---
bezeichner: "io.github.navapbc/rebar"
art: "mcp_server"
slug: "io-github-navapbc-rebar"
paketkoordinate: "pypi:nava-rebar"
status: "aktiv"
homepage: "https://github.com/navapbc/rebar"
erhebungsstand: "2026-10-10T01:17:01.464Z"
namensraum: "io.github.navapbc"
registerseite: "https://tracevero.de/mcp/io-github-navapbc-rebar"
abgerufen_am: "2026-10-10"
zugangsdaten_erforderlich: false
ausfuehrungsort: "lokal"
dateisystem_pfadargument: false
quelloffen_einsehbar: true
einsatzgebiet: "aufgabenverwaltung"
roh_beschreibung: "Event-sourced ticket tracker + Jira reconciler, exposed as a Python library, CLI, and MCP server."
version: "0.13.1"
roh_umgebungsvariablen: "REBAR_ROOT, REBAR_MCP_READONLY, REBAR_MCP_ALLOW_LLM, REBAR_MCP_ALLOW_JIRA_SYNC, REBAR_MCP_TRANSPORT, REBAR_MCP_HTTP_HOST, REBAR_MCP_HTTP_PORT, REBAR_MCP_HTTP_PATH, REBAR_MCP_HTTP_ALLOWED_HOSTS, REBAR_MCP_HTTP_ALLOWED_ORIGINS, REBAR_MCP_HTTP_TLS_AT_EDGE, REBAR_MCP_ALLOW_UNAUTHENTICATED_HTTP, REBAR_MCP_AUTH_ENABLED, REBAR_MCP_AUTH_STRATEGIES, REBAR_MCP_AUTH_ISSUER_URL, REBAR_MCP_AUTH_RESOURCE_SERVER_URL, REBAR_MCP_AUTH_REQUIRED_SCOPES, REBAR_MCP_AUTH_STATIC_TOKENS_FILE, REBAR_MCP_AUTH_JWT_JWKS_URI, REBAR_MCP_AUTH_JWT_ISSUER, REBAR_MCP_AUTH_JWT_ALGORITHMS, REBAR_MCP_AUTH_JWT_LEEWAY, REBAR_MCP_AUTH_JWT_JWKS_REFETCH_COOLDOWN, REBAR_MCP_AUTH_JWT_JWKS_TIMEOUT, REBAR_MCP_AUTH_JWT_EXPECTED_TYP, REBAR_MCP_AUTH_JWT_ALLOW_PRIVATE_JWKS_HOST, REBAR_MCP_AUTH_INTROSPECTION_ENDPOINT, REBAR_MCP_AUTH_INTROSPECTION_CLIENT_ID, REBAR_MCP_AUTH_INTROSPECTION_CLIENT_SECRET_ENV, REBAR_MCP_AUTH_INTROSPECTION_ALLOW_PRIVATE_HOST, REBAR_MCP_AUTH_INTROSPECTION_ALLOW_MISSING_AUD, REBAR_MCP_AUTH_PROXY_SECRET_ENV, REBAR_MCP_AUTH_PROXY_SECRET_HEADER, REBAR_MCP_AUTH_PROXY_IDENTITY_HEADER, REBAR_MCP_AUTH_PROXY_SCOPES, REBAR_MCP_AUTH_CUSTOM_IMPORT"
roh_geheime_pflichtvariablen: ""
roh_transportarten: "stdio"
roh_pfadargumente: ""
roh_repository_url: "https://github.com/navapbc/rebar"
roh_paketquellen: "pypi"
roh_geheime_pflichtkopfzeilen: ""
roh_pfad_umgebungsvariablen: ""
roh_remote_adressen: ""
roh_remote_hosts: ""
roh_statusmeldung: ""
roh_veroeffentlicht_am: "2026-08-30"
roh_aktualisiert_am: "2026-08-30"
roh_schemafassung: "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json"
roh_bereitstellungsform: "paket"
roh_repository_quelle: "github"
roh_repository_unterordner: ""
roh_paketbezeichner: "nava-rebar"
roh_paketversionen: "0.13.1"
roh_laufzeithinweise: "uvx"
roh_umgebungsformate: ""
roh_umgebungsbeschreibungen: "REBAR_MCP_ALLOW_JIRA_SYNC=Set to 1 to allow the live (mutating) Jira reconcile mode; otherwise reconcile is dry-run only. · REBAR_MCP_ALLOW_LLM=Set to 1 to enable the billable LLM tools (review_code / scan_spec / verify_completion / review_plan); off by default. · REBAR_MCP_ALLOW_UNAUTHENTICATED_HTTP=Set to 1 to acknowledge running the Streamable-HTTP transport without a token verifier; required to boot the HTTP transport while auth is off. · REBAR_MCP_AUTH_CUSTOM_IMPORT=The `custom` strategy's `module:factory` import string, resolving to a factory that returns a TokenVerifier; a TRUSTED operator config value that loads and executes the operator-configured code at startup (fail-closed on any load error). · REBAR_MCP_AUTH_ENABLED=Set to 1 to enable MCP authentication (the composite token verifier + Resource-Server wiring); off by default. · REBAR_MCP_AUTH_INTROSPECTION_ALLOW_MISSING_AUD=Set to 1 to accept an active introspection response that OMITS `aud` (many AS do); off by default (fail-closed reject). · REBAR_MCP_AUTH_INTROSPECTION_ALLOW_PRIVATE_HOST=Set to 1 to permit a private/link-local/loopback introspection endpoint host (SSRF guard is on by default); off by default. · REBAR_MCP_AUTH_INTROSPECTION_CLIENT_ID=The client id the `introspection` verifier presents to the Authorization Server via HTTP Basic (client_secret_basic). · REBAR_MCP_AUTH_INTROSPECTION_CLIENT_SECRET_ENV=The NAME of the env var holding the introspection client secret (never the secret itself); must be present + non-empty at startup or the server refuses to start (fail-closed). · REBAR_MCP_AUTH_INTROSPECTION_ENDPOINT=The `introspection` verifier's RFC 7662 endpoint URL (must be