# Server

PORT=3000

HOST=0.0.0.0

REGISTRY_NAME="My Agent Registry"

REGISTRY_URL=http://localhost:3000

# Database

DB_PATH=./data/registry.db

# LLM Provider for embeddings and eval

# Options: anthropic | openai | ollama | mock

# mock = deterministic bag-of-words; useful for CI and offline dev,

# no API key required, but ranking quality is intentionally crude.

LLM_PROVIDER=anthropic

ANTHROPIC_API_KEY=sk-ant-...

OPENAI_API_KEY=sk-...

OLLAMA_URL=http://localhost:11434

# Embedding model

# anthropic: voyage-3 (via Anthropic API)

# openai: text-embedding-3-small

# ollama: nomic-embed-text

EMBEDDING_MODEL=voyage-3

# Chat model — used by the Connect Agent (Sprint 8) when LLM_PROVIDER

# is anthropic/openai/ollama. Defaults per provider:

# anthropic: claude-haiku-4-5-20251001

# openai: gpt-4o-mini

# ollama: llama3.1

# With LLM_PROVIDER=mock, the Connect Agent uses its built-in

# rule-based state machine instead.

CHAT_MODEL=

# Embedding dimensions (must match the model)

# voyage-3: 1024, text-embedding-3-small: 1536, nomic-embed-text: 768

EMBEDDING_DIMS=1024

# Admin (bootstrap token)

# On first boot this value becomes an admin-scoped token in the tokens table

# (name = "env-bootstrap"). Subsequent tokens are managed via POST /admin/tokens.

ADMIN_TOKEN=change-me-before-deploy

# CORS allowlist: comma-separated origins, or "*" for any.

# Default "*" is convenient for local dev, NOT for production.

CORS_ORIGINS=*

# Health check interval in ms (default: 5 minutes)

HEALTH_CHECK_INTERVAL=300000

# Logging — JSON lines in production, pretty single-line in dev.

# LOG_LEVEL: debug | info | warn | error (default info)

# LOG_PRETTY=1 forces the pretty format on even when NODE_ENV=production

LOG_LEVEL=info

# LOG_PRETTY=1

# ─── External SSO (Sprint 5) ────────────────────────────────────────────────

# Auth provider used by POST /auth/login. Only "firebase" is implemented

# today; add new providers under src/auth-providers/ and register them

# in src/auth-providers/index.js to enable swapping.

AUTH_PROVIDER=firebase

# Firebase project. apiKey + projectId are PUBLIC — they're exposed to the

# browser via GET /auth/config. Do not put any private key here.

FIREBASE_PROJECT_ID=

FIREBASE_API_KEY=

# Optional override. Defaults to "<projectId>.firebaseapp.com".

FIREBASE_AUTH_DOMAIN=

# Emails that get the 'admin' role on first SSO login (comma-separated, case

# insensitive). All other users get the 'user' role and can only mutate

# their own agents / MCP servers.

ADMIN_EMAILS=