":"Override the OAuth scope label the server treats as 'write' access; same semantics as --oauth-scope-read-label. Default is couchbase-mcp:write.","format":"string","type":"named","name":"--oauth-scope-write-label"},{"description":"Enable audit logging. Audit output is a separate sink from the CB_MCP_LOG_* operational logs, with a stable schema, its own retention, and events that cannot be filtered out. Default is false. This server emits audit records under its own event block, 0x10000 (65536), so an event id names the server that produced it.","format":"boolean","type":"named","name":"--audit-log-enabled"},{"description":"Comma-separated audit destinations: console, file, or both. 'console' writes to stderr, never stdout, because stdout carries the JSON-RPC protocol under the stdio transport. Default is console.","format":"boolean","type":"named","name":"--audit-log-sinks"},{"description":"Path to the audit log file, required when 'file' is in CB_MCP_AUDIT_LOG_SINKS. Each server process writes its own file with the host and process id inserted before the extension (audit.log becomes audit.myhost.1234.log), because a stdio deployment runs one process per client. If the path is missing the server still starts, with the file sink dropped and an error recorded.","format":"boolean","type":"named","name":"--audit-log-file-path"},{"description":"Maximum size in MB the live audit file may reach before it rotates. 0 turns size-based rotation off. Default is 10 MB.","format":"boolean","type":"named","name":"--audit-log-rotation-max-size-mb"},{"description":"Age the live audit file may reach before it rotates, as <value><unit> where the unit is 'd' (24 hours) or 'w' (7 days) - for example 1d, 30d, 1w, 8w. 0 turns interval-based rotation off. Size and interval are independent: whichever falls due first rotates the file. Default is 1d.","format":"boolean","type":"named","name":"--audit-log-rotation-interval"},{"description":"Number of rotated audit files retained, excluding the live file. Rotated files are gzipped and named with the UTC rotation time. Set to 0 to keep no backups: the live file is truncated at each rotation. Default is 10.","format":"boolean","type":"named","name":"--audit-log-retention-max-backups"},{"description":"Record tool argument values in the audit log. Off by default: there is no redaction in this release, so enabling this writes arguments verbatim, including the full document bodies passed to document-write tools. Review the audit file's retention and access controls before enabling it.","format":"boolean","type":"named","name":"--audit-log-tool-args"},{"description":"Audit events to suppress, as comma-separated numeric event ids (for example '61490,61492'), or a path to a file with one id per line. Ids are listed in the audit descriptor shipped with the package. Only filterable events can be suppressed: write and security events are always recorded, and an attempt to disable one is refused with a warning.","format":"boolean","type":"named","name":"--audit-log-disabled-events"}],"environmentVariables":[{"description":"Operational Insights (Enterprise Analytics) endpoint URL, e.g. http://localhost:8095 (local) or https://<host>:18095 (Capella). An HTTP(S) URL, not a couchbase:// connection string.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CONNECTION_STRING"},{"description":"Operational Insights database username. Required for basic authentication.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_USERNAME"},{"description":"Operational Insights database password. Required for basic authentication.","format":"string","isSecret":true,"name":"CB_OPERATIONAL_INSIGHTS_PASSWORD"},{"description":"Operational Insights CA certificate (trust store) path, used to verify the server certificate over https://.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CA_CERT_PATH"},{"description":"Client certificate path for mTLS: a PEM certificate (paired with the client key path) or a PKCS#12 bundle (.p12/.pfx). Requires an https:// connection string. When set, username/password are ignored.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CLIENT_CERT_PATH"},{"description":"Client private key path (PEM) for mTLS. Leave unset when the client certificate is a PKCS#12 bundle that already contains the key.