.env.example

# LMS MCP Server — Environment Variables
# Copy to mcp-server/.env and fill in. Runs separately from the Next.js app.
#
# Auth model: Supabase OAuth 2.1 (oauthSupabaseProvider). Clients authenticate
# against Supabase; this server verifies the JWTs and runs queries AS the user
# so Postgres RLS enforces tenant isolation. Tenant/role come from the LMS
# custom_access_token_hook claims (tenant_id, tenant_role).

# --- Supabase OAuth (verifying the caller's token) ---
# Hosted: set PROJECT_ID (derives https://<id>.supabase.co)
MCP_USE_OAUTH_SUPABASE_PROJECT_ID=
# Local / self-hosted override (e.g. `supabase start`): wins over PROJECT_ID
# MCP_USE_OAUTH_SUPABASE_URL=http://localhost:54321
# Publishable key (Dashboard → Project Settings → API Keys). Used by the
# consent UI and by request-scoped clients.
MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY=
# Legacy HS256 projects only (new projects use ES256 + JWKS — leave unset):
# MCP_USE_OAUTH_SUPABASE_JWT_SECRET=

# --- Fallbacks (reused if the MCP_USE_* vars above are absent) ---
SUPABASE_URL=
SUPABASE_ANON_KEY=

# --- Audit logging (optional) ---
# Service-role key — bypasses RLS, used ONLY to write mcp_audit_log rows.
# Omit to disable audit logging.
SUPABASE_SERVICE_ROLE_KEY=

# --- Server ---
# Public base URL of THIS server (used for OAuth discovery + widget URLs).
# Standalone/local: http://localhost:3000
# Behind the Next.js proxy (production): the PUBLIC proxied base, e.g.
#   https://yourdomain.com/api/mcp
# (The Next.js app's own MCP_SERVER_URL env is different — it points at this
# server's INTERNAL address, e.g. http://127.0.0.1:3001.)
MCP_SERVER_URL=http://localhost:3000
# PORT=3000
# Bind address — mcp-use defaults to "localhost", which is loopback-only.
# In Docker/production set 0.0.0.0 (the Dockerfile already does).
# HOST=0.0.0.0

# Dev only — register the lms_demo_* widget preview tools and drop OAuth so the
# inspector can render every widget from src/demo-data.ts with no DB and no
# login. Ignored when NODE_ENV=production. See docs/WIDGET_DEMO_DATA.md.
MCP_DEMO_WIDGETS=0