.env.example

# MCP Server Configuration
MCP_HOST=127.0.0.1      # Bind address (use 0.0.0.0 only behind trusted network controls)
MCP_PORT=8000            # Port for the MCP HTTP server
MCP_TRANSPORT=http       # http | stdio
LOG_LEVEL=INFO           # Python log level: DEBUG, INFO, WARNING, ERROR
MCP_AUTH_TOKEN=          # Optional Bearer token required on /mcp
MCP_REQUIRE_AUTH=0       # Set 1 for any remotely exposed deployment
MCP_MAX_CONCURRENT_REQUESTS=8  # Bound concurrent MCP requests/downloads
MCP_RATE_LIMIT_REQUESTS=120    # Per-client/IP window; set 0 only for trusted local use
MCP_RATE_LIMIT_WINDOW_SECONDS=60
MCP_SSL_CERTFILE=        # Optional direct TLS certificate path
MCP_SSL_KEYFILE=         # Optional direct TLS private-key path
BCE_CATALOG_SNAPSHOT_DIR=      # Optional persistent BCEData audit directory
IEM_CATALOG_DIR=               # Optional persistent IEM catalog directory

# Optional API base URL overrides
# CKAN_API_URL=https://www.datosabiertos.gob.ec/api/3/action/
# CKAN_SITE_URL=https://www.datosabiertos.gob.ec/
# GOBEC_API_URL=https://www.gob.ec/api/v1/
# GOBEC_SITE_URL=https://www.gob.ec/
# SERCOP_API_URL=https://datosabiertos.compraspublicas.gob.ec/PLATAFORMA/api/
# SERCOP_SITE_URL=https://datosabiertos.compraspublicas.gob.ec/PLATAFORMA/
# CUENCA_API_URL=https://cuencaendatos.cuenca.gob.ec/api/3/action/
# CUENCA_SITE_URL=https://cuencaendatos.cuenca.gob.ec/

# Opt-in: allow one insecure TLS retry for the open-data portal, only if
# its cert breaks again (it was expired 2026-07-28, renewed 2026-08-07).
# CKAN_INSECURE_TLS=1