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CLIENT_KEY_PATH"},{"description":"Decryption password for the client key or PKCS#12 bundle, if it is encrypted. Omit if the file is unencrypted.","format":"string","isSecret":true,"name":"CB_OPERATIONAL_INSIGHTS_CLIENT_CERT_PASSWORD"},{"description":"Timeout in seconds for each async query request (start, status, fetch, discard, cancel). For a fetch it covers the whole download, so a result that takes longer than this to read fails. Positive integer, maximum 600; larger values are clamped to 600 with a warning, and any other invalid value is logged as a warning and the default is used. Default is 30.","format":"number","default":"30","name":"CB_MCP_OPERATIONAL_INSIGHTS_ASYNC_QUERY_RESULT_TIMEOUT"},{"description":"Operational Insights read only mode. Set to true to disable write operations: the operational_insights_create_index and operational_insights_cancel_async_query tools are not loaded, and queries that modify data are blocked. Set to false to allow them. Default is true.","format":"boolean","name":"CB_MCP_READ_ONLY_MODE"},{"description":"Transport mode for the server (stdio, http or sse). Default is stdio. OAuth is only honored with http.","format":"string","name":"CB_MCP_TRANSPORT"},{"description":"Host to run the MCP server on (default: 127.0.0.1). Used only for HTTP and SSE transport modes.","format":"string","name":"CB_MCP_HOST"},{"description":"Port to run the MCP server on (default: 8001). Used only for HTTP and SSE transport modes.","format":"number","name":"CB_MCP_PORT"},{"description":"Handle each HTTP request without per-session state (default: true when workers > 1, otherwise false). Only honored with the http transport; cannot be combined with CB_MCP_CONFIRMATION_REQUIRED_TOOLS.","format":"boolean","name":"CB_MCP_STATELESS_HTTP"},{"description":"Tools to disable. Accepts comma-separated tool names (e.g., 'tool_1,tool_2') or a file path containing one tool name per line.","format":"string","name":"CB_MCP_DISABLED_TOOLS"},{"description":"Comma-separated tool names that require user confirmation before execution. Also accepts a file path containing one tool name per line. Requires the MCP client to support elicitation.","format":"string","name":"CB_MCP_CONFIRMATION_REQUIRED_TOOLS"},{"description":"Logging level for the MCP server. One of off, debug, info, warning, error. Use 'off' to disable logging entirely. Invalid values fall back to info. Default is info.","format":"string","name":"CB_MCP_LOG_LEVEL"},{"description":"Comma-separated list of log destinations. Allowed values: stderr, file. Include 'file' to write per-level log files; include 'stderr' to write to the console. Default is stderr.","format":"string","name":"CB_MCP_LOG_SINKS"},{"description":"Base path for the per-level log files. One rotating file is written per level (e.g. mcp_server_operational_insights.info.log, mcp_server_operational_insights.error.log). Only used when 'file' is in CB_MCP_LOG_SINKS. Default is mcp_server_operational_insights.log.","format":"string","name":"CB_MCP_LOG_FILE"},{"description":"Global maximum size in MB per-level log file before it rotates, inherited by every level unless overridden by a per-level CB_MCP_LOG_<LEVEL>_ROTATION_MAX_SIZE_MB. A value of 0 is invalid and falls back to the default (1 MB) with a startup warning. Default is 1 (1 MB).","format":"number","name":"CB_MCP_LOG_ROTATION_MAX_SIZE_MB"},{"description":"[DEPRECATED] Global rotation size in bytes; use CB_MCP_LOG_ROTATION_MAX_SIZE_MB (MB) instead. Still honored for backward compatibility but ignored when CB_MCP_LOG_ROTATION_MAX_SIZE_MB is also set. A value of 0 is invalid and falls back to the default with a startup warning.","format":"number","name":"CB_MCP_LOG_MAX_BYTES"},{"description":"Rotation size in MB for the ERROR log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for ERROR; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_ERROR_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the WARNING log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for WARNING; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_WARNING_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the INFO log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for INFO; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_INFO_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the DEBUG log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for DEBUG; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_DEBUG_ROTATION_MAX_SIZE_MB"},{"description":"Number of rotated backup files kept per-level log file, excluding the live file. Applies to every level unless overridden per level. Set to 0 to keep only the live file (still capped by the rotation size). Default is 1.","format":"number","name":"CB_MCP_LOG_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the ERROR log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for ERROR; inherits it when unset.","format":"number","name":"CB_MCP_LOG_ERROR_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the WARNING log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for WARNING; inherits it when unset.","format":"number","name":"CB_MCP_LOG_WARNING_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the INFO log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for INFO; inherits it when unset.","format":"number","name":"CB_MCP_LOG_INFO_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the DEBUG log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for DEBUG; inherits it when unset.","format":"number","name":"CB_MCP_LOG_DEBUG_RETENTION_BACKUP_COUNT"},{"description":"Enable audit logging. Audit output is a separate sink from the CB_MCP_LOG_* operational logs, with a stable schema, its own retention, and events that cannot be filtered out. Default is false. This server emits audit records under its own event block, 0x10000 (65536), so an event id names the server that produced it.","format":"boolean","name":"CB_MCP_AUDIT_LOG_ENABLED"},{"description":"Comma-separated audit destinations: console, file, or both. 