https://); the opaque token is POSTed here on every request (no caching). · REBAR_MCP_AUTH_ISSUER_URL=OAuth authorization-server issuer URL advertised in the Protected-Resource Metadata (RFC 9728) when auth is enabled. · REBAR_MCP_AUTH_JWT_ALGORITHMS=Comma-separated PINNED, asymmetric-only JWS algorithms for the `jwt` verifier (default RS256,ES256); a symmetric algorithm on a JWKS source is refused. · REBAR_MCP_AUTH_JWT_ALLOW_PRIVATE_JWKS_HOST=Set to 1 to permit a private/link-local/loopback JWKS host (SSRF guard is on by default); off by default. · REBAR_MCP_AUTH_JWT_EXPECTED_TYP=When set, the `jwt` verifier requires the JWT header `typ` to equal this (e.g. at+JWT per RFC 9068); unset skips the check. · REBAR_MCP_AUTH_JWT_ISSUER=Expected `iss` claim for the `jwt` verifier; falls back to REBAR_MCP_AUTH_ISSUER_URL when unset. · REBAR_MCP_AUTH_JWT_JWKS_REFETCH_COOLDOWN=Minimum seconds between JWKS refetches triggered by an unknown key id (the concurrency-safe flood guard; default 30). · REBAR_MCP_AUTH_JWT_JWKS_TIMEOUT=HTTP timeout in seconds for the `jwt` verifier's JWKS fetch (default 10). · REBAR_MCP_AUTH_JWT_JWKS_URI=HTTPS JWKS endpoint the `jwt` verifier fetches signing keys from (an OIDC provider's .well-known/jwks.json). · REBAR_MCP_AUTH_JWT_LEEWAY=Clock-skew leeway in seconds applied to exp/nbf validation by the `jwt` verifier (default 60). · REBAR_MCP_AUTH_PROXY_IDENTITY_HEADER=The header carrying the proxy-authenticated principal identity, trusted only when the secret header validates (default x-forwarded-user). · REBAR_MCP_AUTH_PROXY_SCOPES=Comma-separated fixed scope set granted to proxy-authenticated principals; empty by default (the principal holds no scopes). · REBAR_MCP_AUTH_PROXY_SECRET_ENV=The NAME of the env var holding the trusted-proxy shared secret (never the secret itself); must be present + non-empty at startup or the `proxy` verifier refuses to start (fail-closed). · REBAR_MCP_AUTH_PROXY_SECRET_HEADER=The header the fronting proxy sends its shared secret on; the identity is trusted only when this matches (constant-time; default x-proxy-auth). · REBAR_MCP_AUTH_REQUIRED_SCOPES=Comma-separated scopes a caller must hold; the SDK returns 403 insufficient_scope when a principal lacks one. · REBAR_MCP_AUTH_RESOURCE_SERVER_URL=The single resource identifier (RFC 8707 audience) for this server; the composite verifier re-checks every accepted token against it. · REBAR_MCP_AUTH_STATIC_TOKENS_FILE=Path to the JSON secrets file for the static-bearer verifier (stores only SHA-256 digests of the accepted tokens). · REBAR_MCP_AUTH_STRATEGIES=Comma-separated, ordered list of token-verifier strategies to compose (closed set: static, jwt, introspection, proxy, custom). · REBAR_MCP_HTTP_ALLOWED_HOSTS=Comma-separated allowlist of exact host:port values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback. · REBAR_MCP_HTTP_ALLOWED_ORIGINS=Comma-separated allowlist of exact Origin values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback. · REBAR_MCP_HTTP_HOST=Bind host for the Streamable-HTTP transport (default 127.0.0.1). · REBAR_MCP_HTTP_PATH=URL path the Streamable-HTTP transport serves on (default /mcp). · REBAR_MCP_HTTP_PORT=Bind port for the Streamable-HTTP transport (1-65535; default 8000). · REBAR_MCP_HTTP_TLS_AT_EDGE=Set to 1 to acknowledge TLS is terminated at the edge; required to bind the Streamable-HTTP transport to a non-loopback host. · REBAR_MCP_READONLY=Set to 1 to expose only the read tools (no write/mutation tools). · REBAR_MCP_TRANSPORT=Transport for the MCP server: 'stdio' (default) or 'http' (the optional Streamable-HTTP transport). · REBAR_ROOT=Path to the repo root that holds the .tickets-tracker store (defaults to the git toplevel of the working dir)."
roh_symbolformate: ""
