Environment Variables

All configuration options for OpenSRE can be set via environment variables. This page provides a complete reference.

Secret storage

Environment variables are checked first. Credentials you enter through opensre onboard for LLM setup, or through opensre integrations setup for tools, are written to .env and to an owner-only file at ~/.opensre/credentials.json (mode 0600). OpenSRE does not write secrets to the OS keychain. A value in the process environment or a local .env file wins over the credentials file. Keep .env out of source control. Want credentials only from the environment, never on disk? Set OPENSRE_DISABLE_KEYRING=1 and export everything yourself.

LLM providers

Variable	Default	Description
`LLM_PROVIDER`	`anthropic`	Which LLM backend to use — see LLM providers
`LLM_MAX_TOKENS`	`4096`	Max tokens for LLM responses
`OPENSRE_LLM_TRANSPORT`	`sdk`	`sdk` (native SDKs) or `litellm`
`OPENSRE_LLM_NATIVE_STRUCTURED_OUTPUT`		Opt-in provider-native structured outputs (`1`/`true`)

Anthropic

Variable	Default	Description
`ANTHROPIC_API_KEY`		API key for Anthropic
`ANTHROPIC_REASONING_MODEL`		Model for reasoning tasks
`ANTHROPIC_TOOLCALL_MODEL`		Model for tool calling

OpenAI

Variable	Default	Description
`OPENAI_API_KEY`		API key for OpenAI
`OPENAI_REASONING_MODEL`		Model for reasoning tasks
`OPENAI_TOOLCALL_MODEL`		Model for tool calling

OpenRouter

Variable	Default	Description
`OPENROUTER_API_KEY`		API key for OpenRouter
`OPENROUTER_MODEL`		Shared model for all tasks
`OPENROUTER_REASONING_MODEL`		Override model for reasoning
`OPENROUTER_TOOLCALL_MODEL`		Override model for tool calling

TrustedRouter

Variable	Default	Description
`TRUSTEDROUTER_API_KEY`		API key for TrustedRouter
`TRUSTEDROUTER_MODEL`		Shared model for all tasks
`TRUSTEDROUTER_REASONING_MODEL`		Override model for reasoning
`TRUSTEDROUTER_TOOLCALL_MODEL`		Override model for tool calling

DeepSeek

Variable	Default	Description
`DEEPSEEK_API_KEY`		API key for DeepSeek
`DEEPSEEK_MODEL`		Shared model for all tasks
`DEEPSEEK_REASONING_MODEL`		Override model for reasoning
`DEEPSEEK_TOOLCALL_MODEL`		Override model for tool calling

Google Gemini

Variable	Default	Description
`GEMINI_API_KEY`		API key for Google Gemini
`GEMINI_MODEL`		Shared model for all tasks
`GEMINI_REASONING_MODEL`		Override model for reasoning
`GEMINI_TOOLCALL_MODEL`		Override model for tool calling

NVIDIA

Variable	Default	Description
`NVIDIA_API_KEY`		API key for NVIDIA NIM
`NVIDIA_MODEL`		Shared model for all tasks
`NVIDIA_REASONING_MODEL`		Override model for reasoning
`NVIDIA_TOOLCALL_MODEL`		Override model for tool calling

MiniMax

Variable	Default	Description
`MINIMAX_API_KEY`		API key for MiniMax
`MINIMAX_MODEL`		Shared model for all tasks
`MINIMAX_REASONING_MODEL`		Override model for reasoning
`MINIMAX_TOOLCALL_MODEL`		Override model for tool calling

Groq

Variable	Default	Description
`GROQ_API_KEY`		API key for Groq
`GROQ_MODEL`		Shared model for all tasks
`GROQ_REASONING_MODEL`		Override model for reasoning
`GROQ_TOOLCALL_MODEL`		Override model for tool calling

Azure OpenAI

Variable	Default	Description
`AZURE_OPENAI_BASE_URL`		Azure OpenAI resource URL (`https://<resource>.openai.azure.com`)
`AZURE_OPENAI_API_KEY`		API key for Azure OpenAI
`AZURE_OPENAI_API_VERSION`	`2024-10-21`	Azure OpenAI API version
`AZURE_OPENAI_MODEL`		Shared deployment name for all slots
`AZURE_OPENAI_REASONING_MODEL`	`gpt-5.4-mini`	Deployment for reasoning tasks
`AZURE_OPENAI_CLASSIFICATION_MODEL`	`gpt-5.4-mini`	Deployment for classification
`AZURE_OPENAI_TOOLCALL_MODEL`	`gpt-5.4-mini`	Deployment for tool calling

