Is Janbrennenstuhl free?

Yes, Janbrennenstuhl is free to use.

How do I install Janbrennenstuhl?

Janbrennenstuhl is a remote plugin. You do not need to install anything locally. Add the server URL to your AI app's MCP configuration and you are ready to go.

Is Janbrennenstuhl safe to use?

Yes. Janbrennenstuhl passed MCP Marketplace's automated security scan with a score of 10/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What AI apps work with Janbrennenstuhl?

Janbrennenstuhl uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Janbrennenstuhl MCP Server

by Jbspeakr

Developer ToolsLow Risk10.0MCP RegistryRemote

Free

Server data from the Official MCP Registry

Search, read and cite Jan Brennenstuhl's essays on AppSec, identity and agent identity.

About

Search, read and cite Jan Brennenstuhl's essays on AppSec, identity and agent identity.

Remote endpoints: streamable-http: https://mcp.janbrennenstuhl.eu/mcp

Security Report

10.0

Low Risk10.0Low Risk

Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.

4 tools verified · Open access · No issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Found in Source Code

Found by scanning the linked source code. This listing connects to a hosted endpoint, so none of this runs on your machine: it describes what the server software does where it is hosted.

file_system

Applies to the server that hosts this plugin, not to your machine.

env_vars

Applies to the server that hosts this plugin, not to your machine.

HTTP Network Access

Connects to external APIs or services over the internet.

How to Connect

Remote Plugin

No local installation needed. Your AI client connects to the remote endpoint directly.

Add this to your MCP configuration to connect:

{
  "mcpServers": {
    "eu-janbrennenstuhl-site": {
      "url": "https://mcp.janbrennenstuhl.eu/mcp"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Brennenstuhl on Security

The source of janbrennenstuhl.eu: essays, a field guide and research notes on application security, identity, passwords, tokens and agent identity, by Jan Brennenstuhl.

The site is a static publication for two audiences: people who read it in a browser, and agents that search, cite and quote it. Every page has a Markdown twin, every key finding has a stable anchor, and the whole thing ships without a framework.

Built with Hugo extended, owned templates, no theme
Hosted on Bunny in the EU, released from main by GitHub Actions
Budgets: at most 15 kB of CSS and 8 kB of JavaScript per article, no third-party requests except privacy-friendly analytics
Usable without JavaScript, in both themes, down to 320 px

Quick start

Hugo extended at the version in .hugo-version is the only build dependency, except for the social cards: CI draws each article's card plate with Chromium first (scripts/card-plates.sh), and local builds fall back to the topic plate. The release scripts and checks use the Python 3.11+ standard library.

./scripts/bootstrap.sh     # install or check the pinned Hugo
./scripts/verify.sh        # build public/ and run every static release gate
python3 scripts/serve.py   # http://127.0.0.1:8000, with real 404s and Markdown negotiation

hugo server is fine for template work.

Browser, Lighthouse and edge-script checks need Node and are for QA only:

npm ci
npx playwright install chromium
npm run test:browser       # axe, keyboard, no-JS, reflow, explainers, redirects
npm run test:lighthouse    # lab gate on three routes
npm run test:edge          # MCP server and Markdown negotiation

Repository layout

Path	What it holds
`content/`	The writing: essays (`post/`), the field guide (`knowledge-base/`), talks, projects and pages, as Markdown page bundles
`layouts/`	Owned Hugo templates, shortcodes and their Markdown variants, the trust-boundary diagrams
`assets/`	CSS tokens and themes, small JavaScript modules, icons, social-card plates
`data/`	Topics, series, glossary and redirects
`edge/`	Edge rules (headers, CSP, caching) and Bunny Edge Scripts for Markdown negotiation and the MCP server
`scripts/`	Build, release gates, deploy, link checks (Python standard library)
`tests/`	Browser, Lighthouse and edge tests, plus the baseline of every original route
`docs/`	How the site works and why (see below)

For agents

Search, retrieval and training are welcome under CC BY 4.0. Attribution is the condition. The policy is at /agents/.

/llms.txt and /llms-full.txt
/capabilities.txt and /.well-known/capabilities.json
A Markdown twin of every page at <url>index.md, or with Accept: text/markdown
/catalog.json, /findings.json and /feed.json
/.well-known/api-catalog (RFC 9727)
A read-only MCP server in edge/mcp/, with an MCP Registry entry as eu.janbrennenstuhl/site

Documentation

Content contract: front matter, field-guide shape, shortcodes, machine outputs
Design system: tokens, contrast, type, the diagram, budgets
Delivery: CI, Bunny configuration, CSP, redirects, MCP, rollback
Decisions: settled questions, such as licence and training, and analytics
Implementation notes: what changed and what is still open
AGENTS.md: the working guide for coding agents in this repository

Corrections

This is a personal publication, so the repository does not take issues or pull requests. Corrections are still welcome: for a factual error, a broken link or an accessibility problem, use the contact details in the imprint, which every article links as "Send a correction". Security reports follow /.well-known/security.txt.

Licenses

This repository holds two kinds of work under two licenses.

What	License
Writing: everything under `content/`, and the prose in `data/` (topic, series and glossary descriptions)	CC BY 4.0, including AI training, unless a page says otherwise
Code: templates, CSS, JavaScript, scripts, edge scripts, tests, configuration and documentation	MIT

The CC BY grant does not cover:

Pages marked license: false in their front matter: the imprint, the privacy policy, the affiliate disclaimer and the about page.
Credited third-party images and quotations in the writing. They keep their own rights.
Portraits of Jan Brennenstuhl, and the Bunny logo in static/images/, a trademark of its owner.

Bundled third-party work:

Geist and Geist Mono fonts, © Vercel, under the SIL Open Font License 1.1 (static/fonts/OFL.txt, assets/fonts/OFL-Geist.txt).
Icons in assets/icons/ from Tabler Icons, © Paweł Kuna, under the MIT License.
Hugo, downloaded at build time, is under the Apache License 2.0.

To reuse an article, name the author, link the canonical URL and say if you changed it. For example: "Title" by Jan Brennenstuhl, https://www.janbrennenstuhl.eu/…, CC BY 4.0.

Reviews

No reviews yet

Be the first to review this server!

4.8

Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.