'console' writes to stderr, never stdout, because stdout carries the JSON-RPC protocol under the stdio transport. Default is console.","format":"string","name":"CB_MCP_AUDIT_LOG_SINKS"},{"description":"Path to the audit log file, required when 'file' is in CB_MCP_AUDIT_LOG_SINKS. Each server process writes its own file with the host and process id inserted before the extension (audit.log becomes audit.myhost.1234.log), because a stdio deployment runs one process per client. If the path is missing the server still starts, with the file sink dropped and an error recorded.","format":"filepath","name":"CB_MCP_AUDIT_LOG_FILE_PATH"},{"description":"Maximum size in MB the live audit file may reach before it rotates. 0 turns size-based rotation off. Default is 10 MB.","format":"number","name":"CB_MCP_AUDIT_LOG_ROTATION_MAX_SIZE_MB"},{"description":"Age the live audit file may reach before it rotates, as <value><unit> where the unit is 'd' (24 hours) or 'w' (7 days) - for example 1d, 30d, 1w, 8w. 0 turns interval-based rotation off. Size and interval are independent: whichever falls due first rotates the file. Default is 1d.","format":"string","name":"CB_MCP_AUDIT_LOG_ROTATION_INTERVAL"},{"description":"Number of rotated audit files retained, excluding the live file. Rotated files are gzipped and named with the UTC rotation time. Set to 0 to keep no backups: the live file is truncated at each rotation. Default is 10.","format":"number","name":"CB_MCP_AUDIT_LOG_RETENTION_MAX_BACKUPS"},{"description":"Record tool argument values in the audit log. Off by default: there is no redaction in this release, so enabling this writes arguments verbatim, including the full document bodies passed to document-write tools. Review the audit file's retention and access controls before enabling it.","format":"boolean","name":"CB_MCP_AUDIT_LOG_TOOL_ARGS"},{"description":"Audit events to suppress, as comma-separated numeric event ids (for example '61490,61492'), or a path to a file with one id per line. Ids are listed in the audit descriptor shipped with the package. Only filterable events can be suppressed: write and security events are always recorded, and an attempt to disable one is refused with a warning.","format":"string","name":"CB_MCP_AUDIT_LOG_DISABLED_EVENTS"},{"description":"JWKS endpoint of the identity provider used to verify bearer JWT signatures. Required to enable OAuth, along with CB_MCP_OAUTH_JWT_ISSUER and CB_MCP_OAUTH_JWT_AUDIENCE. Only honored when CB_MCP_TRANSPORT=http.","format":"string","name":"CB_MCP_OAUTH_JWT_JWKS_URI"},{"description":"Expected JWT 'iss' claim value. Also advertised as the authorization server in Protected Resource Metadata when CB_MCP_OAUTH_MCP_BASE_URL is set. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_ISSUER"},{"description":"Expected JWT 'aud' claim value. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_AUDIENCE"},{"description":"JWT signing algorithm. One of RS256/384/512, ES256/384/512, PS256/384/512. Default is RS256.","format":"string","name":"CB_MCP_OAUTH_JWT_ALGORITHM"},{"description":"Public base URL of this MCP server. When set, the server publishes RFC 9728 Protected Resource Metadata at <base_url>/.well-known/oauth-protected-resource/mcp so PRM-aware clients can discover the authorization server. Optional.","format":"string","name":"CB_MCP_OAUTH_MCP_BASE_URL"},{"description":"Override the OAuth scope label the server treats as 'read' access; advertised in PRM and matched against the token's scope/scp claim. Use when your IdP cannot emit the canonical form. Default is couchbase-mcp:read.","format":"string","name":"CB_MCP_OAUTH_SCOPE_READ_LABEL"},{"description":"Override the OAuth scope label the server treats as 'write' access; same semantics as CB_MCP_OAUTH_SCOPE_READ_LABEL. Default is couchbase-mcp:write.","format":"string","name":"CB_MCP_OAUTH_SCOPE_WRITE_LABEL"}]},{"registryType":"oci","identifier":"docker.io/couchbase/mcp-server:1.1.0","transport":{"type":"stdio"},"packageArguments":[{"description":"Runs the operational Couchbase cluster MCP server. Fixed; not user-configurable.","isRequired":true,"type":"positional","value":"operational","valueHint":"subcommand"}],"environmentVariables":[{"description":"Couchbase connection string. Required for connecting to the