71 lines
3.0 KiB
Bash
71 lines
3.0 KiB
Bash
# AegisGitea MCP configuration. Copy to .env and fill in. All names are
|
|
# case-insensitive. Never commit a real .env.
|
|
|
|
# --- Gitea -------------------------------------------------------------------
|
|
# Base URL of your Gitea instance. A trailing /api/v1 is accepted and removed.
|
|
GITEA_URL=https://gitea.example.com
|
|
# Token used for stdio and for admin-token mode on HTTP. Create it in Gitea under
|
|
# Settings > Applications. Its scopes bound what this server can do.
|
|
GITEA_TOKEN=
|
|
|
|
# --- Transport ---------------------------------------------------------------
|
|
# stdio (default) or http
|
|
MCP_TRANSPORT=stdio
|
|
MCP_HOST=127.0.0.1
|
|
MCP_PORT=8080
|
|
MCP_PATH=/mcp
|
|
# Static bearer token for the HTTP endpoint (admin identity). At least 32
|
|
# characters. Generate with: openssl rand -hex 32
|
|
MCP_BEARER_TOKEN=
|
|
# Public base URL of this server behind a reverse proxy (https unless loopback).
|
|
PUBLIC_BASE_URL=
|
|
# Extra Host header values accepted behind a reverse proxy (comma separated).
|
|
ALLOWED_HOSTS=
|
|
# Proxy addresses whose X-Forwarded-For is trusted (comma separated IPs or
|
|
# networks). The default only trusts a proxy on this host. Behind a Docker proxy
|
|
# on another address list that address; use * only if the port is reachable
|
|
# solely from the proxy.
|
|
FORWARDED_ALLOW_IPS=127.0.0.1
|
|
|
|
# --- Per-user OAuth (HTTP only) -----------------------------------------------
|
|
OAUTH_ENABLED=false
|
|
GITEA_OAUTH_CLIENT_ID=
|
|
GITEA_OAUTH_CLIENT_SECRET=
|
|
# Encrypts stored user tokens. At least 32 characters. Generate with:
|
|
# openssl rand -hex 32
|
|
TOKEN_ENCRYPTION_KEY=
|
|
# Optional allowlist of redirect URIs clients may register (comma separated): exact
|
|
# URIs, or https://host/ prefixes. Empty accepts any https URI (and http on
|
|
# loopback); the consent page is then the only check. For a public deployment list the
|
|
# hosted clients you use, e.g. https://claude.ai/,https://chat.mistral.ai/
|
|
OAUTH_REDIRECT_ALLOWLIST=
|
|
# Granular Gitea scopes only (read:/write: activitypub, admin, issue, misc,
|
|
# notification, organization, package, repository, user). Unknown values are rejected.
|
|
OAUTH_SCOPES=write:activitypub,write:admin,write:issue,write:misc,write:notification,write:organization,write:package,write:repository,write:user
|
|
|
|
# --- State --------------------------------------------------------------------
|
|
# Token store and audit log live here.
|
|
DATA_DIR=~/.local/state/aegis-gitea-mcp
|
|
# Defaults to DATA_DIR/audit.log
|
|
AUDIT_LOG_PATH=
|
|
|
|
# --- Tool exposure (everything is enabled by default) ---------------------------
|
|
# Expose only GET operations.
|
|
READ_ONLY=false
|
|
# Comma separated domains: admin, repo, issue, pull, release, wiki, org, team,
|
|
# user, actions, hook, package, notification, misc, or all.
|
|
TOOLSETS=all
|
|
# Comma separated tool names to hide, e.g. gitea_repo_delete
|
|
DISABLED_TOOLS=
|
|
|
|
# --- Limits and safety ----------------------------------------------------------
|
|
REQUEST_TIMEOUT_SECONDS=30
|
|
MAX_TOOL_RESPONSE_ITEMS=200
|
|
MAX_TOOL_RESPONSE_CHARS=60000
|
|
MAX_BINARY_BYTES=5242880
|
|
# off, mask or block
|
|
SECRET_DETECTION_MODE=mask
|
|
LOG_LEVEL=INFO
|
|
EXPOSE_ERROR_DETAILS=false
|
|
RATE_LIMIT_PER_MINUTE=120
|