roh_verbindungswege: "{\"packages\":[{\"registryType\":\"pypi\",\"identifier\":\"nava-rebar\",\"version\":\"0.13.1\",\"runtimeHint\":\"uvx\",\"transport\":\"stdio\",\"environment\":[{\"name\":\"REBAR_ROOT\",\"description\":\"Path to the repo root that holds the .tickets-tracker store (defaults to the git toplevel of the working dir).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_READONLY\",\"description\":\"Set to 1 to expose only the read tools (no write/mutation tools).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_ALLOW_LLM\",\"description\":\"Set to 1 to enable the billable LLM tools (review_code / scan_spec / verify_completion / review_plan); off by default.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_ALLOW_JIRA_SYNC\",\"description\":\"Set to 1 to allow the live (mutating) Jira reconcile mode; otherwise reconcile is dry-run only.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_TRANSPORT\",\"description\":\"Transport for the MCP server: 'stdio' (default) or 'http' (the optional Streamable-HTTP transport).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_HTTP_HOST\",\"description\":\"Bind host for the Streamable-HTTP transport (default 127.0.0.1).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_HTTP_PORT\",\"description\":\"Bind port for the Streamable-HTTP transport (1-65535; default 8000).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_HTTP_PATH\",\"description\":\"URL path the Streamable-HTTP transport serves on (default /mcp).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_HTTP_ALLOWED_HOSTS\",\"description\":\"Comma-separated allowlist of exact host:port values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_HTTP_ALLOWED_ORIGINS\",\"description\":\"Comma-separated allowlist of exact Origin values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_HTTP_TLS_AT_EDGE\",\"description\":\"Set to 1 to acknowledge TLS is terminated at the edge; required to bind the Streamable-HTTP transport to a non-loopback host.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_ALLOW_UNAUTHENTICATED_HTTP\",\"description\":\"Set to 1 to acknowledge running the Streamable-HTTP transport without a token verifier; required to boot the HTTP transport while auth is off.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_ENABLED\",\"description\":\"Set to 1 to enable MCP authentication (the composite token verifier + Resource-Server wiring); off by default.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_STRATEGIES\",\"description\":\"Comma-separated, ordered list of token-verifier strategies to compose (closed set: static, jwt, introspection, proxy, custom).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_ISSUER_URL\",\"description\":\"OAuth authorization-server issuer URL advertised in the Protected-Resource Metadata (RFC 9728) when auth is enabled.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_RESOURCE_SERVER_URL\",\"description\":\"The single resource identifier (RFC 8707 audience) for this server; the composite verifier re-checks every accepted token against it.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_REQUIRED_SCOPES\",\"description\":\"Comma-separated scopes a caller must hold; the SDK returns 403 insufficient_scope when a principal lacks one.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_STATIC_TOKENS_FILE\",\"description\":\"Path to the JSON secrets file for the static-bearer verifier (stores only SHA-256 digests of the accepted tokens).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_JWKS_URI\",\"description\":\"HTTPS JWKS endpoint the `jwt` verifier fetches signing keys from (an OIDC provider's .well-known/jwks.json).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_ISSUER\",\"description\":\"Expected `iss` claim for the `jwt` verifier; falls back to REBAR_MCP_AUTH_ISSUER_URL when unset.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_ALGORITHMS\",\"description\":\"Comma-separated PINNED, asymmetric-only JWS algorithms for the `jwt` verifier (default RS256,ES256); a symmetric algorithm on a JWKS source is refused.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_LEEWAY\",\"description\":\"Clock-skew leeway in seconds applied to exp/nbf validation by the `jwt` verifier (default 60).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_JWKS_REFETCH_COOLDOWN\",\"description\":\"Minimum seconds between JWKS refetches triggered by an unknown key id (the concurrency-safe flood guard; default 30).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_JWKS_TIMEOUT\",\"description\":\"HTTP timeout in seconds for the `jwt` verifier's JWKS fetch (default 10).