CB_USERNAME
optional
Database username for basic authentication, created in Capella or Couchbase Server RBAC.
CB_CA_CERT_PATH
optional
Server CA certificate path for TLS with self-signed/untrusted certificates; not needed for Capella.
CB_CLIENT_CERT_PATH
optional
Client certificate file path for mTLS authentication.
CB_CLIENT_KEY_PATH
optional
Client private key file path for mTLS authentication.
CB_MCP_READ_ONLY_MODE
optional
Read-only switch, true by default; disables all write operations (KV, query, scope/collection and index management).
CB_MCP_TRANSPORT
optional
Transport mode: stdio, http, or sse. Default stdio.
CB_MCP_HOST
optional
Host the server binds to in HTTP/SSE modes, default 127.0.0.1.
CB_MCP_PORT
optional
Port for HTTP/SSE modes, default 8000.
CB_MCP_DISABLED_TOOLS
optional
Tools to disable: comma-separated names or a file path with one tool name per line.
CB_MCP_CONFIRMATION_REQUIRED_TOOLS
optional
Tools requiring explicit user confirmation via MCP elicitation before execution.
CB_MCP_LOG_LEVEL
optional
Log level: off, debug, info, warning, error. Default info.
CB_MCP_LOG_SINKS
optional
Log destinations: stderr, file, or both. Default stderr.
CB_MCP_LOG_FILE
optional
Base path for per-level log files, default mcp_server.log.
CB_MCP_LOG_ROTATION_MAX_SIZE_MB
optional
Global per-level log rotation size in MB, default 1.
CB_MCP_LOG_MAX_BYTES
optional
Deprecated byte-based rotation size; ignored when CB_MCP_LOG_ROTATION_MAX_SIZE_MB is set.
CB_MCP_LOG_ERROR_ROTATION_MAX_SIZE_MB
optional
Overrides the global rotation size (MB) for the ERROR log file.
CB_MCP_LOG_WARNING_ROTATION_MAX_SIZE_MB
optional
Overrides the global rotation size (MB) for the WARNING log file.
CB_MCP_LOG_INFO_ROTATION_MAX_SIZE_MB
optional
Overrides the global rotation size (MB) for the INFO log file.
CB_MCP_LOG_DEBUG_ROTATION_MAX_SIZE_MB
optional
Overrides the global rotation size (MB) for the DEBUG log file.
CB_MCP_LOG_RETENTION_BACKUP_COUNT
optional
Number of rotated backups kept per level, default 1.
CB_MCP_LOG_ERROR_RETENTION_BACKUP_COUNT
optional
Overrides the global backup count for the ERROR log file.
CB_MCP_LOG_WARNING_RETENTION_BACKUP_COUNT
optional
Overrides the global backup count for the WARNING log file.
CB_MCP_LOG_INFO_RETENTION_BACKUP_COUNT
optional
Overrides the global backup count for the INFO log file.
CB_MCP_LOG_DEBUG_RETENTION_BACKUP_COUNT
optional
Overrides the global backup count for the DEBUG log file.
CB_MCP_OAUTH_JWT_JWKS_URI
optional
Identity provider JWKS endpoint used to verify bearer JWT signatures; required for OAuth, only honored on http transport.
CB_MCP_OAUTH_JWT_ISSUER
optional
Expected JWT 'iss' claim; required to enable OAuth.
CB_MCP_OAUTH_JWT_AUDIENCE
optional
Expected JWT 'aud' claim; required to enable OAuth.
CB_MCP_OAUTH_JWT_ALGORITHM
optional
JWT signing algorithm (RS256/384/512, ES256/384/512, PS256/384/512); default RS256.
CB_MCP_OAUTH_MCP_BASE_URL
optional
Public base URL of this server; when set, publishes RFC 9728 Protected Resource Metadata.
CB_MCP_OAUTH_SCOPE_READ_LABEL
optional
Override of the OAuth scope label treated as 'read' access; default couchbase-mcp:read.
CB_MCP_OAUTH_SCOPE_WRITE_LABEL
optional
Override of the OAuth scope label treated as 'write' access; default couchbase-mcp:write.