Skip to content

Environment variable descriptions (raw)

7,577 distinct values, measured against 42,703 published entries.

Value Entries Share
MASV_ALLOW_DELETE=Set to true to enable delete operations for packages and portals · MASV_API_KEY=Your MASV API key for authentication · MASV_TEAM_ID=Your MASV team identifier 1 0.0 %
MATCHAWARDS_API_BASE=Base URL of the MatchAwards API. Leave unset to use https://matchawards.com; set only for development. 1 0.0 %
MATCHCV_BASE_URL=Override MatchCV API origin. Defaults to https://matchcv.co. 1 0.0 %
MATERA_BASE_URL=API base URL. Defaults to https://api.matera.com (production) · MATERA_CLIENT_ID=OAuth2 client_id issued by Matera · MATERA_CLIENT_SECRET=OAuth2 client_secret issued by Matera 1 0.0 %
MATHLAS_INDEX=Path to a prebuilt index .npz to serve for search_existing_math (optional; the seed corpus is used when absent). · MATHLAS_SEED=Set to 1 to force the lightweight built-in seed corpus and never load the multi-GB prebuilt index (fast cold start). 1 0.0 %
MATIH_MCP_TOKEN=Matih developer token (mat_agt_…), minted in Settings → Developer Tokens. Bearer credential, scoped to your connections + tools. 1 0.0 %
MATOMO_DEFAULT_SITE_ID=Optional default site ID so tools don't require an explicit site_id · MATOMO_TOKEN=Matomo API token (token_auth) with view access · MATOMO_URL=Matomo instance URL, e.g. https://matomo.example.com 1 0.0 %
MATPLOTLIBNET_FONTS=Font files (.ttf, .otf) and directories of them, separated by ';', registered at startup so a chart can use a script the bundled font lacks (Devanagari, Thai, Chinese). Arabic and Hebrew work without it. · MATPLOTLIBNET_MCP_OUTPUT_ROOT=The only directory save_chart may write under. Defaults to the system temp directory. 1 0.0 %
MATRICULA_CACHE_DIR=Directory for the on-disk response cache. · MATRICULA_CONTACT=An email address or URL appended to the User-Agent, so ICARUS can reach whoever runs the server. · MATRICULA_DOWNLOAD_DIR=An existing folder. When set, matricula_page_image saves only inside it; needed to save under ~/Library, such as an iCloud Drive folder. · MATRICULA_IMAGE_ACCESS=Leave unset: page images are not fetched. Set to 'granted' only once ICARUS has granted this client access to its image host; needs MATRICULA_CONTACT. · MATRICULA_MIN_INTERVAL=Least seconds between two requests to Matricula. Never below 2. · MATRICULA_SEARCH_INTERVAL=Least seconds between two place searches. Never below 10. · MATRICULA_TIMEOUT=HTTP timeout in seconds for one request. Image downloads get 120 s to read. 1 0.0 %
MAVEN_AUTO_DOWNLOAD=Whether to automatically download missing artifacts from remote repositories. Defaults to true. · MAVEN_DECODER_CACHE_DIR=Override directory used for decompilation and metadata caches. · MAVEN_OFFLINE=Set to true to disable all network access and use only the local repository. · MAVEN_REMOTE_PASSWORD=Password or token for authenticating against private remote Maven repositories. · MAVEN_REMOTE_REPOS=Comma or whitespace separated list of remote Maven repository base URLs. · MAVEN_REMOTE_USERNAME=Username for authenticating against private remote Maven repositories. · MAVEN_REPOSITORY=Path to the local Maven repository. Defaults to ~/.m2/repository. 1 0.0 %
MAXIMO_API_KEY=API Key for Maximo authentication · MAXIMO_HOST=Base Host URL for the Maximo instance · MAXIMO_URL=Base URL for the Maximo REST API (e.g., https://your-host/maximo/api) 1 0.0 %
MAXIO_API_KEY=Single-secret Maxio credential, sent as the HTTP Basic username with the constant 'x' as the password. Use this or the MAXIO_USERNAME + MAXIO_PASSWORD pair. · MAXIO_BASE_URL=Full API base URL. Leave blank: the CLI builds it from MAXIO_SITE. Set it only to point at a different host. · MAXIO_PASSWORD=Set the MAXIO_PASSWORD credential for the Maxio MCP server. · MAXIO_SITE=Set the MAXIO_SITE credential for the Maxio MCP server. · MAXIO_USERNAME=Set the MAXIO_USERNAME credential for the Maxio MCP server. 1 0.0 %