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_EXPECTED_TYP\",\"description\":\"When set, the `jwt` verifier requires the JWT header `typ` to equal this (e.g. at+JWT per RFC 9068); unset skips the check.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_JWT_ALLOW_PRIVATE_JWKS_HOST\",\"description\":\"Set to 1 to permit a private/link-local/loopback JWKS host (SSRF guard is on by default); off by default.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_INTROSPECTION_ENDPOINT\",\"description\":\"The `introspection` verifier's RFC 7662 endpoint URL (must be https://); the opaque token is POSTed here on every request (no caching).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_INTROSPECTION_CLIENT_ID\",\"description\":\"The client id the `introspection` verifier presents to the Authorization Server via HTTP Basic (client_secret_basic).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_INTROSPECTION_CLIENT_SECRET_ENV\",\"description\":\"The NAME of the env var holding the introspection client secret (never the secret itself); must be present + non-empty at startup or the server refuses to start (fail-closed).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_INTROSPECTION_ALLOW_PRIVATE_HOST\",\"description\":\"Set to 1 to permit a private/link-local/loopback introspection endpoint host (SSRF guard is on by default); off by default.\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_INTROSPECTION_ALLOW_MISSING_AUD\",\"description\":\"Set to 1 to accept an active introspection response that OMITS `aud` (many AS do); off by default (fail-closed reject).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_PROXY_SECRET_ENV\",\"description\":\"The NAME of the env var holding the trusted-proxy shared secret (never the secret itself); must be present + non-empty at startup or the `proxy` verifier refuses to start (fail-closed).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_PROXY_SECRET_HEADER\",\"description\":\"The header the fronting proxy sends its shared secret on; the identity is trusted only when this matches (constant-time; default x-proxy-auth).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_PROXY_IDENTITY_HEADER\",\"description\":\"The header carrying the proxy-authenticated principal identity, trusted only when the secret header validates (default x-forwarded-user).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_PROXY_SCOPES\",\"description\":\"Comma-separated fixed scope set granted to proxy-authenticated principals; empty by default (the principal holds no scopes).\",\"required\":false,\"secret\":false},{\"name\":\"REBAR_MCP_AUTH_CUSTOM_IMPORT\",\"description\":\"The `custom` strategy's `module:factory` import string, resolving to a factory that returns a TokenVerifier; a TRUSTED operator config value that loads and executes the operator-configured code at startup (fail-closed on any load error).\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":false}],\"remotes\":[]}"
---

# io.github.navapbc/rebar

## Gemessene Werte

| Merkmal | Wert | Quelle | Erhoben am | Vertrauensgrad | Rohangabe |
| --- | --- | --- | --- | --- | --- |
| Pflicht-Geheimnisse deklariert | false | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_geheime_pflichtvariablen: ; roh_geheime_pflichtkopfzeilen: |
| Ausführungsort | lokal | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_transportarten: stdio |
| Pfadargument vorhanden | false | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_pfadargumente: ; roh_pfad_umgebungsvariablen: |
| Repository-Adresse geführt | true | MCP-Register | 2026-08-06T13:57:41.838Z | abgeleitet | roh_repository_url: https://github.com/navapbc/rebar |
| Einsatzgebiet, aus der Anbieterbeschreibung abgeleitet | aufgabenverwaltung | MCP-Register | 2026-08-26T16:45:01.514Z | abgeleitet | roh_beschreibung: Event-sourced ticket tracker + Jira reconciler, exposed as a Python library, CLI, and MCP server. |
| Beschreibung (Rohangabe) | Event-sourced ticket tracker + Jira reconciler, exposed as a Python library, CLI, and MCP server. | MCP-Register | 2026-08-31T01:17:02.104Z | selbstauskunft |  |
