.env.example

# MCP Registry Configuration

# Server configuration
MCP_REGISTRY_SERVER_ADDRESS=:8080
MCP_REGISTRY_VERSION=dev

# Database configuration
MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-registry

# Per-app limits. Budget max_connections across all replicas, rollout surge,
# admin clients and background work before increasing replica count.
MCP_REGISTRY_DATABASE_MAX_CONNECTIONS=60
MCP_REGISTRY_DATABASE_MIN_CONNECTIONS=10
# Enable only after migration 018 and prepared-row backfill coverage are verified.
# Disable to use typed listing responses without removing derived database columns.
MCP_REGISTRY_PREPARED_LISTING_JSON=false

# Path or URL to import seed data (supports local files and HTTP URLs)
# For offline development, use: data/seed.json
MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers

# Validate seed data against the registry rules on import (default: true)
# Set to false for offline development when seeding from a local file, since
# data/seed.json is not guaranteed to pass validation
MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=true

# GitHub OAuth configuration
# These creds are for local development with the 'MCP Registry Login (Local)' GitHub App
# They don't provide any real privileged access, hence why it's okay that they're here
# The staging and prod credentials client secrets are sensitive and are stored in encrypted form in ./deploy
MCP_REGISTRY_GITHUB_CLIENT_ID=Iv23licy3GSiM9Km5jtd
MCP_REGISTRY_GITHUB_CLIENT_SECRET=0e8db54879b02c29adef51795586f3c510a9341d

# JWT configuration
# This should be a 32-byte Ed25519 seed (not the full private key). Generate a new seed with: `openssl rand -hex 32`
MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c

# Anonymous authentication for development/testing only
# When enabled, allows anyone to get tokens for publishing to io.modelcontextprotocol.anonymous/* namespace
# This should be disabled in prod
MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false

# GitHub OIDC token exchange (for `mcp-publisher login github-oidc`)
# Expected `aud` claim on incoming GitHub Actions OIDC tokens. Must equal the
# scheme + host that publishers pass via `--registry` (e.g. `https://registry.example.com`).
# The publisher CLI derives the audience from `--registry` automatically; the server
# rejects all OIDC exchanges if this is unset, so set it on every deployment that
# accepts GitHub Actions publishes.
MCP_REGISTRY_GITHUB_OIDC_AUDIENCE=

# Google Cloud Identity OIDC configuration for admin access
# Enable OIDC authentication for @modelcontextprotocol.io admin accounts
MCP_REGISTRY_OIDC_ENABLED=false
# Example for Google Cloud Identity issuer
MCP_REGISTRY_OIDC_ISSUER=https://accounts.google.com
MCP_REGISTRY_OIDC_CLIENT_ID=1234.apps.googleusercontent.com
# Require @modelcontextprotocol.io Google Workspace domain
MCP_REGISTRY_OIDC_EXTRA_CLAIMS=[{"hd":"modelcontextprotocol.io"}]
# Grant admin permissions to OIDC-authenticated users
MCP_REGISTRY_OIDC_EDIT_PERMISSIONS=*
MCP_REGISTRY_OIDC_PUBLISH_PERMISSIONS=*