MAXPREPS_CACHE_TTL=Seconds to cache a page response. Default 300; 0 disables caching. · MAXPREPS_MIN_INTERVAL_MS=Minimum spacing between requests, in ms. Default 250. · MAXPREPS_USER_AGENT=Optional override for the User-Agent sent to MaxPreps. 1 0.0 %
MAXWELL_DAILY_BUDGET_USD=Daily spend cap in USD (default 2) · MAXWELL_MAX_PER_CALL_USD=Per-call cap; above it the user is asked (default 0.05) · MAXWELL_SOLANA_KEY_FILE=File with a Solana secret key for paying in USDC on Solana · MAXWELL_WALLET_KEY_FILE=File with a Base (EVM) private key for paying; without a wallet, paid tools only quote 1 0.0 %
MAX_AUTO_PAY_SATS=Maximum sats to auto-pay per request · NWC_URI=Nostr Wallet Connect URI for autonomous Lightning payments 1 0.0 %
MAX_BURN_USD=Max USD value of $THREE a single three_burn call may destroy. · REQUIRE_CONFIRM=When on (default), three_burn refuses until re-issued with confirm:true. Set 0/false to disable the gate. · SOLANA_RPC_URL=Solana mainnet RPC endpoint. Defaults to the public cluster — bring your own (Helius / Quicknode / Triton) for production traffic. · SOLANA_SECRET_KEY=Base58 Solana secret key that signs burns (the wallet that holds the $THREE). Not needed for the read-only tools (three_price, three_balance). Treat like cash. · THREE_WS_BASE=Base URL of the three.ws token API (serves /api/token/config and /api/token/price). Override only when self-hosting. 1 0.0 %
MAX_ETH_PER_SESSION=Server-enforced cumulative session spend cap in ETH (default 2). · MAX_ETH_PER_TX=Server-enforced cap per trade in ETH (default 0.5). · MAX_TX_PER_MINUTE=Server-enforced rate limit on state-changing calls (default 12). · PRIVATE_KEY=Optional trading key — without it the server is READ-ONLY (scan/vet/info only). Signs locally; never leaves your machine. · RPC_URL=Override the chain RPC (defaults to Robinhood Chain mainnet; pair with CHAIN_ID and the *_ADDRESS vars for forks/testnets). 1 0.0 %
MAX_PAYMENT_USDC=Client-side per-call spend ceiling in USDC (default 0.10). The signer refuses to auto-pay a 402 whose amount exceeds this — protects the wallet from a hostile endpoint. · SERVER_URL=true402 API base (default https://true402.dev/api). Must be https (or localhost) — the signer refuses to send a payment over cleartext. · WALLET_PRIVATE_KEY=Funded Base wallet private key for x402 payment signing (optional; without it, paid tools return the 402 requirements). 1 0.0 %
MAX_PAY_USD=Max USD a single pay_and_call may spend. Bounds a runaway or injected payment. · REQUIRE_CONFIRM=When on (default), pay_and_call refuses until re-issued with confirm:true. Set 0/false to disable the gate. · SOLANA_RPC_URL=Solana mainnet RPC endpoint. Defaults to the public cluster — bring your own (Helius / Quicknode / Triton) for production traffic. · SOLANA_SECRET_KEY=Base58 (or JSON byte-array) Solana secret key that signs payments and holds the USDC. Not needed for the read tools (find_services, inspect_endpoint, or x402_wallet with an explicit address). Treat like cash. · THREE_WS_BASE=Base URL of the three.ws API that serves /api/bazaar/search for find_services. Override only when self-hosting. 1 0.0 %
MAX_PRICE_USDC=Per-call price ceiling in USDC (default 0.05). · X402_PRIVATE_KEY=Private key of the paying wallet (USDC on Base mainnet). Signs x402 payment authorizations locally. 1 0.0 %
