Skip to main content

​
Environment Variables (.env)

Create a .env file in the same directory as docker-compose.yml and set the required values before starting the application.

​
Security (Required)

VariableDefaultDescription
STUDIO_ENCRYPTION_KEYauto-generatedEncryption key for passwords, tokens, and secrets in the database. Set explicitly to persist encrypted data across container restarts.
STUDIO_JWT_SECRETauto-generatedJWT secret for admin session tokens. Set explicitly to persist sessions across restarts.
REDIS_PASSWORD— (required)Redis authentication password. Compose will fail if not set.
STUDIO_AGENT_SERVICE_TOKEN— (required)Shared token for backend-to-agent-mcp internal communication. Must match on both containers.

​
Public Ports

VariableDefaultDescription
STUDIO_PORT3000Frontend nginx port (public)
STUDIO_SSL_PORT443Frontend HTTPS port (public, when SSL enabled)

​
Database

VariableDefaultDescription
STUDIO_DATABASE_URLsqlite+aiosqlite:///./data/studio.dbConnection string for the internal metadata database
STUDIO_GENERATED_DIR./generatedDirectory for generated server code (shared volume mount point)

​
FastMCP

VariableDefaultDescription
STUDIO_FASTMCP_HOSTmcpDocker service name for the FastMCP container
STUDIO_FASTMCP_PORT8080FastMCP internal port

​
Agent MCP

VariableDefaultDescription
STUDIO_AGENT_RATE_LIMIT120Max agent API requests per minute per token

​
Redis

VariableDefaultDescription
STUDIO_REDIS_URLautoBackend Redis connection URL (auto-constructed from REDIS_PASSWORD). Override for external Redis.
REDIS_URLautoMCP container Redis connection URL (auto-constructed from REDIS_PASSWORD).

​
Logging

VariableDefaultDescription
STUDIO_LOG_LEVELINFOBackend log level: DEBUG, INFO, WARNING, ERROR

​
GeoIP (Optional)

VariableDefaultDescription
STUDIO_GEOIP_SOURCEgenericGeoIP database source: generic (P3TERX community mirror) or maxmind (official MaxMind API)
STUDIO_MAXMIND_LICENSE_KEY—MaxMind license key for API downloads. Required when STUDIO_GEOIP_SOURCE=maxmind. Also enables runtime DB updates from the Settings UI.
The GeoLite2-Country MMDB is downloaded at Docker build time and works air-gapped after build. When a MaxMind license key is configured, you can update the database at runtime via the Settings UI.
Get a free MaxMind license key at maxmind.com/en/geolite2/signup.

​
Security Controls

VariableDefaultDescription
STUDIO_PROMPT_GUARD_ENABLEDtrueEnable prompt injection scanning on all entity writes and imports
STUDIO_PROMPT_GUARD_ML_DOWNLOADtrueAllow automatic download of the ML model for L1 prompt injection detection
STUDIO_ALLOW_PRIVATE_NETWORKSfalseAllow database connections to private/internal network addresses (localhost, RFC 1918, Docker service names). Enable for development only.
STUDIO_ALLOW_PASSTHROUGH_SQLfalseAllow passthrough SQL tools (tools where the entire SQL query is a single parameter). When disabled, these tools are blocked during code generation.
See Security > Prompt Injection Protection for details on what is scanned and how blocked attempts are reported.

​
SSL/TLS (Optional)

VariableDefaultDescription
STUDIO_SSL_STAGINGfalseUse Let’s Encrypt staging environment for testing (avoids rate limits)
STUDIO_SSL_DOMAIN—Domain name for SSL certificate
STUDIO_SSL_EMAIL—Contact email for Let’s Encrypt notifications
STUDIO_EXTERNAL_HTTPS_PORT443External HTTPS port for HTTP→HTTPS redirects (set if port-mapping differs from default 443)

​
Generate Secrets

# Encryption key
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

# JWT secret
openssl rand -hex 32

# Redis password
openssl rand -base64 32

# Agent service token
openssl rand -hex 32

​
Server Settings (UI)

Server settings are managed through the Settings tab on the Server page (/server > Settings tab).

​
General

SettingDefaultDescription
Server NameSMKRV Analytics MCPDisplay name for the MCP server
TransporthttpTransport protocol: http, sse, stdio
Host0.0.0.0Bind address
Port8080MCP server port
Log LevelINFOFastMCP log level
OpenTelemetrydisabledEnable OTEL tracing

​
Security

SettingDefaultDescription
Auth TypenoneAuthentication: none, bearer, oauth_credentials, or oauth_introspection
Bearer Tokens—Named bearer tokens when auth_type is bearer. Create and manage from the MCP Access page. Each token supports optional idle timeout. Stored as bcrypt hashes.
OAuth2 Clients—Client ID/secret pairs when auth_type is oauth_credentials (max 10, encrypted at rest)
Token TTL3600Access token lifetime in seconds for oauth_credentials mode (60–604800)
Introspection URL—RFC 7662 endpoint URL when auth_type is oauth_introspection
Introspection Client ID—Client ID for authenticating with the introspection endpoint
Introspection Client Secret—Client secret for the introspection endpoint (encrypted at rest)
Introspection Cache TTL60Cache duration in seconds for introspection results (0–3600)
CORS Originslocalhost:3000, localhost:5173Allowed CORS origins (array)

​
SSL / TLS

SettingDefaultDescription
SSL EnabledfalseEnable HTTPS with Let’s Encrypt
UI Domain—Domain for the web UI
MCP Domain—Domain for MCP endpoint (same or separate from UI)
MCP ProxyfalseProxy MCP through nginx
ACME Email—Email for Let’s Encrypt notifications
Challenge Typehttp-01ACME challenge: http-01 or dns-01
DNS Provider—DNS provider for DNS-01: cloudflare or route53
DNS Credentials—Provider API credentials (encrypted at rest)
Auto-RenewtrueAutomatically renew certificates

​
Global Variables

Server-level key-value pairs accessible in all tool transform templates as {{ vars.key_name }}.
SettingDescription
Variable NameAlphanumeric identifier (letters, digits, underscores)
ValueString, integer, float, or boolean
TypeInferred from value or set explicitly
Manage via the Global Variables card on the Settings tab, or via the API: PATCH /api/v1/server/config with global_variables.
Maximum 100 global variables. Names must match ^[a-zA-Z_]\w{0,63}$.

​
CORS Configuration

Default CORS origins allow only localhost:3000 and localhost:5173. For production, update to your actual domain: 
["https://studio.example.com"]
Never use ["*"] in production — it allows any origin to make API requests.
Update via the Settings UI or the API: PATCH /api/v1/server/config with cors_origins.

​
Encryption Key Management

The STUDIO_ENCRYPTION_KEY is a symmetric encryption key used to encrypt:
  • Database connection passwords
  • Bearer authentication tokens
  • DNS API credentials for SSL
  • Sensitive extra_params fields (e.g., BigQuery credentials_json)
  • TOTP 2FA secrets
  • OAuth2 client credentials (MCP auth)
  • OAuth2 introspection client secret (MCP auth)
If not set, a key is auto-generated on first run. Set it explicitly in .env to persist encrypted data across container restarts.

​
Key Rotation

SMKRV MCP Studio supports encryption key rotation. To rotate:
  1. Generate a new key: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
  2. Set STUDIO_ENCRYPTION_KEY to new_key,old_key (comma-separated, new key first)
  3. Restart the backend — new data is encrypted with the new key, old data can still be decrypted with the old key
  4. After all data has been re-encrypted (on next update of each entity), remove the old key

​
See Also