# -----------------------------------------------------------------

# Environment

# -----------------------------------------------------------------

# Environment: "development", "production", or "testing"

NODE_ENV=development

# -----------------------------------------------------------------

# MCP Server Configuration

# -----------------------------------------------------------------

# Transport type: "stdio" or "http"

MCP_TRANSPORT_TYPE=http

# Session mode: "stateless", "stateful", or "auto" (only used if MCP_TRANSPORT_TYPE=http)

MCP_SESSION_MODE=auto

# Response verbosity: "minimal", "standard", or "full"

# MCP_RESPONSE_VERBOSITY=standard

# Log level: "debug", "info", "notice", "warning", "error", "crit", "alert", "emerg"

MCP_LOG_LEVEL=debug

# Directory for log files

LOGS_DIR=logs/

# -----------------------------------------------------------------

# HTTP Transport Configuration (only used if MCP_TRANSPORT_TYPE=http)

# -----------------------------------------------------------------

MCP_HTTP_HOST=127.0.0.1

MCP_HTTP_PORT=3010

# Max request body size in bytes for the MCP endpoint. Oversized requests are

# rejected with 413 before the per-request server/transport are allocated.

# Default 1 MiB; raise for large tool inputs (base64 media, documents).

# Set 0 to disable and defer body limits to the runtime/reverse proxy.

# MCP_HTTP_MAX_BODY_BYTES=1048576

# Public-facing URL when running behind a TLS-terminating reverse proxy

# (Cloudflare Tunnel, Caddy, nginx, ALB). When set, the landing page

# connect snippets, SEP-1649 Server Card `endpoints.streamable_http`,

# and RFC 9728 `resource` fallback use this origin instead of the

# inbound request URL. Leave unset for direct (non-proxied) deployments.

# MCP_PUBLIC_URL=https://mcp.example.com

# Comma-separated list of allowed origins for CORS

MCP_ALLOWED_ORIGINS=http://localhost:8080

# Interval in ms for an opt-in forced-GC loop (Bun runtime only — ignored

# on Node/Workers). Mitigates the issue #50 scenario where per-request

# McpServer/McpSessionTransport pairs sit reachable in old-gen under

# sustained moderate HTTP load until a major collection fires. Cheap

# (~50 ms reclaims dozens of pairs) and benign when unset.

# Recommended starting point for HTTP deployments showing heap growth: 60000.

# MCP_GC_PRESSURE_INTERVAL_MS=0

# -----------------------------------------------------------------

# Authentication Configuration

# -----------------------------------------------------------------

# Authentication mode: "none", "jwt", or "oauth"

MCP_AUTH_MODE=none

# --- JWT Auth (required when MCP_AUTH_MODE=jwt) ---

# Secret key for signing JWTs (must be at least 32 characters long)

# MCP_AUTH_SECRET_KEY=your-super-secret-key-that-is-at-least-32-characters-long

# Set to "true" to bypass JWT auth in development (not allowed in production)

# DEV_MCP_AUTH_BYPASS=false

# --- OAuth Auth (required when MCP_AUTH_MODE=oauth) ---

# OAUTH_ISSUER_URL=https://your-idp.example.com

# OAUTH_AUDIENCE=your-api-audience

# OAUTH_JWKS_URI=https://your-idp.example.com/.well-known/jwks.json

# --- Scope enforcement (jwt or oauth modes) ---

# Granted scopes are unioned from `scp`, `scope`, and `mcp_tool_scopes` JWT claims.

# `mcp_tool_scopes` (string or array) is the supported escape hatch for OIDC providers

# (Authentik, Keycloak <26.5, Zitadel) that ignore property mappings overriding `scope`

# in the authorization_code flow.

#

# When set to "true", bypasses both `withRequiredScopes` (declared `auth: [...]`) and

# `checkScopes` (runtime-computed scopes inside handlers, including tenant isolation).

# Token signature, audience, issuer, and expiry validation remain intact. Combine with

# server-side ACLs — without an in-handler ACL, every authenticated user gets every tool.

# MCP_AUTH_DISABLE_SCOPE_CHECKS=false

# -----------------------------------------------------------------

# Storage Configuration

# -----------------------------------------------------------------

# Storage backend: "in-memory", "filesystem", "supabase", "cloudflare-r2", "cloudflare-kv", "cloudflare-d1"

STORAGE_PROVIDER_TYPE="filesystem"

# Path for the filesystem storage provider (required if STORAGE_PROVIDER_TYPE=filesystem)

STORAGE_FILESYSTEM_PATH="./.storage"

# -----------------------------------------------------------------

# Database Configuration (required if STORAGE_PROVIDER_TYPE=supabase)

# -----------------------------------------------------------------

# SUPABASE_URL=

# SUPABASE_ANON_KEY=

# SUPABASE_SERVICE_ROLE_KEY=

# -----------------------------------------------------------------

# LLM Provider Configuration (optional)

# -----------------------------------------------------------------

# API key for OpenRouter

OPENROUTER_API_KEY=

# Default LLM model to use

LLM_DEFAULT_MODEL="google/gemini-2.5-flash-preview-05-20"

# Default temperature for LLM responses

LLM_DEFAULT_TEMPERATURE=0.7

# -----------------------------------------------------------------

# OpenTelemetry Configuration (optional)

# -----------------------------------------------------------------

# Set to "true" to enable OpenTelemetry tracing and metrics

# OTEL_ENABLED=false

# OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://localhost:4318/v1/traces

# OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=http://localhost:4318/v1/metrics