cluster.","format":"string","name":"CB_CONNECTION_STRING"},{"description":"Couchbase database username. Required for basic authentication.","format":"string","name":"CB_USERNAME"},{"description":"Couchbase database password. Required for basic authentication.","format":"string","isSecret":true,"name":"CB_PASSWORD"},{"description":"Couchbase CA certificate path. Required for TLS authentication in non Capella clusters.","format":"string","name":"CB_CA_CERT_PATH"},{"description":"Couchbase client certificate path. Required for mTLS authentication.","format":"string","name":"CB_CLIENT_CERT_PATH"},{"description":"Couchbase client key path. Required for mTLS authentication.","format":"string","name":"CB_CLIENT_KEY_PATH"},{"description":"Couchbase read only mode. Set to true to disable write operations: KV document, scope/collection and index write tools are not loaded, and SQL++ queries that modify data are blocked. Set to false to allow them. Default is true.","format":"boolean","name":"CB_MCP_READ_ONLY_MODE"},{"description":"Transport mode for the server (stdio, http or sse). Default is stdio. OAuth is only honored with http.","format":"string","name":"CB_MCP_TRANSPORT"},{"description":"Host to run the MCP server on (default: 127.0.0.1). Used only for HTTP and SSE transport modes.","format":"string","name":"CB_MCP_HOST"},{"description":"Port to run the MCP server on (default: 8000). Used only for HTTP and SSE transport modes.","format":"number","name":"CB_MCP_PORT"},{"description":"Number of server worker processes (default: 1). Values above 1 use more CPU cores, require the http transport, run in stateless HTTP mode, and cannot be combined with CB_MCP_CONFIRMATION_REQUIRED_TOOLS. Each worker writes log files named with the host and process id.","format":"number","name":"CB_MCP_WORKERS"},{"description":"Handle each HTTP request without per-session state (default: true when workers > 1, otherwise false). Only honored with the http transport; cannot be combined with CB_MCP_CONFIRMATION_REQUIRED_TOOLS.","format":"boolean","name":"CB_MCP_STATELESS_HTTP"},{"description":"Tools to disable. Accepts comma-separated tool names (e.g., 'tool_1,tool_2') or a file path containing one tool name per line.","format":"string","name":"CB_MCP_DISABLED_TOOLS"},{"description":"Comma-separated tool names that require user confirmation before execution. Also accepts a file path containing one tool name per line. Requires the MCP client to support elicitation.","format":"string","name":"CB_MCP_CONFIRMATION_REQUIRED_TOOLS"},{"description":"Logging level for the MCP server. One of off, debug, info, warning, error. Use 'off' to disable logging entirely. Invalid values fall back to info. Default is info.","format":"string","name":"CB_MCP_LOG_LEVEL"},{"description":"Comma-separated list of log destinations. Allowed values: stderr, file. Include 'file' to write per-level log files; include 'stderr' to write to the console. Default is stderr.","format":"string","name":"CB_MCP_LOG_SINKS"},{"description":"Base path for the per-level log files. One rotating file is written per level (e.g. mcp_server.info.log, mcp_server.error.log). Only used when 'file' is in CB_MCP_LOG_SINKS. Default is mcp_server.log.","format":"string","name":"CB_MCP_LOG_FILE"},{"description":"Global maximum size in MB per-level log file before it rotates, inherited by every level unless overridden by a per-level CB_MCP_LOG_<LEVEL>_ROTATION_MAX_SIZE_MB. A value of 0 is invalid and falls back to the default (1 MB) with a startup warning. Default is 1 (1 MB).","format":"number","name":"CB_MCP_LOG_ROTATION_MAX_SIZE_MB"},{"description":"[DEPRECATED] Global rotation size in bytes; use CB_MCP_LOG_ROTATION_MAX_SIZE_MB (MB) instead. Still honored for backward compatibility but ignored when CB_MCP_LOG_ROTATION_MAX_SIZE_MB is also set. A value of 0 is invalid and falls back to the default with a startup warning.","format":"number","name":"CB_MCP_LOG_MAX_BYTES"},{"description":"Rotation size in MB for the ERROR log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for ERROR; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_ERROR_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the WARNING log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for WARNING; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_WARNING_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the INFO log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for INFO; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_INFO_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the DEBUG log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for DEBUG; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_DEBUG_ROTATION_MAX_SIZE_MB"},{"description":"Number of rotated backup files kept per-level log file, excluding the live file. Applies to every level unless overridden per level. Set to 0 to keep only the live file (still