MAX_PRICE_USD_PER_CALL=Most this server will pay for a single lookup. Defaults to 0.01, the advertised price. A 402 asking for more than this is refused rather than paid. · PRIVATE_KEY=Private key of a Base mainnet wallet holding a little USDC. No ETH needed: x402 payments are settled by a facilitator, so the wallet signs off-chain and pays no gas. Use PRIVATE_KEY_FILE instead to keep the key out of your client config. · PRIVATE_KEY_FILE=Path to a file containing the wallet private key. Preferred over PRIVATE_KEY. Set exactly one of the two. · REQUEST_TIMEOUT_MS=How long to wait for the API, in milliseconds. 1000 to 300000, default 45000. · SPEND_CAP_USD=Total USD this server may spend from your wallet before it stops. Required: the server refuses to start without it. About 100 lookups per dollar. 1 0.0 %
MAX_SOL_PER_TX=Per-transaction spend cap in SOL for native SOL transfers via send_transfer. Bounds the blast radius of a leaked key or an injected argument. · RECIPIENT_ALLOWLIST=Optional comma-separated base58 pubkeys. When set, send_transfer refuses any recipient not in the list. · REQUIRE_CONFIRM=When on (default), send_transfer refuses until re-issued with confirm:true. Set 0/false to disable the gate. · SOLANA_RPC_URL=Solana mainnet RPC endpoint used by get_wallet_balances and send_transfer. Defaults to https://api.mainnet-beta.solana.com — bring your own (Helius / Quicknode / Triton) for production traffic. · SOLANA_SECRET_KEY=Base58-encoded Solana secret key for the wallet that send_transfer signs from. REQUIRED for send_transfer (the only write tool); a per-call `secret` arg overrides it. Not needed for any read tool. Treat like cash. · THREE_WS_BASE=Base URL of the three.ws API that serves the portfolio + trades endpoints. Override only when self-hosting or targeting a preview deployment. · THREE_WS_SESSION=Your three.ws session token (the value of the `__Host-sid` cookie from a signed-in browser). Required for the account-scoped reads — get_portfolio_summary, get_portfolio_history, get_portfolio_asset — which return data for the agents YOU own. The public trade feed and on-chain balance reads do not need it. Treat like a password. · THREE_WS_TIMEOUT_MS=Per-request timeout in milliseconds for the live three.ws API reads. 1 0.0 %
MAX_SPENDING_USDC=Client-side spending cap per request in USDC (wallet mode). · TAG_PER_TRACK_API_KEY=Studio API key (tpt_live_...) generated on https://tag-per-track.cloud. Consumes prepaid credits, no crypto wallet needed. Takes priority over the wallet mode. · TAG_PER_TRACK_NO_PERSIST=Set to 1 or true to keep API-key analyses out of your dashboard history. · WALLET_PRIVATE_KEY=Private key of a dedicated Base burner wallet (66 hex chars starting with 0x) for USDC micro-payments via x402. Used only when no API key is set. 1 0.0 %
MAX_TOKEN=MAX bot token from dev.max.ru — passed as Authorization header WITHOUT 'Bearer' prefix (MAX API quirk: non-standard auth) 1 0.0 %
MAX_TRANSFER_AMOUNT=Optional max amount per transfer, in the source currency. · WISE_API_TOKEN=Wise personal API token (Wise → Settings → API tokens). Full access to prepare transfers, Read only for answers. · WRITES_ENABLED=Set to false for read-only. Writes are always two-step and transfers are paid by you in the Wise app. 1 0.0 %
MAX_USD_PER_CALL=Max USD per single call (default 0.05). · MAX_USD_TOTAL=Max USD per session (default 5). · WALLET_PRIVATE_KEY=Private key of a wallet holding USDC on Base. Stays on your machine. 1 0.0 %
MAX_USD_PER_CALL=Max USD per single call (default 0.05). · MAX_USD_TOTAL=Max USD per session (default 5). · WALLET_PRIVATE_KEY=Private key of a wallet holding USDC.e on Tempo. Stays on your machine. 1 0.0 %
MAX_USD_PER_CALL=Per-call spend cap in USD (default 0.10) · MAX_USD_PER_SESSION=Per-process spend cap in USD (default 1.00) · PRIVATE_KEY=Hex private key of the paying wallet (USDC on Base). Optional: the free who_terms tool works without it. 1 0.0 %
MBA_API_BASE=Override for self-hosted WooCommerce/Magento backends; defaults to the MBA hosted backend · MBA_API_KEY=Per-store MBA API key (mba_live_...), minted in the merchant admin · MBA_PLATFORM=Store platform (shopify, bigcommerce, woocommerce, magento, orocommerce); drives per-platform path mapping and tool gating 1 0.0 %
