Back to Home
mapyr icon

mcp-hangar

Verified Safe

by mapyr

Overview

Lifecycle management and orchestration platform for Model Context Protocol (MCP) providers, focusing on auto-discovery, observability, and resilience for LLM tooling at scale.

Installation

Run Command
mcp-hangar --config config.yaml --http

Environment Variables

  • MCP_LOG_LEVEL
  • MCP_CONFIG
  • MCP_MODE
  • MCP_HTTP_PORT
  • MCP_JSON_LOGS
  • HANGAR_LANGFUSE_ENABLED
  • LANGFUSE_PUBLIC_KEY
  • LANGFUSE_SECRET_KEY
  • LANGFUSE_HOST
  • OTEL_EXPORTER_OTLP_ENDPOINT
  • OTEL_SERVICE_NAME
  • MCP_TRACING_ENABLED
  • MCP_ENVIRONMENT
  • MCP_AUTH_DB_PASSWORD
  • GITHUB_TOKEN
  • GOOGLE_APPLICATION_CREDENTIALS
  • SLACK_BOT_TOKEN
  • BRAVE_API_KEY
  • SENTRY_AUTH_TOKEN
  • SENTRY_ORG
  • SENTRY_PROJECT
  • MCP_CONTAINER_RUNTIME
  • MCP_CI_RELAX_VOLUME_PERMS

Security Notes

**CRITICAL VULNERABILITY**: The 'AUTH_SECURITY_AUDIT.md' report explicitly highlights a lack of rate limiting on authentication attempts, making the server vulnerable to brute-force attacks. **MEDIUM RISKS**: Absence of IP binding for API keys (allowing stolen keys to be used from any IP) and lack of automatic API key rotation are noted. While the project implements strong secure defaults for Kubernetes pods (runAsNonRoot, readOnlyRootFilesystem, dropped capabilities), input validation, command sanitization, and secrets masking in logs, the critical authentication weakness significantly lowers the overall security posture. Example Keycloak configuration files contain hardcoded secrets (`mcp-hangar-secret`), which should be replaced with proper secret management in production deployments.

Similar Servers

Stats

Interest Score40
Security Score4
Cost ClassMedium
Avg Tokens300
Stars7
Forks1
Last Update2026-01-19

Tags

AI/ML InfrastructureLLM ToolingKubernetesObservabilityProvider Orchestration