Settings

Set them when you add the server, for example claude mcp add -s user bopbop -e BBM_GUARD=shop-social -- npx -y bopbop, or under "env" in a JSON config.

Setting	Effect
`BBM_GUARD=shop-social`	Blocks Buy now, Place order, checkout pages and Post buttons (step checks, in-page guard, browser-level blocking). Under the guard, JavaScript clicks through `eval` are blocked too.
`BBM_ALLOW=http://127.0.0.1:,.example.com`	Origin allowlist. Fails closed. Enforced in the browser (documents, frames, redirects, popups).
`BBM_UPLOAD_ROOTS=/path/a,/path/b`	Upload files only from these folders (default `~/Downloads`, `$TMPDIR/bbm-uploads`). Hidden files are refused.
`BBM_OUTPUT_DIR=/path`	Where HAR files go (default `~/Downloads/bbm`). The agent gives only a file name.
`BBM_SHOW_COOKIES=1`	Show cookie and credential header values in full (default: shortened).
`BBM_WINDOW=agent`	Extension mode: agent tabs in their own unfocused window.
`BBM_KEEP_TABS=1`	Extension mode: keep the agent’s tabs open when the session ends.
`BBM_FRONT=1`	Extension mode: bring agent tabs to the front (old behavior).
`BBM_TRACE=1`	Timing traces on stderr.
`BBM_MODE=connect` + `BBM_CDP_URL=http://127.0.0.1:9222`	Use a browser that you started with remote debugging, not the extension.