MB_API_KEY=API key for mercado-bitcoin 1 0.0 %
MCEPTION_DATA_DIR=Where audit reports and rug-pull baselines live. Defaults to ~/.mception. · MCEPTION_ENABLE_LLM_JUDGE=Set to 1 to enable advisory LLM-assisted classification via MCP sampling. No API key needed. · MCEPTION_INTROSPECT_TIMEOUT=Per-target timeout in seconds for the fetcher + engine pipeline. · MCEPTION_OFFLINE=Set to 1 to block outbound HTTP (OSV, registry signals, phantom-repo probes). 1 0.0 %
MCP-INDUSTRY-APPID=Industry app ID for authentication 1 0.0 %
MCPAMPEL_API_KEY=MCPAmpel API key (get one free at mcpampel.com) 1 0.0 %
MCPEMAILS_API_KEY=MCP Emails API key: 'mcpe_' followed by 64 hex characters. Create one at https://mcpemails.com/dashboard/keys 1 0.0 %
MCPIE_CONFIG=Optional path to the mcpie config TOML (defaults to ~/.config/mcpie/config.toml) 1 0.0 %
MCPSENTINEL_ALLOWED_HOSTS=Comma-separated MCP server hostnames, optionally with an exact port, that the MCP-native scanner may connect to. · MCPSENTINEL_ALLOW_PRIVATE_HTTP_TARGETS=Set to true only to permit an explicitly allowlisted private or reserved HTTP address in a trusted local network. 1 0.0 %
MCPSKILLS_API_KEY=Optional Pro API key for higher rate limits and full reports. 1 0.0 %
MCPSPEND_API_KEY=Your MCPSpend API key. Create one at https://mcpspend.com/dashboard/keys. Starts with mcps_live_ or mcps_test_. Optional — the server boots and lists tools without it; only tool calls require auth. · MCPSPEND_ENDPOINT=Optional. Override the MCPSpend API endpoint. Defaults to https://api.mcpspend.com. Use only if you self-host MCPSpend. 1 0.0 %
MCP_1C_BASE=URL of the 1C HTTP service (with MCPService extension installed) · MCP_1C_PASSWORD=Password for the 1C user · MCP_1C_USER=1C user with API access · RCS_LICENSE_KEY=RCS license token (Solo free, Pro 9900 KZT/mo, Team 39900 KZT/mo) 1 0.0 %
MCP_AGENTS_LOG_DIR=Directory for the audit log (default: XDG state dir) 1 0.0 %
MCP_AI_BASE_URL=Full URL of the NV oOS MCP endpoint (https://<site>/wp-json/mcp-ai/v1/mcp) · MCP_AI_HTTP_TIMEOUT=Request timeout in milliseconds · MCP_AI_TOKEN=Credential (cred_*) or operator (op_*) token minted in Fleet Operator 1 0.0 %
MCP_ALLOWED_HOSTS=Comma-separated allow-list of hosts the bot may join. · MCP_DEFAULT_AUTH=Auth mode: offline or microsoft. · MCP_DEFAULT_HOST=Server to auto-connect on startup (optional). · MCP_DEFAULT_USERNAME=In-game name (offline) or account email (microsoft). · MCP_DISABLE_GROUPS=Comma-separated tool-group keys to disable. · MCP_READ_ONLY=Observe-only mode (no world-mutating tools). 1 0.0 %
MCP_ALLOWED_HOSTS=Comma-separated allowed Host headers. Empty = Host validation disabled (default). When set, requests with a Host outside the list are rejected. · MCP_ALLOWED_ORIGINS=Comma-separated allowed browser Origins (DNS-rebinding defense). Empty = reject any request carrying an Origin header; non-browser clients (CLI/SDK) send no Origin and are always allowed. Use '*' to allow all. · MCP_ALLOW_INSECURE_FILE_URL=Set to "true" to allow plain http:// fileUrl downloads in evidence_create (default https-only). Private/internal addresses are rejected regardless (resolution-time check; see the documented DNS TOCTOU limitation in the hosted-deployment runbook). · MCP_ALLOW_UNVERIFIED_BEARER=Escape hatch for MCP_HTTP_PUBLIC=true WITHOUT inbound-token introspection: set to "true" ONLY when an upstream gateway already verifies Bearer tokens. The server logs a prominent warning and forwards tokens upstream unverified. · MCP_API_BASE_URL=Gateway ROOT URL (e.g. https://api.int.gcloudfactory.com) — each manager's path prefix is appended automatically; do NOT include a manager path here · MCP_API_BASE_URL_CHAT=Full base URL override for the chat manager, used