Configuration

The server reads a single YAML file at startup, validated by Pydantic. All fields have sensible defaults — a minimal file only needs storage.backend.

Set the path with the CONFIG_FILE environment variable (default: configs/opentremor-core-local.yaml).

Looking for a specific field or env var?

This page is just enough to get running. See Full Reference for every field, or Environment Variables for the override list.

---

Get started fast

The absolute minimum — zero config, in-memory, nothing to install:

storage:
  backend: memory

That’s a complete, valid config file. Auth is disabled by default too, so there’s genuinely nothing else to set up — see Quick Start to go from here to your first analysis in a few commands.

Pick the setup closest to yours:

Local dev (in-memory)

storage:
  backend: memory

No database, no auth, no secrets. Data is lost on restart — see In-Memory Backend.

Production (MongoDB)

storage:
  backend: mongodb
  mongodb:
    uri: "mongodb://mcp_app:secret@mongo:27017/mcp_analyzer?authSource=mcp_analyzer"
    database: mcp_analyzer

cors:
  allow_origins: ["https://dashboard.example.com"]

auth:
  api_key: "my-strong-api-key"

Plus JWT_SECRET and LLM_CREDENTIAL_KEY set via environment variable — see the production checklist below. Once the server is up, set public_base_url (and anything else under Platform settings) with one call:

curl -X PATCH https://mcp-analyzer.example.com/admin/settings \
  -H "X-API-Key: my-strong-api-key" -H "Content-Type: application/json" \
  -d '{"server_public_base_url": "https://mcp-analyzer.example.com"}'

+ GitHub App

Everything from “Production” above, plus one more PATCH /admin/settings call after first boot — github isn’t part of the config file at all (same reasoning as public_base_url above):

curl -X PATCH https://mcp-analyzer.example.com/admin/settings \
  -H "X-API-Key: my-strong-api-key" -H "Content-Type: application/json" \
  -d '{
    "github_app_id": "123456",
    "github_private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEow...\n-----END RSA PRIVATE KEY-----",
    "github_webhook_secret": "whsec_..."
  }'

Then per org: POST /orgs/{org_id}/integrations/github with the installation_id obtained by installing the App via GitHub’s UI. See GitHub App integration.

This step is optional even if you want GitHub integration on the deployment — it’s only the platform’s own App, shared by orgs that don’t register their own. An org can instead click “Create GitHub App” in the dashboard (or POST /orgs/{org_id}/integrations/github/manifest) to register a custom App for itself, with no platform-level setup at all beyond public_base_url. See GitHub App Integration — your own App.

---

Production checklist

Everything below is optional in dev (random defaults, or the feature is simply disabled) but must be set explicitly — and shared across every replica — once you’re running more than one process or care about surviving a restart:

Set this	Via	Why
storage.mongodb.uri	MONGODB_URI env var (don’t put credentials in the YAML)	Without it there’s no persistence at all (backend: memory)
jwt.secret	JWT_SECRET env var	Left as the random per-process default, every restart invalidates all logged-in sessions, and replicas can’t validate each other’s sessions
llm.credential_encryption_key	LLM_CREDENTIAL_KEY env var	Left as the random default, stored LLM credentials become unreadable across restarts/replicas
auth.api_key	YAML (or omit and use human registration instead)	Left null, the server is wide open — anyone gets owner of the default org
server.public_base_url	PATCH /admin/settings (not YAML — see Platform settings)	Report links and the GitHub manifest flow otherwise fall back to request headers, or 501
github.app_id/private_key/webhook_secret	PATCH /admin/settings (not YAML/env — same reason as above)	Only needed if you’re using the platform’s own GitHub App integration — otherwise leave unset

See Environment Variables for the complete list.