.env.example

# memory-journal-mcp Environment Configuration
# Copy this file to .env and customize for your setup
# See README.md for full documentation of these variables

# =============================================================================
# Database
# =============================================================================
# Path to the personal journal SQLite database (CLI: --db)
DB_PATH=./memory_journal.db

# Path to the shared team SQLite database (CLI: --team-db)
# SECURITY WARNING: Ensure this path is heavily access-controlled.
# Required to enable the 25 team collaboration tools
# TEAM_DB_PATH=./team.db

# Override author name written to team entries (default: git config user.name)
# TEAM_AUTHOR=Your Name

# Comma-separated flag types for Hush Protocol (CLI: --flag-vocabulary)
# FLAG_VOCABULARY=blocker,needs_review,help_requested,fyi

# =============================================================================
# GitHub Integration
# =============================================================================
# Personal access token — scopes: repo, project, read:org
# GITHUB_TOKEN=ghp_your_token_here

# Default GitHub Project number for auto-assignment when creating issues
# DEFAULT_PROJECT_NUMBER=1

# JSON map of repo names → { path, project_number } for multi-project routing
# Recommended over GITHUB_REPO_PATH for multi-repo setups
# PROJECT_REGISTRY={"my-repo":{"path":"/path/to/repo","project_number":1},"other-repo":{"path":"/path/to/other","project_number":5}}

# =============================================================================
# Tool Filtering
# =============================================================================
# Control exposed tools (CLI: --tool-filter)
# Shortcuts: full (default), starter (~11), essential (~7), readonly (~15)
# Groups:    core, search, analytics, relationships, export, admin, github, backup, team, codemode
# Exclusion: -github,-analytics  Re-enable: +tool_name
# MEMORY_JOURNAL_MCP_TOOL_FILTER=full

# Maximum size in bytes for mj_execute_code result payload (CLI: --codemode-max-result-size)
# CODE_MODE_MAX_RESULT_SIZE=102400

# =============================================================================
# Security & IO Boundaries
# =============================================================================
# Critical Security Boundary: Comma-separated absolute paths granting filesystem access to Code Mode and export tools
# SECURITY WARNING: Never use generic directories like / or /usr. Fail-closed by default.
# ALLOWED_IO_ROOTS=/path/to/your/git/repo

# =============================================================================
# Server Configuration
# =============================================================================
# Bind host for HTTP/SSE transport (use 0.0.0.0 for containers)
# MCP_HOST=localhost

# Bearer token for HTTP transport authentication (CLI: --auth-token)
# MCP_AUTH_TOKEN=your-secret-token

# Allowed CORS origins for HTTP transport, comma-separated (default: none)
# MCP_CORS_ORIGIN=https://your-client.example.com

# Max requests per minute per client IP for HTTP transport (default: 100)
# MCP_RATE_LIMIT_MAX=100

# Enable HSTS security header on HTTP responses (CLI: --enable-hsts)
# MCP_ENABLE_HSTS=false

# Log verbosity: error, warn, info, debug (CLI: --log-level)
LOG_LEVEL=info

# Instruction depth served to agents: essential, standard, full (CLI: --instruction-level)
# INSTRUCTION_LEVEL=standard

# =============================================================================
# OAuth 2.1 Authentication (HTTP transport only, opt-in)
# =============================================================================
# OAUTH_ENABLED=false
# OAUTH_ISSUER=https://auth.example.com/realms/mcp
# OAUTH_AUDIENCE=memory-journal-mcp
# OAUTH_JWKS_URI=https://auth.example.com/realms/mcp/protocol/openid-connect/certs
# OAUTH_CLOCK_TOLERANCE=5

# =============================================================================
# Briefing Configuration (memory://briefing content)
# =============================================================================
# Number of recent journal entries to include (CLI: --briefing-entries)
# BRIEFING_ENTRY_COUNT=3

# Number of session summaries to list in briefing (CLI: --briefing-summaries)
# BRIEFING_SUMMARY_COUNT=1

# Include team DB entries in briefing output
# BRIEFING_INCLUDE_TEAM=false

# Number of milestones to list in briefing; 0 = hide section
# BRIEFING_MILESTONE_COUNT=3

# Number of issues to list in briefing; 0 = count only
# BRIEFING_ISSUE_COUNT=0

# Number of PRs to list in briefing; 0 = count only
# BRIEFING_PR_COUNT=0

# Show PR status breakdown (open/merged/closed)
# BRIEFING_PR_STATUS=false

# Number of workflow runs to list in briefing; 0 = status only
# BRIEFING_WORKFLOW_COUNT=0

# Show workflow status breakdown
# BRIEFING_WORKFLOW_STATUS=false

# Aggregate Copilot review state in briefing
# BRIEFING_COPILOT_REVIEWS=false

# =============================================================================
# Agent Context (Rules & Skills)
# =============================================================================
# Path to a rules/GEMINI.md file for agent awareness (CLI: --rules-file)
# RULES_FILE_PATH=/path/to/RULES.md

# Path to a skills directory for agent awareness (CLI: --skills-dir)
# SKILLS_DIR_PATH=/path/to/skills

# Free-text workflow summary shown in memory://workflows (CLI: --workflow-summary)
# MEMORY_JOURNAL_WORKFLOW_SUMMARY=/deploy: production deploy | /audit: security scan

# =============================================================================
# GitHub Commander
# =============================================================================
# Lint command used in Commander validation gates
# PROJECT_LINT_CMD=npm run lint

# Typecheck command (empty = skip)
# PROJECT_TYPECHECK_CMD=npm run typecheck

# Build command (empty = skip)
# PROJECT_BUILD_CMD=npm run build

# Test command
# PROJECT_TEST_CMD=npm run test

# E2E test command (empty = skip)
# PROJECT_E2E_CMD=npm run test:e2e

# Package manager override: npm, yarn, pnpm, bun (default: auto-detect from lockfile)
# PROJECT_PACKAGE_MANAGER=npm

# Enable Docker audit steps (default: auto-detect from Dockerfile presence)
# PROJECT_HAS_DOCKERFILE=true

# Human-in-the-loop checkpoint if changes touch > N files
# COMMANDER_HITL_FILE_THRESHOLD=10

# Override security tool auto-detection (comma-separated)
# COMMANDER_SECURITY_TOOLS=npm-audit,trivy

# Branch naming prefix for Commander PRs
# COMMANDER_BRANCH_PREFIX=fix

# =============================================================================
# Audit Logging & Metrics
# =============================================================================
# Enable JSONL audit logging to a file path, or "stderr" for container mode (CLI: --audit-log)
AUDIT_LOG_PATH=./logs/mcp-audit.jsonl

# Redact tool arguments from audit entries (CLI: --audit-redact)
# AUDIT_REDACT=false

# Log read-scoped tool calls in addition to write/admin (CLI: --audit-reads)
# AUDIT_READS=false

# Maximum audit log file size in bytes before rotation (CLI: --audit-log-max-size)
# AUDIT_LOG_MAX_SIZE=10485760

# Set to false to disable in-memory tool call metrics accumulation
# MCP_METRICS_ENABLED=true

# =============================================================================
# Vector Index
# =============================================================================
# Rebuild the semantic search vector index on server startup
# AUTO_REBUILD_INDEX=false