| Deklarierte Version | 0.13.1 | MCP-Register | 2026-08-31T01:17:02.104Z | selbstauskunft |  |
| Umgebungsvariablen (Rohangabe) | REBAR_ROOT, REBAR_MCP_READONLY, REBAR_MCP_ALLOW_LLM, REBAR_MCP_ALLOW_JIRA_SYNC, REBAR_MCP_TRANSPORT, REBAR_MCP_HTTP_HOST, REBAR_MCP_HTTP_PORT, REBAR_MCP_HTTP_PATH, REBAR_MCP_HTTP_ALLOWED_HOSTS, REBAR_MCP_HTTP_ALLOWED_ORIGINS, REBAR_MCP_HTTP_TLS_AT_EDGE, REBAR_MCP_ALLOW_UNAUTHENTICATED_HTTP, REBAR_MCP_AUTH_ENABLED, REBAR_MCP_AUTH_STRATEGIES, REBAR_MCP_AUTH_ISSUER_URL, REBAR_MCP_AUTH_RESOURCE_SERVER_URL, REBAR_MCP_AUTH_REQUIRED_SCOPES, REBAR_MCP_AUTH_STATIC_TOKENS_FILE, REBAR_MCP_AUTH_JWT_JWKS_URI, REBAR_MCP_AUTH_JWT_ISSUER, REBAR_MCP_AUTH_JWT_ALGORITHMS, REBAR_MCP_AUTH_JWT_LEEWAY, REBAR_MCP_AUTH_JWT_JWKS_REFETCH_COOLDOWN, REBAR_MCP_AUTH_JWT_JWKS_TIMEOUT, REBAR_MCP_AUTH_JWT_EXPECTED_TYP, REBAR_MCP_AUTH_JWT_ALLOW_PRIVATE_JWKS_HOST, REBAR_MCP_AUTH_INTROSPECTION_ENDPOINT, REBAR_MCP_AUTH_INTROSPECTION_CLIENT_ID, REBAR_MCP_AUTH_INTROSPECTION_CLIENT_SECRET_ENV, REBAR_MCP_AUTH_INTROSPECTION_ALLOW_PRIVATE_HOST, REBAR_MCP_AUTH_INTROSPECTION_ALLOW_MISSING_AUD, REBAR_MCP_AUTH_PROXY_SECRET_ENV, REBAR_MCP_AUTH_PROXY_SECRET_HEADER, REBAR_MCP_AUTH_PROXY_IDENTITY_HEADER, REBAR_MCP_AUTH_PROXY_SCOPES, REBAR_MCP_AUTH_CUSTOM_IMPORT | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft |  |
| Geheime Pflichtvariablen (Rohangabe) |  | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft |  |
| Transportarten (Rohangabe) | stdio | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft |  |
| Pfadargumente (Rohangabe) |  | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft |  |
| Repository (Rohangabe) | https://github.com/navapbc/rebar | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft |  |
| Paketquellen (Rohangabe) | pypi | MCP-Register | 2026-08-06T13:57:41.838Z | selbstauskunft |  |
| Geheime Pflichtkopfzeilen (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Pfad-Umgebungsvariablen (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Remote-Adressen (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Remote-Hosts (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Statusmeldung des Registers (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Im Register eingetragen am (Rohangabe) | 2026-08-30 | MCP-Register | 2026-08-31T01:17:02.104Z | selbstauskunft |  |
| Im Register geändert am (Rohangabe) | 2026-08-30 | MCP-Register | 2026-08-31T01:17:02.104Z | selbstauskunft |  |
| Schemafassung des Rohsatzes (Rohangabe) | https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Bereitstellungsform (Rohangabe) | paket | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Repository-Plattform (Rohangabe) | github | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Repository-Unterordner (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Paketbezeichner (Rohangabe) | nava-rebar | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Paketversionen (Rohangabe) | 0.13.1 | MCP-Register | 2026-08-31T01:17:02.104Z | selbstauskunft |  |
| Laufzeithinweise (Rohangabe) | uvx | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Formate der Umgebungsvariablen (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Beschreibungen der Umgebungsvariablen (Rohangabe) | REBAR_MCP_ALLOW_JIRA_SYNC=Set to 1 to allow the live (mutating) Jira reconcile mode; otherwise reconcile is dry-run only. · REBAR_MCP_ALLOW_LLM=Set to 1 to enable the billable LLM tools (review_code / scan_spec / verify_completion / review_plan); off by default. · REBAR_MCP_ALLOW_UNAUTHENTICATED_HTTP=Set to 1 to acknowledge running the Streamable-HTTP transport without a token verifier; required to boot the HTTP transport while auth is off. · REBAR_MCP_AUTH_CUSTOM_IMPORT=The `custom` strategy's `module:factory` import string, resolving to a factory that returns a TokenVerifier; a TRUSTED operator config value that loads and executes the operator-configured code at startup (fail-closed on any load error). · REBAR_MCP_AUTH_ENABLED=Set to 1 to enable MCP authentication (the composite token verifier + Resource-Server wiring); off by default. · REBAR_MCP_AUTH_INTROSPECTION_ALLOW_MISSING_AUD=Set to 1 