capped by the rotation size). Default is 1.","format":"number","name":"CB_MCP_LOG_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the ERROR log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for ERROR; inherits it when unset.","format":"number","name":"CB_MCP_LOG_ERROR_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the WARNING log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for WARNING; inherits it when unset.","format":"number","name":"CB_MCP_LOG_WARNING_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the INFO log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for INFO; inherits it when unset.","format":"number","name":"CB_MCP_LOG_INFO_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the DEBUG log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for DEBUG; inherits it when unset.","format":"number","name":"CB_MCP_LOG_DEBUG_RETENTION_BACKUP_COUNT"},{"description":"JWKS endpoint of the identity provider used to verify bearer JWT signatures. Required to enable OAuth, along with CB_MCP_OAUTH_JWT_ISSUER and CB_MCP_OAUTH_JWT_AUDIENCE. Only honored when CB_MCP_TRANSPORT=http.","format":"string","name":"CB_MCP_OAUTH_JWT_JWKS_URI"},{"description":"Expected JWT 'iss' claim value. Also advertised as the authorization server in Protected Resource Metadata when CB_MCP_OAUTH_MCP_BASE_URL is set. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_ISSUER"},{"description":"Expected JWT 'aud' claim value. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_AUDIENCE"},{"description":"JWT signing algorithm. One of RS256/384/512, ES256/384/512, PS256/384/512. Default is RS256.","format":"string","name":"CB_MCP_OAUTH_JWT_ALGORITHM"},{"description":"Public base URL of this MCP server. When set, the server publishes RFC 9728 Protected Resource Metadata at <base_url>/.well-known/oauth-protected-resource/mcp so PRM-aware clients can discover the authorization server. Optional.","format":"string","name":"CB_MCP_OAUTH_MCP_BASE_URL"},{"description":"Override the OAuth scope label the server treats as 'read' access; advertised in PRM and matched against the token's scope/scp claim. Use when your IdP cannot emit the canonical form. Default is couchbase-mcp:read.","format":"string","name":"CB_MCP_OAUTH_SCOPE_READ_LABEL"},{"description":"Override the OAuth scope label the server treats as 'write' access; same semantics as CB_MCP_OAUTH_SCOPE_READ_LABEL. Default is couchbase-mcp:write.","format":"string","name":"CB_MCP_OAUTH_SCOPE_WRITE_LABEL"},{"description":"Enable audit logging. Audit output is a separate sink from the CB_MCP_LOG_* operational logs, with a stable schema, its own retention, and events that cannot be filtered out. Default is false.","format":"boolean","name":"CB_MCP_AUDIT_LOG_ENABLED"},{"description":"Comma-separated audit destinations: console, file, or both. 'console' writes to stderr, never stdout, because stdout carries the JSON-RPC protocol under the stdio transport. Default is console.","format":"string","name":"CB_MCP_AUDIT_LOG_SINKS"},{"description":"Embedding provider for run_vector_query / run_vector_search: one of capella, openai, cohere, voyage, bedrock. Unset disables both tools' embedding step until configured.","format":"string","name":"CB_MCP_EMBEDDING_MODEL_PROVIDER"},{"description":"Path to the audit log file, required when 'file' is in CB_MCP_AUDIT_LOG_SINKS. Each server process writes its own file with the host and process id inserted before the extension (audit.log becomes audit.myhost.1234.log), because a stdio deployment runs one process per client. If the path is missing the server still starts, with the file sink dropped and an error recorded.","format":"filepath","name":"CB_MCP_AUDIT_LOG_FILE_PATH"},{"description":"Maximum size in MB the live audit file may reach before it rotates. 0 turns size-based rotation off. Default is 10 MB.","format":"number","name":"CB_MCP_AUDIT_LOG_ROTATION_MAX_SIZE_MB"},{"description":"Age the live audit file may reach before it rotates, as <value><unit> where the unit is 'd' (24 hours) or 'w' (7 days) - for example 1d, 30d, 1w, 8w. 0 turns interval-based rotation off. Size and interval are independent: whichever falls due first rotates the file. Default is 1d.","format":"string","name":"CB_MCP_AUDIT_LOG_ROTATION_INTERVAL"},{"description":"Model name/ID for the configured embedding provider.","format":"string","name":"CB_MCP_EMBEDDING_MODEL"},{"description":"Number of rotated audit files retained, excluding the live file. Rotated files are gzipped and named with the UTC rotation time. Set to 0 to keep no backups: the live file is truncated at each rotation. Default is 10.","format":"number","name":"CB_MCP_AUDIT_LOG_RETENTION_MAX_BACKUPS"},{"description":"Record tool argument values in the audit log. Off by default: there is no redaction in this release, so enabling this writes arguments verbatim, including the full document