as-is (default: https://api.gcloudfactory.com/chat-bot-manager) · MCP_API_BASE_URL_EVIDENCE=Full base URL override for the evidence manager, used as-is (default: https://api.gcloudfactory.com/digital-trust) · MCP_API_BASE_URL_NOTIFICATION=Full base URL override for the notification manager, used as-is (default: https://api.gcloudfactory.com/notifications) · MCP_API_BASE_URL_SIGNATURE=Full base URL override for the signature manager, used as-is (default: https://api.gcloudfactory.com/signature-manager) · MCP_HTTP_HOST=Interface the HTTP transport binds to. Default 127.0.0.1 (localhost only). Set 0.0.0.0 to expose on all interfaces (containers do this automatically). · MCP_HTTP_MAX_BODY_BYTES=Maximum accepted POST /mcp request-body size in bytes (default 16777216 = 16 MiB — sized so base64 file uploads within the documented tool limits fit). Oversized requests get a 413 JSON-RPC error before/while reading — closes a memory-exhaustion DoS vector in public deployments. Note: base64 file sources are capped by this limit BEFORE MCP_FILE_MAX_BYTES applies. · MCP_HTTP_PUBLIC=Set to "true" for public/multi-tenant deployments. Activates Host validation and refuses to start unless (1) MCP_ALLOWED_ORIGINS or MCP_ALLOWED_HOSTS is set AND (2) inbound Bearer introspection is configured (MCP_SVC_INTROSPECT_URL + MCP_SVC_CLIENT_ID/SECRET) or MCP_ALLOW_UNVERIFIED_BEARER=true is set explicitly (fail-closed). · MCP_SVC_CLIENT_ID=OAuth2 client_credentials client ID. · MCP_SVC_CLIENT_SECRET=OAuth2 client_credentials client secret. (See https://digitaltrust.gcloudfactory.com for credential acquisition.) · MCP_SVC_INTROSPECT_URL=RFC 7662 token introspection URL for inbound Bearer verification in HTTP mode. Opt-in, and required when MCP_HTTP_PUBLIC=true. Leave empty for stdio (local) use. · MCP_SVC_SCOPE=Optional OAuth2 scope for the service-account token request. · MCP_SVC_TOKEN_URL=Token endpoint URL for the OAuth2 client_credentials flow. · PORT=HTTP port when running in hosted (HTTP) mode; ignored in stdio mode 1 0.0 %
MCP_ALLOWED_HOSTS=Comma-separated allowed Host headers. Empty = Host validation disabled (default). When set, requests with a Host outside the list are rejected. · MCP_ALLOWED_ORIGINS=Comma-separated allowed browser Origins (DNS-rebinding defense). Empty = reject any request carrying an Origin header; non-browser clients (CLI/SDK) send no Origin and are always allowed. Use '*' to allow all. · MCP_ALLOW_INSECURE_FILE_URL=Set to "true" to allow plain http:// fileUrl downloads in evidence_create (default https-only). Private/internal addresses are rejected regardless (resolution-time check; see the documented DNS TOCTOU limitation in the hosted-deployment runbook). · MCP_ALLOW_UNVERIFIED_BEARER=Escape hatch for MCP_HTTP_PUBLIC=true WITHOUT inbound-token introspection: set to "true" ONLY when an upstream gateway already verifies Bearer tokens. The server logs a prominent warning and forwards tokens upstream unverified. · MCP_API_BASE_URL=Upstream API root. Required: your user key is exchanged for a session token against this host, and the server will not start without it. · MCP_AUTH_USER_KEY=Long-lived EAD Enterprise Suite user key, exchanged automatically for a short-lived session token. Use it for headless or automated access instead of an account password. (See https://www.eadtrust.eu/soluciones-legaltech/enterprise-suite/ for credential acquisition.) · MCP_HTTP_HOST=Interface the HTTP transport binds to. Default 127.0.0.1 (localhost only). Set 0.0.0.0 to expose on all interfaces (containers do this automatically). · MCP_HTTP_MAX_BODY_BYTES=Maximum accepted POST /mcp request-body size in bytes (default 16777216 = 16 MiB — sized so base64 file uploads within the documented tool limits fit). Oversized requests get a 413 JSON-RPC error before/while reading — closes a memory-exhaustion DoS vector in public deployments. Note: base64 file sources are capped by this limit BEFORE MCP_FILE_MAX_BYTES applies. · MCP_HTTP_PUBLIC=Set to "true" for public/multi-tenant deployments. Activates Host validation and refuses to start unless (1) MCP_ALLOWED_ORIGINS or MCP_ALLOWED_HOSTS is set AND (2) inbound Bearer introspection is configured (MCP_SVC_INTROSPECT_URL + MCP_SVC_CLIENT_ID/SECRET) or MCP_ALLOW_UNVERIFIED_BEARER=true is set explicitly (fail-closed). · MCP_SVC_CLIENT_ID=Client ID this server presents to the introspection endpoint above (its resource-server credentials). Only needed alongside MCP_SVC_INTROSPECT_URL; it does not authenticate you to EAD Enterprise Suite. · MCP_SVC_CLIENT_SECRET=Client secret this server presents to the introspection endpoint above (its resource-server credentials). Only needed alongside MCP_SVC_INTROSPECT_URL; it does not authenticate you to EAD Enterprise Suite. (See https://www.eadtrust.eu/soluciones-legaltech/enterprise-suite/ for credential acquisition.) · MCP_SVC_INTROSPECT_URL=RFC 7662 token introspection URL for inbound Bearer verification in HTTP mode. Opt-in, and required when MCP_HTTP_PUBLIC=true. Leave empty for stdio (local) use. · PORT=HTTP port when running in hosted (HTTP) mode; ignored in stdio mode 1 0.0 %
MCP_ALLOWED_HOSTS=Comma-separated allowed Host headers. Empty = Host validation disabled (default). When set, requests with a Host outside the list are rejected. · MCP_ALLOWED_ORIGINS=Comma-separated allowed browser Origins (DNS-rebinding defense). Empty = reject any request carrying an Origin header; non-browser clients (CLI/SDK) send no Origin and are always allowed. Use '*' to allow all. · MCP_ALLOW_INSECURE_FILE_URL=Set to "true" to allow plain http:// fileUrl downloads in evidence_create (default https-only). Private/internal addresses are rejected regardless (resolution-time check; see the documented DNS TOCTOU limitation in the hosted-deployment runbook). · MCP_ALLOW_UNVERIFIED_BEARER=Escape hatch for MCP_HTTP_PUBLIC=true WITHOUT inbound-token introspection: set to "true" ONLY when an upstream gateway already verifies Bearer tokens. The server logs a prominent warning and forwards tokens upstream unverified. · MCP_API_BASE_URL=Upstream API root. Required: your user key is exchanged for a session token against this host, and the server will not start without it. · MCP_AUTH_USER_KEY=Long-lived GoCertius user key, exchanged automatically for a short-lived session token. Use it for headless or automated access instead of an account password. (See https://www.gocertius.io for credential acquisition.) · MCP_HTTP_HOST=Interface the HTTP transport binds to. Default 127.0.0.1 (localhost only). Set 0.0.0.0 to expose on all interfaces (containers do this automatically). · MCP_HTTP_MAX_BODY_BYTES=Maximum accepted POST /mcp request-body size in bytes (default 16777216 = 16 MiB — sized so base64 file uploads within the documented tool limits fit). Oversized requests get a 413 JSON-RPC error before/while reading — closes a memory-exhaustion DoS vector in public deployments. Note: base64 file sources are capped by this limit BEFORE MCP_FILE_MAX_BYTES applies. · MCP_HTTP_PUBLIC=Set to "true" for public/multi-tenant deployments. Activates Host validation and refuses to start unless (1) MCP_ALLOWED_ORIGINS or MCP_ALLOWED_HOSTS is set AND (2) inbound Bearer introspection is configured (MCP_SVC_INTROSPECT_URL + MCP_SVC_CLIENT_ID/SECRET) or MCP_ALLOW_UNVERIFIED_BEARER=true is set explicitly (fail-closed). · MCP_SVC_CLIENT_ID=Client ID this server presents to the introspection endpoint above (its resource-server credentials). Only needed alongside MCP_SVC_INTROSPECT_URL; it does not authenticate you to GoCertius. · MCP_SVC_CLIENT_SECRET=Client secret this server presents to the introspection endpoint above (its resource-server credentials). Only needed alongside MCP_SVC_INTROSPECT_URL; it does not authenticate you to GoCertius. (See https://www.gocertius.io for credential acquisition.) · MCP_SVC_INTROSPECT_URL=RFC 7662 token introspection URL for inbound Bearer verification in HTTP mode. Opt-in, and required when MCP_HTTP_PUBLIC=true. Leave empty for stdio (local) use. · PORT=HTTP port when running in hosted (HTTP) mode; ignored in stdio mode 1 0.0 %