to accept an active introspection response that OMITS `aud` (many AS do); off by default (fail-closed reject). · REBAR_MCP_AUTH_INTROSPECTION_ALLOW_PRIVATE_HOST=Set to 1 to permit a private/link-local/loopback introspection endpoint host (SSRF guard is on by default); off by default. · REBAR_MCP_AUTH_INTROSPECTION_CLIENT_ID=The client id the `introspection` verifier presents to the Authorization Server via HTTP Basic (client_secret_basic). · REBAR_MCP_AUTH_INTROSPECTION_CLIENT_SECRET_ENV=The NAME of the env var holding the introspection client secret (never the secret itself); must be present + non-empty at startup or the server refuses to start (fail-closed). · REBAR_MCP_AUTH_INTROSPECTION_ENDPOINT=The `introspection` verifier's RFC 7662 endpoint URL (must be https://); the opaque token is POSTed here on every request (no caching). · REBAR_MCP_AUTH_ISSUER_URL=OAuth authorization-server issuer URL advertised in the Protected-Resource Metadata (RFC 9728) when auth is enabled. · REBAR_MCP_AUTH_JWT_ALGORITHMS=Comma-separated PINNED, asymmetric-only JWS algorithms for the `jwt` verifier (default RS256,ES256); a symmetric algorithm on a JWKS source is refused. · REBAR_MCP_AUTH_JWT_ALLOW_PRIVATE_JWKS_HOST=Set to 1 to permit a private/link-local/loopback JWKS host (SSRF guard is on by default); off by default. · REBAR_MCP_AUTH_JWT_EXPECTED_TYP=When set, the `jwt` verifier requires the JWT header `typ` to equal this (e.g. at+JWT per RFC 9068); unset skips the check. · REBAR_MCP_AUTH_JWT_ISSUER=Expected `iss` claim for the `jwt` verifier; falls back to REBAR_MCP_AUTH_ISSUER_URL when unset. · REBAR_MCP_AUTH_JWT_JWKS_REFETCH_COOLDOWN=Minimum seconds between JWKS refetches triggered by an unknown key id (the concurrency-safe flood guard; default 30). · REBAR_MCP_AUTH_JWT_JWKS_TIMEOUT=HTTP timeout in seconds for the `jwt` verifier's JWKS fetch (default 10). · REBAR_MCP_AUTH_JWT_JWKS_URI=HTTPS JWKS endpoint the `jwt` verifier fetches signing keys from (an OIDC provider's .well-known/jwks.json). · REBAR_MCP_AUTH_JWT_LEEWAY=Clock-skew leeway in seconds applied to exp/nbf validation by the `jwt` verifier (default 60). · REBAR_MCP_AUTH_PROXY_IDENTITY_HEADER=The header carrying the proxy-authenticated principal identity, trusted only when the secret header validates (default x-forwarded-user). · REBAR_MCP_AUTH_PROXY_SCOPES=Comma-separated fixed scope set granted to proxy-authenticated principals; empty by default (the principal holds no scopes). · REBAR_MCP_AUTH_PROXY_SECRET_ENV=The NAME of the env var holding the trusted-proxy shared secret (never the secret itself); must be present + non-empty at startup or the `proxy` verifier refuses to start (fail-closed). · REBAR_MCP_AUTH_PROXY_SECRET_HEADER=The header the fronting proxy sends its shared secret on; the identity is trusted only when this matches (constant-time; default x-proxy-auth). · REBAR_MCP_AUTH_REQUIRED_SCOPES=Comma-separated scopes a caller must hold; the SDK returns 403 insufficient_scope when a principal lacks one. · REBAR_MCP_AUTH_RESOURCE_SERVER_URL=The single resource identifier (RFC 8707 audience) for this server; the composite verifier re-checks every accepted token against it. · REBAR_MCP_AUTH_STATIC_TOKENS_FILE=Path to the JSON secrets file for the static-bearer verifier (stores only SHA-256 digests of the accepted tokens). · REBAR_MCP_AUTH_STRATEGIES=Comma-separated, ordered list of token-verifier strategies to compose (closed set: static, jwt, introspection, proxy, custom). · REBAR_MCP_HTTP_ALLOWED_HOSTS=Comma-separated allowlist of exact host:port values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback. · REBAR_MCP_HTTP_ALLOWED_ORIGINS=Comma-separated allowlist of exact Origin values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback. · REBAR_MCP_HTTP_HOST=Bind host for the Streamable-HTTP transport (default 127.0.0.1). · REBAR_MCP_HTTP_PATH=URL path the Streamable-HTTP transport serves on (default /mcp). · REBAR_MCP_HTTP_PORT=Bind port for the Streamable-HTTP transport (1-65535; default 8000). · REBAR_MCP_HTTP_TLS_AT_EDGE=Set to 1 to acknowledge TLS is terminated at the edge; required to bind the Streamable-HTTP transport to a non-loopback host. · REBAR_MCP_READONLY=Set to 1 to expose only the read tools (no write/mutation tools). · REBAR_MCP_TRANSPORT=Transport for the MCP server: 'stdio' (default) or 'http' (the optional Streamable-HTTP transport). · REBAR_ROOT=Path to the repo root that holds the .tickets-tracker store (defaults to the git toplevel of the working dir). | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Symbolformate (Rohangabe) |  | MCP-Register | 2026-08-16T01:17:01.420Z | selbstauskunft |  |