bodies passed to document-write tools. Review the audit file's retention and access controls before enabling it.","format":"boolean","name":"CB_MCP_AUDIT_LOG_TOOL_ARGS"},{"description":"Audit events to suppress, as comma-separated numeric event ids (for example '61490,61492'), or a path to a file with one id per line. Ids are listed in the audit descriptor shipped with the package. Only filterable events can be suppressed: write and security events are always recorded, and an attempt to disable one is refused with a warning.","format":"string","name":"CB_MCP_AUDIT_LOG_DISABLED_EVENTS"},{"description":"API key for the configured embedding provider. Not used by bedrock (uses the AWS credential chain / CB_MCP_EMBEDDING_MODEL_AWS_* instead).","format":"string","isSecret":true,"name":"CB_MCP_EMBEDDING_MODEL_API_KEY"},{"description":"Base URL override for the configured embedding provider (e.g. an OpenAI-compatible local server, or a Capella Model Service deployment's own URL). Required when CB_MCP_EMBEDDING_MODEL_PROVIDER=capella.","format":"string","name":"CB_MCP_EMBEDDING_MODEL_ENDPOINT"},{"description":"AWS access key ID, bedrock provider only. Omit to use the default AWS credential chain.","format":"string","isSecret":true,"name":"CB_MCP_EMBEDDING_MODEL_AWS_ACCESS_KEY_ID"},{"description":"AWS secret access key, bedrock provider only.","format":"string","isSecret":true,"name":"CB_MCP_EMBEDDING_MODEL_AWS_SECRET_ACCESS_KEY"},{"description":"AWS region, bedrock provider only. Falls back to the AWS SDK's own region resolution if unset.","format":"string","name":"CB_MCP_EMBEDDING_MODEL_AWS_REGION"}]},{"registryType":"oci","identifier":"docker.io/couchbase/mcp-server:1.1.0","transport":{"type":"stdio"},"packageArguments":[{"description":"Runs the Couchbase Operational Insights MCP server. Fixed; not user-configurable.","isRequired":true,"type":"positional","value":"operational-insights","valueHint":"subcommand"}],"environmentVariables":[{"description":"Operational Insights (Enterprise Analytics) endpoint URL, e.g. http://localhost:8095 (local) or https://<host>:18095 (Capella). An HTTP(S) URL, not a couchbase:// connection string.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CONNECTION_STRING"},{"description":"Operational Insights database username. Required for basic authentication.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_USERNAME"},{"description":"Operational Insights database password. Required for basic authentication.","format":"string","isSecret":true,"name":"CB_OPERATIONAL_INSIGHTS_PASSWORD"},{"description":"Operational Insights CA certificate (trust store) path, used to verify the server certificate over https://.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CA_CERT_PATH"},{"description":"Client certificate path for mTLS: a PEM certificate (paired with the client key path) or a PKCS#12 bundle (.p12/.pfx). Requires an https:// connection string. When set, username/password are ignored.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CLIENT_CERT_PATH"},{"description":"Client private key path (PEM) for mTLS. Leave unset when the client certificate is a PKCS#12 bundle that already contains the key.","format":"string","name":"CB_OPERATIONAL_INSIGHTS_CLIENT_KEY_PATH"},{"description":"Decryption password for the client key or PKCS#12 bundle, if it is encrypted. Omit if the file is unencrypted.","format":"string","isSecret":true,"name":"CB_OPERATIONAL_INSIGHTS_CLIENT_CERT_PASSWORD"},{"description":"Timeout in seconds for each async query request (start, status, fetch, discard, cancel). For a fetch it covers the whole download, so a result that takes longer than this to read fails. Positive integer, maximum 600; larger values are clamped to 600 with a warning, and any other invalid value is logged as a warning and the default is used. Default is 30.","format":"number","default":"30","name":"CB_MCP_OPERATIONAL_INSIGHTS_ASYNC_QUERY_RESULT_TIMEOUT"},{"description":"Operational Insights read only mode. Set to true to disable write operations: the operational_insights_create_index and operational_insights_cancel_async_query tools are not loaded, and queries that modify data are blocked. Set to false to allow them. Default is true.","format":"boolean","name":"CB_MCP_READ_ONLY_MODE"},{"description":"Transport mode for the server (stdio, http or sse). Default is stdio. OAuth is only honored with http.","format":"string","name":"CB_MCP_TRANSPORT"},{"description":"Host to run the MCP server on (default: 127.0.0.1). Used only for HTTP and SSE transport modes.","format":"string","name":"CB_MCP_HOST"},{"description":"Port to run the MCP server on (default: 8001). Used only for HTTP and SSE transport modes.","format":"number","name":"CB_MCP_PORT"},{"description":"Handle each HTTP request without per-session state (default: true when workers > 1, otherwise false). Only honored with the http