# NVD API key — get one free at https://nvd.nist.gov/developers/request-an-api-key
# Without a key: 5 req/30s. With key: 50 req/30s.
NVD_API_KEY=

# GitHub personal access token — increases advisory API rate limit from 60/hr to 5000/hr
# Create at https://github.com/settings/tokens (no scopes needed for public data)
GITHUB_TOKEN=

# VulnCheck community API key — free tier at https://vulncheck.com
VULNCHECK_TOKEN=

# Cache DB path (defaults to ~/.cve-mcp/cache.db if unset)
CACHE_DB_PATH=

# Audit log path (defaults to ~/.cve-mcp/audit.log if unset)
# Rotates at 50MB, keeps 5 backups (250MB max)
AUDIT_LOG_PATH=

# HTTP request timeout in seconds for all API calls (default: 30)
REQUEST_TIMEOUT=30

# Number of retries on transient network errors (default: 3)
# Backoff delays: 6s, 12s, 24s
MAX_RETRIES=3

# ── Threat Intelligence API Keys ────────────────────────────────────────────

# AbuseIPDB API key — check IP reputation, abuse reports
# Free tier: 1000 checks/day. Get one at https://www.abuseipdb.com/account/api
ABUSEIPDB_KEY=

# VirusTotal API key — file hash lookups, malware detection stats
# Free tier: 4 lookups/min, 500/day. Get one at https://www.virustotal.com/gui/join-us
VIRUSTOTAL_KEY=

# URLScan.io API key — URL/domain safety checks (optional, works without key)
# Free tier: 100 scans/day. Get one at https://urlscan.io/user/signup
URLSCAN_KEY=

# Shodan API key — host intelligence, open ports, services
# Free tier: limited lookups. Get one at https://account.shodan.io/register
SHODAN_KEY=

# GreyNoise API key — check IP reputation, internet scanner detection
# Free tier available. Get one at https://www.greynoise.io/plans/community
# Required: /v3/community endpoint was deprecated Jan 2026; now uses /v3/ip/{ip}
GREYNOISE_API_KEY=

# CIRCL Passive DNS credentials — requires registration at circl.lu
# Contact https://www.circl.lu/contact/ for access
CIRCL_PDNS_USER=
CIRCL_PDNS_PASS=