| Verbindungswege (Quellstruktur) | {"packages":[{"registryType":"pypi","identifier":"nava-rebar","version":"0.13.1","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"REBAR_ROOT","description":"Path to the repo root that holds the .tickets-tracker store (defaults to the git toplevel of the working dir).","required":false,"secret":false},{"name":"REBAR_MCP_READONLY","description":"Set to 1 to expose only the read tools (no write/mutation tools).","required":false,"secret":false},{"name":"REBAR_MCP_ALLOW_LLM","description":"Set to 1 to enable the billable LLM tools (review_code / scan_spec / verify_completion / review_plan); off by default.","required":false,"secret":false},{"name":"REBAR_MCP_ALLOW_JIRA_SYNC","description":"Set to 1 to allow the live (mutating) Jira reconcile mode; otherwise reconcile is dry-run only.","required":false,"secret":false},{"name":"REBAR_MCP_TRANSPORT","description":"Transport for the MCP server: 'stdio' (default) or 'http' (the optional Streamable-HTTP transport).","required":false,"secret":false},{"name":"REBAR_MCP_HTTP_HOST","description":"Bind host for the Streamable-HTTP transport (default 127.0.0.1).","required":false,"secret":false},{"name":"REBAR_MCP_HTTP_PORT","description":"Bind port for the Streamable-HTTP transport (1-65535; default 8000).","required":false,"secret":false},{"name":"REBAR_MCP_HTTP_PATH","description":"URL path the Streamable-HTTP transport serves on (default /mcp).","required":false,"secret":false},{"name":"REBAR_MCP_HTTP_ALLOWED_HOSTS","description":"Comma-separated allowlist of exact host:port values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback.","required":false,"secret":false},{"name":"REBAR_MCP_HTTP_ALLOWED_ORIGINS","description":"Comma-separated allowlist of exact Origin values accepted by the Streamable-HTTP DNS-rebinding protection; empty defaults to loopback.","required":false,"secret":false},{"name":"REBAR_MCP_HTTP_TLS_AT_EDGE","description":"Set to 1 to acknowledge TLS is terminated at the edge; required to bind the Streamable-HTTP transport to a non-loopback host.","required":false,"secret":false},{"name":"REBAR_MCP_ALLOW_UNAUTHENTICATED_HTTP","description":"Set to 1 to acknowledge running the Streamable-HTTP transport without a token verifier; required to boot the HTTP transport while auth is off.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_ENABLED","description":"Set to 1 to enable MCP authentication (the composite token verifier + Resource-Server wiring); off by default.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_STRATEGIES","description":"Comma-separated, ordered list of token-verifier strategies to compose (closed set: static, jwt, introspection, proxy, custom).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_ISSUER_URL","description":"OAuth authorization-server issuer URL advertised in the Protected-Resource Metadata (RFC 9728) when auth is enabled.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_RESOURCE_SERVER_URL","description":"The single resource identifier (RFC 8707 audience) for this server; the composite verifier re-checks every accepted token against it.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_REQUIRED_SCOPES","description":"Comma-separated scopes a caller must hold; the SDK returns 403 insufficient_scope when a principal lacks one.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_STATIC_TOKENS_FILE","description":"Path to the JSON secrets file for the static-bearer verifier (stores only SHA-256 digests of the accepted tokens).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_JWKS_URI","description":"HTTPS JWKS endpoint the `jwt` verifier fetches signing keys from (an OIDC provider's .well-known/jwks.json).