nab

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-10-24T14:03:13.098038Z",
      "publishedAt": "2026-10-24T14:03:13.098038Z",
      "statusChangedAt": "2026-10-24T14:03:13.098038Z"
    }
  },
  "server": {
    "name": "io.github.MikkoParkkola/nab",
    "title": "nab",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.12.6",
    "packages": [
      {
        "version": "0.12.6",
        "transport": {
          "type": "stdio"
        },
        "identifier": "nab",
        "registryType": "cargo",
        "registryBaseUrl": "https://crates.io",
        "environmentVariables": [
          {
            "name": "NAB_SSRF_ALLOW_PRIVATE",
            "description": "Set to allow fetching private/internal IP addresses (corporate dashboards). Never unblocks loopback, link-local/cloud-metadata, or other always-denied ranges. Off by default."
          },
          {
            "name": "NAB_SSRF_ALLOWLIST",
            "description": "Comma-separated list of private IP/CIDR ranges to exempt from the SSRF guard (e.g. 10.252.0.0/16,192.168.1.5). Narrower, preferred alternative to NAB_SSRF_ALLOW_PRIVATE. Empty by default."
          },
          {
            "name": "NAB_WEBMCP_STRICT",
            "description": "Set to a truthy value to require fetched pages advertising a WebMCP manifest to match NAB_WEBMCP_OPT_IN before ingestion is allowed (defense against prompt injection via fetched content). Off by default."
          },
          {
            "name": "NAB_WEBMCP_OPT_IN",
            "description": "Comma-separated allowlist consulted when NAB_WEBMCP_STRICT is enabled. Empty by default."
          },
          {
            "name": "NAB_STATE_DIR",
            "description": "Overrides the directory used to persist session/cookie state (default: ~/.nab)."
          },
          {
            "name": "NAB_KEYCHAIN_INTERACTION",
            "description": "Controls whether cookie extraction may prompt macOS Keychain for authorization. Set to 'never' in automated/headless callers so a background fetch cannot open a GUI dialog."
          },
          {
            "name": "NAB_OP_BIN",
            "description": "Path to the 1Password CLI binary used for credential retrieval during the login tool (default: op)."
          },
          {
            "name": "NAB_MCP_CLI_BIN",
            "description": "Path to the mcp-cli binary used for MCP-based credential retrieval (default: mcp-cli)."
          },
          {
            "name": "NAB_NO_TELEMETRY",
            "description": "Set to anything other than 0 or false to skip the daily heartbeat. NO_TELEMETRY and DO_NOT_TRACK do the same."
          },
          {
            "name": "NAB_TELEMETRY_ENDPOINT",
            "description": "Replace the daily heartbeat URL. An empty value leaves the default."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/MikkoParkkola/nab",
      "source": "github"
    },
    "websiteUrl": "https://github.com/MikkoParkkola/nab",
    "description": "Token-optimized HTTP client for LLMs: fetches any URL as clean markdown. CLI and MCP server."
  }
}