Compose reads .env next to compose.yaml. Copy platform.env to .env, set MCP_DOMAIN, and change other options only
when you need to. Passwords, keys and certificates inside the platform are generated on the first start and kept in Docker
volumes. They do not belong in .env. After a change, run docker compose up -d.
| Option |
Default |
Description |
MCP_DOMAIN |
none, required |
The name users type in the browser and in their AI client, in lower case. The certificate in certs/tls.crt must name it. |
MCP_ADMIN_USERNAME |
mcp-admin |
The first platform administrator (group mcp-platform-admin). Its initial password is generated: docker compose run --rm init show admin-password. |
MCP_CERTS_DIR |
./certs |
Directory with tls.crt, tls.key and, if needed, company-ca.crt. |
MCP_HTTPS_PORT |
443 |
The https port that nginx publishes. |
MCP_HTTP_PORT |
80 |
The http port that nginx publishes. It redirects to https. |
MCP_BIND |
0.0.0.0 |
The address on which nginx publishes both ports. Use 127.0.0.1 for a local test. |
MCP_PUBLIC_ORIGIN |
https://<MCP_DOMAIN> |
Set only when the https port is not 443: https://<domain>:<port>. It is the origin users see. Without it, the addresses the platform hands out and the redirect from port 80 drop the port. |
MCP_CLAUDE_CODE_CALLBACK_PORT |
33418 |
The port Claude Code listens on for the sign-in callback. The portal shows it in the command it gives to users. |
MCP_SERVER_TRUSTED_CAS_FILE |
empty |
A PEM file on the host with CAs that sign the certificates of MCP servers on other hosts. The gateway trusts them in addition to public CAs and certs/company-ca.crt. A server whose certificate chains to one of them, for the host name of its address, is trusted as ca and its renewals need no approval. Other servers are pinned by fingerprint. |
MCP_GATEWAY_VERSION |
2.0.1 |
Version of the gateway image. |
MCP_BROKER_VERSION |
2.0.0 |
Version of the credential broker image. |
MCP_PORTAL_VERSION |
2.0.1 |
Version of the portal image. |
MCP_REGISTRY |
ghcr.io/aiwcorpo |
Registry with mcp-gateway, mcp-credential-broker, mcp-portal and the MCP servers. |
MCP_THIRD_PARTY_REGISTRY |
empty (Docker Hub and quay.io) |
Registry with postgres, redis, nginx, eclipse-temurin, keycloak and openbao under their plain names. |
PULL_POLICY |
missing |
Compose pull policy. Use never when the images are loaded by hand. |
GATEWAY_MEM_LIMIT |
2g |
Memory limit of the gateway. |
BROKER_MEM_LIMIT |
1g |
Memory limit of the broker. |
PORTAL_MEM_LIMIT |
1g |
Memory limit of the portal. |
KEYCLOAK_MEM_LIMIT |
2g |
Memory limit of Keycloak. |
| Variable |
Use |
COMPOSE_PROJECT_NAME |
Changes the project name, and with it the prefix of volumes and networks (default mcp-platform). Used in Install locally. |
COMPOSE_FILE |
Adds files, for example compose.yaml:servers.yaml for a server in the same Docker or compose.yaml:compose.offline.yaml for offline installs. On Windows the separator is ;. |
COMPOSE_PROFILES |
Enables profiles. stub starts the stub backend of the test stack. |
| File |
Use |
certs/ |
The certificate, key and company CA. After renewing the certificate, run docker compose up -d and then docker compose restart nginx. |
nginx/keycloak-admin-allow.conf |
Networks that may open the Keycloak consoles (default allow all;). Run docker compose restart nginx after a change. |
keycloak/realm-mcp.json |
The realm. It is imported only when the realm does not exist. Later changes do not reach an existing realm: make them in the Keycloak console. |
servers.yaml (from servers.example.yaml) |
An MCP server that runs in the platform’s own Docker. |
The bundle sets the options of the gateway, broker, portal and Keycloak in compose.yaml, from the values above. The bundle
does not expose the rest. The standalone installs of the components document all of their options in the deploy/
directory of each repository:
The names there (MCP_* for the gateway and broker, PORTAL_* for the portal) are the same as in the environment: blocks of
compose.yaml. To set an option the bundle does not expose, add it to a compose.override.yaml next to compose.yaml. Compose reads that file by itself only when COMPOSE_FILE is not set. Otherwise add it to COMPOSE_FILE.