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_ISSUER","description":"Expected `iss` claim for the `jwt` verifier; falls back to REBAR_MCP_AUTH_ISSUER_URL when unset.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_ALGORITHMS","description":"Comma-separated PINNED, asymmetric-only JWS algorithms for the `jwt` verifier (default RS256,ES256); a symmetric algorithm on a JWKS source is refused.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_LEEWAY","description":"Clock-skew leeway in seconds applied to exp/nbf validation by the `jwt` verifier (default 60).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_JWKS_REFETCH_COOLDOWN","description":"Minimum seconds between JWKS refetches triggered by an unknown key id (the concurrency-safe flood guard; default 30).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_JWKS_TIMEOUT","description":"HTTP timeout in seconds for the `jwt` verifier's JWKS fetch (default 10).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_EXPECTED_TYP","description":"When set, the `jwt` verifier requires the JWT header `typ` to equal this (e.g. at+JWT per RFC 9068); unset skips the check.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_JWT_ALLOW_PRIVATE_JWKS_HOST","description":"Set to 1 to permit a private/link-local/loopback JWKS host (SSRF guard is on by default); off by default.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_INTROSPECTION_ENDPOINT","description":"The `introspection` verifier's RFC 7662 endpoint URL (must be https://); the opaque token is POSTed here on every request (no caching).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_INTROSPECTION_CLIENT_ID","description":"The client id the `introspection` verifier presents to the Authorization Server via HTTP Basic (client_secret_basic).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_INTROSPECTION_CLIENT_SECRET_ENV","description":"The NAME of the env var holding the introspection client secret (never the secret itself); must be present + non-empty at startup or the server refuses to start (fail-closed).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_INTROSPECTION_ALLOW_PRIVATE_HOST","description":"Set to 1 to permit a private/link-local/loopback introspection endpoint host (SSRF guard is on by default); off by default.","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_INTROSPECTION_ALLOW_MISSING_AUD","description":"Set to 1 to accept an active introspection response that OMITS `aud` (many AS do); off by default (fail-closed reject).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_PROXY_SECRET_ENV","description":"The NAME of the env var holding the trusted-proxy shared secret (never the secret itself); must be present + non-empty at startup or the `proxy` verifier refuses to start (fail-closed).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_PROXY_SECRET_HEADER","description":"The header the fronting proxy sends its shared secret on; the identity is trusted only when this matches (constant-time; default x-proxy-auth).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_PROXY_IDENTITY_HEADER","description":"The header carrying the proxy-authenticated principal identity, trusted only when the secret header validates (default x-forwarded-user).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_PROXY_SCOPES","description":"Comma-separated fixed scope set granted to proxy-authenticated principals; empty by default (the principal holds no scopes).","required":false,"secret":false},{"name":"REBAR_MCP_AUTH_CUSTOM_IMPORT","description":"The `custom` strategy's `module:factory` import string, resolving to a factory that returns a TokenVerifier; a TRUSTED operator config value that loads and executes the operator-configured code at startup (fail-closed on any load error).","required":false,"secret":false}],"additional_arguments_declared":false}],"remotes":[]} | MCP-Register | 2026-09-08T01:17:01.649Z | selbstauskunft |  |

## Verweise

- Namensraum: [[namensraum/io-github-navapbc|io.github.navapbc]]

---

- Registerseite: <https://tracevero.de/mcp/io-github-navapbc-rebar>
- Abgerufen am: 2026-10-10