transport; cannot be combined with CB_MCP_CONFIRMATION_REQUIRED_TOOLS.","format":"boolean","name":"CB_MCP_STATELESS_HTTP"},{"description":"Tools to disable. Accepts comma-separated tool names (e.g., 'tool_1,tool_2') or a file path containing one tool name per line.","format":"string","name":"CB_MCP_DISABLED_TOOLS"},{"description":"Comma-separated tool names that require user confirmation before execution. Also accepts a file path containing one tool name per line. Requires the MCP client to support elicitation.","format":"string","name":"CB_MCP_CONFIRMATION_REQUIRED_TOOLS"},{"description":"Logging level for the MCP server. One of off, debug, info, warning, error. Use 'off' to disable logging entirely. Invalid values fall back to info. Default is info.","format":"string","name":"CB_MCP_LOG_LEVEL"},{"description":"Comma-separated list of log destinations. Allowed values: stderr, file. Include 'file' to write per-level log files; include 'stderr' to write to the console. Default is stderr.","format":"string","name":"CB_MCP_LOG_SINKS"},{"description":"Base path for the per-level log files. One rotating file is written per level (e.g. mcp_server_operational_insights.info.log, mcp_server_operational_insights.error.log). Only used when 'file' is in CB_MCP_LOG_SINKS. Default is mcp_server_operational_insights.log.","format":"string","name":"CB_MCP_LOG_FILE"},{"description":"Global maximum size in MB per-level log file before it rotates, inherited by every level unless overridden by a per-level CB_MCP_LOG_<LEVEL>_ROTATION_MAX_SIZE_MB. A value of 0 is invalid and falls back to the default (1 MB) with a startup warning. Default is 1 (1 MB).","format":"number","name":"CB_MCP_LOG_ROTATION_MAX_SIZE_MB"},{"description":"[DEPRECATED] Global rotation size in bytes; use CB_MCP_LOG_ROTATION_MAX_SIZE_MB (MB) instead. Still honored for backward compatibility but ignored when CB_MCP_LOG_ROTATION_MAX_SIZE_MB is also set. A value of 0 is invalid and falls back to the default with a startup warning.","format":"number","name":"CB_MCP_LOG_MAX_BYTES"},{"description":"Rotation size in MB for the ERROR log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for ERROR; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_ERROR_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the WARNING log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for WARNING; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_WARNING_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the INFO log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for INFO; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_INFO_ROTATION_MAX_SIZE_MB"},{"description":"Rotation size in MB for the DEBUG log file. Overrides CB_MCP_LOG_ROTATION_MAX_SIZE_MB for DEBUG; inherits it when unset. 0 is invalid and falls back to the inherited global with a startup warning.","format":"number","name":"CB_MCP_LOG_DEBUG_ROTATION_MAX_SIZE_MB"},{"description":"Number of rotated backup files kept per-level log file, excluding the live file. Applies to every level unless overridden per level. Set to 0 to keep only the live file (still capped by the rotation size). Default is 1.","format":"number","name":"CB_MCP_LOG_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the ERROR log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for ERROR; inherits it when unset.","format":"number","name":"CB_MCP_LOG_ERROR_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the WARNING log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for WARNING; inherits it when unset.","format":"number","name":"CB_MCP_LOG_WARNING_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the INFO log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for INFO; inherits it when unset.","format":"number","name":"CB_MCP_LOG_INFO_RETENTION_BACKUP_COUNT"},{"description":"Rotated backups kept for the DEBUG log file. Overrides CB_MCP_LOG_RETENTION_BACKUP_COUNT for DEBUG; inherits it when unset.","format":"number","name":"CB_MCP_LOG_DEBUG_RETENTION_BACKUP_COUNT"},{"description":"Enable audit logging. Audit output is a separate sink from the CB_MCP_LOG_* operational logs, with a stable schema, its own retention, and events that cannot be filtered out. Default is false. This server emits audit records under its own event block, 0x10000 (65536), so an event id names the server that produced it.","format":"boolean","name":"CB_MCP_AUDIT_LOG_ENABLED"},{"description":"Comma-separated audit destinations: console, file, or both. 'console' writes to stderr, never stdout, because stdout carries the JSON-RPC protocol under the stdio transport. Default is console.","format":"string","name":"CB_MCP_AUDIT_LOG_SINKS"},{"description":"Path to the audit log file, required when 'file' is in CB_MCP_AUDIT_LOG_SINKS. Each server process writes its own file with the host and process id inserted before the extension (audit.log becomes audit.myhost.1234.log), because a stdio deployment runs one process per client. If the path is missing the server still starts, with the file sink dropped and an error recorded.","format":"filepath","name":"CB_MCP_AUDIT_LOG_FILE_PATH"},{"description":"Maximum size in MB the live audit file may reach before it rotates. 