.env.example

# MCP Server Environment Variables

# Server configuration
PORT=3000
HOST=localhost
NODE_ENV=development

# Logging configuration
LOG_LEVEL=info # error, warn, info, debug

# Security settings
CORS_ENABLED=true
CORS_ORIGINS=*
RATE_LIMIT_ENABLED=true
RATE_LIMIT_MAX=100
RATE_LIMIT_WINDOW_MS=900000 # 15 minutes

# Blocks browser-driven cross-origin POST/PUT/PATCH/DELETE requests. Clients that
# send no Origin header (curl, MCP clients, server-to-server) are unaffected.
# Set to false only if you intentionally serve a cross-origin browser app.
CSRF_PROTECTION_ENABLED=true

# Scanner module: token required on side-effecting routes (scan/export and the
# /tools/scanner tool endpoint). If unset, those routes are unauthenticated.
# Send as `Authorization: Bearer <token>` or `X-API-Key: <token>`.
SCANNER_API_TOKEN=

# readme-badges module: token required on the routes that touch the filesystem
# (update/detect and the /tools/readme-badges tool endpoint). If unset, those
# routes are unauthenticated. Same header formats as SCANNER_API_TOKEN.
README_BADGES_API_TOKEN=

# readme-badges module: directory that readmePath/rootDir must stay inside.
# Defaults to the process working directory.
README_BADGES_ROOT=

# convert2doc module: extra hosts allowed as `baseUrl`, comma-separated. Only
# convert2doc.com (and its subdomains) are allowed by default; a leading dot
# matches subdomains. Set this if you self-host the conversion API.
CONVERT2DOC_ALLOWED_HOSTS=

# craigslist module: extra hosts allowed for /craigslist/details, comma-separated.
# Only craigslist.org subdomains are allowed by default.
CRAIGSLIST_ALLOWED_HOSTS=

# Module settings
MODULES_AUTOLOAD=


# Proxies
WEBSHARE_PROXY=http://username-US-rotate:password@p.webshare.io:80