.env.example

# Couchbase MCP Server — environment template
#
# Copy this file to .env and fill in real values for local development:
#   cp .env.example .env
#
# Production deployments should set these via the container orchestrator
# (Docker Compose, Kubernetes secrets, Smithery config) rather than committing
# a populated .env. The .gitignore is configured to exclude .env so you can't
# accidentally commit credentials.

# ── Connection (required) ─────────────────────────────────────────────────────
# Use couchbase:// for plain, couchbases:// for TLS (Capella always TLS)
CB_CONNECTION_STRING=couchbase://localhost

# Username/password auth (most common). Leave blank if using mTLS below.
CB_USERNAME=Administrator
CB_PASSWORD=

# Default bucket / scope / collection for the data-plane tools (cb_get, cb_query, etc.)
CB_BUCKET=travel-sample
CB_SCOPE=_default
CB_COLLECTION=_default

# ── mTLS (optional — instead of password auth) ────────────────────────────────
# When BOTH are set, the server uses CertificateAuthenticator instead of password auth.
# CB_CLIENT_CERT_PATH=/etc/couchbase/client.pem
# CB_CLIENT_KEY_PATH=/etc/couchbase/client.key

# CA certificate for self-signed clusters (leave blank for Capella / public CAs)
# CB_CA_CERT_PATH=/etc/couchbase/ca.pem

# Disable TLS hostname verification — DEVELOPMENT ONLY, never production
# CB_MCP_TLS_INSECURE=false

# ── Management REST port override (optional) ──────────────────────────────────
# Default is 8091 for plain, 18091 for TLS. Override only when the cluster
# uses non-standard ports.
# CB_MGMT_PORT=

# ── Safety knobs ──────────────────────────────────────────────────────────────
# When true (default), write tools are not loaded — they don't appear in tool discovery.
CB_MCP_READ_ONLY_MODE=true

# Comma-separated tool names to exclude, or a path to a file with one name per line.
# Example: CB_MCP_DISABLED_TOOLS=admin_bucket_delete,admin_node_failover_hard
CB_MCP_DISABLED_TOOLS=

# Additional tools that should require `confirm: true` (on top of the destructive defaults).
CB_MCP_CONFIRMATION_REQUIRED_TOOLS=

# Include hint text in confirmation-required error responses so the LLM knows
# how to recover.
CB_MCP_ELICITATION_HINTS=true

# ── Transport ─────────────────────────────────────────────────────────────────
# stdio (default), http, streamable_http
CB_MCP_TRANSPORT=stdio

# HTTP transport binding (only used when CB_MCP_TRANSPORT=http)
CB_MCP_HOST=127.0.0.1
CB_MCP_PORT=8000

# ── Networking ────────────────────────────────────────────────────────────────
# Retries and timeout for the admin REST client
CB_MCP_HTTP_RETRIES=3
CB_MCP_HTTP_TIMEOUT=30

# ── Capella v4 (only needed for capella_* tools) ──────────────────────────────
# CAPELLA_API_KEY=
# CAPELLA_SECRET_KEY=
# CAPELLA_BASE_URL=https://cloudapi.cloud.couchbase.com