ConnectSecure MCP

Host a copy with our keys and logs.

• CONNECTSECURE_BASE_URL — Your tenant's pod URL, e.g. https://pod104.myconnectsecure.com (Profile > API Documentation in the portal). Each tenant has its own pod; there is no working default.
• CONNECTSECURE_TENANT — Tenant name you type on the ConnectSecure portal login screen.
• CONNECTSECURE_CLIENT_ID — API client ID from Settings > Users > (user) > API Key.
• CONNECTSECURE_CLIENT_SECRET — API client secret from Settings > Users > (user) > API Key.
• CONNECTSECURE_ACCESS_TOKEN — Optional. A pre-minted JWT from /w/authorize; while it is unexpired it is used instead of minting one. The tenant, client ID and secret are still needed so the CLI can mint a fresh token once it expires.
• CONNECTSECURE_USER_ID — Optional user_id from /w/authorize. Only needed with a pre-minted access token; minting fills it automatically.
• CONNECTSECURE_MCP_READ_ONLY — Set to 1 to make the MCP server refuse every write and hide the sync, export and tail tools (import is never an MCP tool). Credential reads are still answered.
• CONNECTSECURE_USER_AGENT — Overrides the User-Agent the CLI sends on ConnectSecure requests.
• CONNECTSECURE_MCP_HTTP_TOKEN — Required only when running the MCP server with --transport http. Not needed for the default local stdio transport.
• PRINTING_PRESS_CLIENT_PROFILE — Optional: binds the MCP server to a tenant-gated Printing Press client profile. This connector registers none; leave unset.
• CONNECTSECURE_NO_LOCAL_DATA — Optional. Set to 1 to keep no local copy of API responses: reads go to the API, the response cache is off, and sync refuses to run. Leave blank to keep the local store.
• CONNECTSECURE_MCP_UPLOAD_ROOT — Optional. Leave blank: MCP file uploads then take the file as base64 content and the server never opens a local path. Set it to a folder only to let MCP uploads read files from inside that folder.