MCP_ALLOWED_SYMLINK_ROOTS=JSON array of absolute paths the connector may read through (and write generated images through) in-workspace symlinks that resolve into them. Mirrors the host's built-in file-tool declared-Space roots. Malformed or partially-malformed values fail closed to workspace-only. Optional; standalone users omit it. · MCP_HTTP_PORT=When set, serve MCP over HTTP on this port bound to 127.0.0.1 (loopback only) instead of stdio. Intended for host-managed local deployments; stdio hosts omit it. · MCP_WORKSPACE_PATH=Workspace directory for saving generated images · OPENAI_API_KEY=OpenAI API key with image generation access · OPENAI_IMAGE_MODEL=Override the default OpenAI image model identifier · OPENAI_IMAGE_REQUEST_TIMEOUT_MS=Outbound HTTP request timeout in milliseconds (max 1800000) 1 0.0 %
MCP_ALLOW_DATA_PREVIEW=Set to 1 to let tableContents read table and CDS rows on every destination that does not state policy.allowDataPreview itself (reading table data is off by default) · MCP_ALLOW_FREE_SQL=Set to 1 to allow runQuery and tableContents with sqlQuery on every destination that does not state policy.allowFreeSql itself (free SQL is off by default; implies table data) · MCP_API_CLASSIFICATION_FILES=Extra classification files for apiReleaseState, comma list: a path inside SAP's cloudification repository (partner/objectClassifications_ACME.json) or an https URL · MCP_AUDIT_FILE=Path of a JSONL audit trail: one record per tool call (tool, destination, duration, outcome ok/error/denied/unavailable, policy gate, redacted argument summary) · MCP_CACHE_DIR=Directory for the cached SAP cloudification repository used by apiReleaseState (default ~/.abap-adt-mcp/cache) · MCP_DISABLED_TOOLSETS=Toolsets to hide, comma list (core cannot be disabled) · MCP_EXPORT_ROOT=When set, exportPackageSources may only write inside this directory · MCP_HTTP_ALLOWED_HOSTS=Comma-separated Host header values allowed (DNS-rebinding protection; loopback hosts always allowed when bound to loopback) · MCP_HTTP_ALLOWED_ORIGINS=Comma-separated Origin values allowed on the HTTP transport (loopback origins always allowed when bound to loopback; * allows any) · MCP_HTTP_HOST=Bind address for the HTTP transport (default 127.0.0.1). Set 0.0.0.0 only inside containers that publish the port · MCP_HTTP_MAX_BODY_BYTES=Largest request body the HTTP transport accepts, in bytes (default 4194304); larger bodies are refused with HTTP 413 · MCP_HTTP_MAX_SESSIONS=Maximum concurrent MCP sessions on the HTTP transport (default 16); further initialize requests get 503 · MCP_HTTP_PORT=When set (1024-65535), serve Streamable HTTP on http://127.0.0.1:<port>/mcp with bearer-token auth instead of stdio · MCP_HTTP_SESSION_TTL_MINUTES=Idle minutes after which an HTTP session (and its SAP sessions/locks) is closed (default 30) · MCP_HTTP_TOKEN=Bearer token for the HTTP transport; auto-generated and written to ~/.abap-adt-mcp/http-token when unset · MCP_MAX_RESPONSE_CHARS=Character budget for a single tool response before results are paged/truncated (default 40000, minimum 5000). Raise it if your MCP host accepts larger tool outputs · MCP_PROFILE_GATE=Platform gate for toolsets the destination does not expose (debugger, traces, abapGit, ...): enforce (default, refuse before calling SAP), warn (log only) or off · MCP_READ_ONLY=Set