Use .env, environment variables, or MCP_CONFIG_PATH with a JSON/YAML file.

​
Core settings

VariableDescription
PROJECTS_ROOTSComma-separated list of root directories to scan for projects (preferred).
PROJECTS_ROOTSingle root directory (legacy compatibility).
ENABLE_HTTPEnable the HTTP transport (true/false).
ENABLE_STDIOEnable the STDIO transport (true/false).
HTTP_HOSTHTTP server bind address. Default: 127.0.0.1.
HTTP_PORTHTTP server port. Default: 3000.
HTTP_MODEHTTP transport mode: streamable or sse.
MAX_FILE_SIZEMaximum file size for read operations (bytes).
MAX_OUTPUT_SIZEMaximum command or resource output size (bytes).
COMMAND_TIMEOUT_MSTimeout for command execution (milliseconds).
RETRY_MAX_ATTEMPTSNumber of retry attempts for transient failures.
RETRY_BASE_DELAY_MSBase delay between retries (milliseconds).
ALLOWED_COMMANDSComma-separated list of commands permitted by run_command_safe.
PROTECTED_PATHSComma-separated path patterns that cannot be modified.
LOG_LEVELLog verbosity: trace, debug, info, warn, error.
REGISTRY_FILEPath to the project registry JSON file.
AUDIT_LOG_FILEPath to the audit log for mutating operations.
HTTP_REQUEST_LOG_FILEPath to the HTTP request log.

​
Security settings

VariableDescription
ENABLE_AUTHEnable API-key authentication for the HTTP transport.
AUTH_HEADER_NAMEHTTP header used to pass the API key. Default: x-api-key.
AUTH_API_KEYSComma-separated keys in key:role:id format.

​
Observability settings

VariableDescription
ENABLE_OTELEnable OpenTelemetry tracing.
OTEL_SERVICE_NAMEService name reported in traces.
OTEL_EXPORTER_OTLP_ENDPOINTOTLP HTTP endpoint for trace export.
OTEL_EXPORTER_OTLP_HEADERSHeaders for the OTLP exporter in key=value,key2=value2 format.

​
Cross-platform paths

REGISTRY_FILE and AUDIT_LOG_FILE support ~ and normalize to absolute paths on Linux, macOS, and Windows.

​
Example .env

PROJECTS_ROOTS=/projects,/srv/repos
ENABLE_HTTP=true
ENABLE_STDIO=true
HTTP_HOST=127.0.0.1
HTTP_PORT=3000
HTTP_MODE=streamable
MAX_FILE_SIZE=1048576
MAX_OUTPUT_SIZE=131072
COMMAND_TIMEOUT_MS=120000
RETRY_MAX_ATTEMPTS=2
RETRY_BASE_DELAY_MS=200
ALLOWED_COMMANDS=npm,pnpm,yarn,go,python,pytest,ruff,flake8,cargo,mvn,gradle,php,composer,phpunit,make
PROTECTED_PATHS=.git,.env,.env.local,.env.production
LOG_LEVEL=info
REGISTRY_FILE=~/.coding-mcp/registry.json
AUDIT_LOG_FILE=~/.coding-mcp/audit.log
HTTP_REQUEST_LOG_FILE=~/.coding-mcp/http-requests.log

​
Config file usage

MCP_CONFIG_PATH=/etc/coding-mcp/config.yaml coding-mcp serve --transport http

​
Validation

If configuration is invalid, startup fails with schema validation errors.