0 turns size-based rotation off. Default is 10 MB.","format":"number","name":"CB_MCP_AUDIT_LOG_ROTATION_MAX_SIZE_MB"},{"description":"Age the live audit file may reach before it rotates, as <value><unit> where the unit is 'd' (24 hours) or 'w' (7 days) - for example 1d, 30d, 1w, 8w. 0 turns interval-based rotation off. Size and interval are independent: whichever falls due first rotates the file. Default is 1d.","format":"string","name":"CB_MCP_AUDIT_LOG_ROTATION_INTERVAL"},{"description":"Number of rotated audit files retained, excluding the live file. Rotated files are gzipped and named with the UTC rotation time. Set to 0 to keep no backups: the live file is truncated at each rotation. Default is 10.","format":"number","name":"CB_MCP_AUDIT_LOG_RETENTION_MAX_BACKUPS"},{"description":"Record tool argument values in the audit log. Off by default: there is no redaction in this release, so enabling this writes arguments verbatim, including the full document bodies passed to document-write tools. Review the audit file's retention and access controls before enabling it.","format":"boolean","name":"CB_MCP_AUDIT_LOG_TOOL_ARGS"},{"description":"Audit events to suppress, as comma-separated numeric event ids (for example '61490,61492'), or a path to a file with one id per line. Ids are listed in the audit descriptor shipped with the package. Only filterable events can be suppressed: write and security events are always recorded, and an attempt to disable one is refused with a warning.","format":"string","name":"CB_MCP_AUDIT_LOG_DISABLED_EVENTS"},{"description":"JWKS endpoint of the identity provider used to verify bearer JWT signatures. Required to enable OAuth, along with CB_MCP_OAUTH_JWT_ISSUER and CB_MCP_OAUTH_JWT_AUDIENCE. Only honored when CB_MCP_TRANSPORT=http.","format":"string","name":"CB_MCP_OAUTH_JWT_JWKS_URI"},{"description":"Expected JWT 'iss' claim value. Also advertised as the authorization server in Protected Resource Metadata when CB_MCP_OAUTH_MCP_BASE_URL is set. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_ISSUER"},{"description":"Expected JWT 'aud' claim value. Required to enable OAuth.","format":"string","name":"CB_MCP_OAUTH_JWT_AUDIENCE"},{"description":"JWT signing algorithm. One of RS256/384/512, ES256/384/512, PS256/384/512. Default is RS256.","format":"string","name":"CB_MCP_OAUTH_JWT_ALGORITHM"},{"description":"Public base URL of this MCP server. When set, the server publishes RFC 9728 Protected Resource Metadata at <base_url>/.well-known/oauth-protected-resource/mcp so PRM-aware clients can discover the authorization server. Optional.","format":"string","name":"CB_MCP_OAUTH_MCP_BASE_URL"},{"description":"Override the OAuth scope label the server treats as 'read' access; advertised in PRM and matched against the token's scope/scp claim. Use when your IdP cannot emit the canonical form. Default is couchbase-mcp:read.","format":"string","name":"CB_MCP_OAUTH_SCOPE_READ_LABEL"},{"description":"Override the OAuth scope label the server treats as 'write' access; same semantics as CB_MCP_OAUTH_SCOPE_READ_LABEL. Default is couchbase-mcp:write.","format":"string","name":"CB_MCP_OAUTH_SCOPE_WRITE_LABEL"}]}],"tools":[],"scan":{"score":85,"grade":"A","scanned_at":"2026-11-03T23:29:54.304Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-11-03T23:29:54.262Z","components":{"code":{"score":25,"max":25,"notes":["95 source files scanned","95 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":9,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"couchbase-mcp-server","version":"1.1.0","found":true,"weeklyDownloads":548,"license":"Apache-2.0","dependencyCount":17,"publishedAt":"2026-11-02T13:58:44.368565Z","repositoryUrl":"https://github.com/couchbase/mcp-server-couchbase"},{"registryType":"pypi","identifier":"couchbase-mcp-server","version":"1.1.0","found":true,"weeklyDownloads":548,"license":"Apache-2.0","dependencyCount":17,"publishedAt":"2026-11-02T13:58:44.368565Z","repositoryUrl":"https://github.com/couchbase/mcp-server-couchbase"}],"repo":{"found":true,"owner":"couchbase","repo":"mcp-server-couchbase","archived":false,"pushedAt":"2026-11-02T13:57:21Z","stars":34,"forks":34,"openIssues":9,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/605755?v=4","ownerCreatedAt":"2011-02-07T23:22:25Z","license":"Apache-2.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/605755?v=4&s=128","source":"registry","width":128,"height":128},"presence":{"stars":34,"forks":34,"downloadsWeek":1096,"license":"Apache-2.0","lastPushAt":"2026-11-02T13:57:21.000Z","score":48}}}},"grade_history":[],"reviews":[]}