to 1 to make every destination read-only (server-side; only read-only annotated tools plus login/logout run). Per-destination policies live in systems.json · MCP_SOURCE_CACHE_TTL_SECONDS=Lifetime of the per-session source cache used by grepPackage, cdsViewInfo and syntaxCheckCode (default 300; 0 keeps entries until logout) · MCP_TOOLSETS=Toolsets to publish: comma list (core,source,objects,transports,analysis,tests,atc,data,discovery,runtime,refactoring,rap,services,git,debugger,traces) or a preset: all (default) or focused · SAP_ALLOW_REENTRANCE_TICKET=Set to 1 to enable the reentranceTicket tool (disabled by default: it returns a live SAP logon credential into the conversation) · SAP_AUTH_TYPE=Default auth type for entries that don't specify one: sso (default), sso2, basic, or oauth · SAP_BROWSER_PATH=SSO destinations: path to a Chromium/Chrome/Edge binary for the browser login (auto-detected when unset) · SAP_BROWSER_PROFILE_DIR=SSO destinations: directory of the persistent browser profile that keeps the identity-provider session (default ~/.abap-adt-mcp/sso/<host>) · SAP_CLIENT=Legacy single-system mode: SAP client number, e.g. 100 · SAP_DEFAULT_DESTINATION=Destination name used when a tool call omits `destination` (alternatively mark an entry with "default": true) · SAP_LANGUAGE=Legacy single-system mode: logon language, e.g. EN · SAP_OAUTH_CLIENT_ID=Legacy single-system mode with SAP_AUTH_TYPE=oauth: OAuth2 client id · SAP_OAUTH_CLIENT_SECRET=Legacy single-system mode with SAP_AUTH_TYPE=oauth: OAuth2 client secret · SAP_OAUTH_SCOPE=Legacy single-system mode with SAP_AUTH_TYPE=oauth: optional OAuth2 scope · SAP_OAUTH_TOKEN_URL=Legacy single-system mode with SAP_AUTH_TYPE=oauth: OAuth2 token endpoint (client_credentials) · SAP_PASSWORD=Legacy single-system mode: SAP password · SAP_SSO2_ARGS=Legacy single-system sso2 mode: JSON array of provider arguments (never put a ticket here) · SAP_SSO2_COMMAND=Legacy single-system sso2 mode: absolute path to the trusted local ticket provider · SAP_SSO2_TIMEOUT_MS=Legacy single-system sso2 mode: provider timeout in milliseconds (default 30000; range 1000-300000) · SAP_SYSTEMS=Inline JSON map of destinations (same shape as SAP_SYSTEMS_FILE). Contains credentials — prefer SAP_SYSTEMS_FILE · SAP_SYSTEMS_FILE=Path to a JSON file mapping destination names to system configs (url, client, authType basic/sso/sso2/oauth, credentials). Recommended; keep the file mode 0600. See systems.example.json · SAP_TLS_INSECURE=Legacy single-system mode: set to 1 to skip TLS certificate verification for that system only (sandboxes with self-signed certificates) · SAP_URL=Legacy single-system mode: base URL of the SAP system, e.g. https://host:44300 · SAP_USER=Legacy single-system mode: SAP username 1 0.0 %
MCP_API_BASE_URL=NexusFeed API base URL · MCP_API_KEY=NexusFeed API key. Get one via RapidAPI: rapidapi.com/ladourv/api/abc-license-compliance-api 1 0.0 %
MCP_API_BASE_URL=NexusFeed API base URL · MCP_API_KEY=NexusFeed API key. Get one via RapidAPI: rapidapi.com/ladourv/api/ltl-fuel-surcharge-api 1 0.0 %
MCP_API_KEY=API key clients must send as X-API-Key. · MCP_SERVER_TOOLS_SURFACE=Tool surface to expose. Use guided for the safer default workflow, including report readback. Use expert only when clients need raw ZAP tools outside the guided surface. · ZAP_API_KEY=API key configured on the ZAP daemon. · ZAP_API_PORT=ZAP API port. · ZAP_API_URL=Hostname or URL of a separately running ZAP daemon reachable from this container. 1 0.0 %

This sheet lists 50 of 7,577 values; they cover 50 entries.

Sheet 90 of 152, 7,577 values in total.

Counted from the projection, the same table the list filters on. An entry counts once per value.

tracevero · https://tracevero.com/werkzeuge/merkmal/mcp/roh_umgebungsbeschreibungen?seite=90