Amazon Bedrock

Variable	Default	Description
`BEDROCK_REASONING_MODEL`		Model for reasoning tasks
`BEDROCK_TOOLCALL_MODEL`		Model for tool calling
`BEDROCK_CLASSIFICATION_MODEL`	`us.anthropic.claude-sonnet-4-6`	Model for classification

Google Vertex AI

Variable	Default	Description
`VERTEX_AI_PROJECT`		GCP project ID (required for Vertex)
`VERTEX_AI_LOCATION`	`us`	Vertex AI US multi-region; use a model-supported location
`VERTEX_AI_REASONING_MODEL`	`gemini-3.8-flash`	Model for reasoning
`VERTEX_AI_TOOLCALL_MODEL`	`gemini-3.5-flash-lite`	Model for tool calling
`VERTEX_AI_CLASSIFICATION_MODEL`	`gemini-3.8-flash`	Model for classification
`VERTEX_AI_MODEL`		Shared model override for all slots

Ollama (Local)

Variable	Default	Description
`OLLAMA_MODEL`	`llama3.2`	Model name in Ollama
`OLLAMA_HOST`	`http://localhost:11434`	Ollama server URL

LLM Reasoning Effort

Variable	Default	Description
`OPENSRE_REASONING_EFFORT`		Effort for extended-thinking models: `low`, `medium`, `high`, or `xhigh`. Unset keeps the provider default, except GPT-6.1 Sol on the native OpenAI SDK and Codex, which sends `xhigh` (extra high)

CLI providers

Codex

Variable	Default	Description
`CODEX_BIN`		Path to Codex CLI binary
`CODEX_MODEL`		Model override for Codex

Claude Code

Variable	Default	Description
`CLAUDE_CODE_BIN`		Path to Claude Code CLI binary
`CLAUDE_CODE_MODEL`		Model override for Claude Code

Gemini CLI

Variable	Default	Description
`GEMINI_CLI_BIN`		Path to Gemini CLI binary
`GEMINI_CLI_MODEL`		Model override for Gemini CLI

Antigravity

Variable	Default	Description
`ANTIGRAVITY_CLI_BIN`		Path to Antigravity CLI binary
`ANTIGRAVITY_CLI_MODEL`		Model override for Antigravity
`ANTIGRAVITY_CLI_TIMEOUT_SECONDS`		Timeout for Antigravity CLI invocations

OpenCode

Variable	Default	Description
`OPENCODE_BIN`		Path to OpenCode CLI binary
`OPENCODE_MODEL`		Model override for OpenCode

Cursor

Variable	Default	Description
`CURSOR_BIN`		Path to Cursor CLI binary
`CURSOR_MODEL`		Model override for Cursor

Kimi

Variable	Default	Description
`KIMI_BIN`		Path to Kimi CLI binary
`KIMI_MODEL`		Model override for Kimi
`KIMI_API_KEY`		API key for Kimi

GitHub Copilot

Variable	Default	Description
`COPILOT_BIN`		Path to GitHub Copilot CLI binary
`COPILOT_MODEL`		Model override for Copilot
`COPILOT_HOME`		Copilot config directory override
`COPILOT_GITHUB_TOKEN`		GitHub token for Copilot auth

Grok / xAI

Variable	Default	Description
`GROK_CLI_BIN`		Path to Grok Build CLI binary
`GROK_CLI_MODEL`		Model override for Grok Build CLI
`XAI_API_KEY`		API-key auth for Grok Build CLI
`XAI_BASE_URL`		Override xAI API base URL
`GROK_CLI_TIMEOUT_SECONDS`	`300`	Timeout for Grok CLI invocations

Variable	Default	Description
`PI_BIN`		Path to Pi CLI binary
`PI_MODEL`		Model override for Pi CLI (`provider/model`)
`PI_AGENT_DIR`		Pi agent config directory override
`PI_CONFIG_DIR`		Pi config directory override

Custom endpoints

Variable	Default	Description
`CUSTOM_OPENAI_BASE_URL`		Base URL for an OpenAI-compatible gateway
`CUSTOM_OPENAI_API_KEY`		API key for `custom-openai`
`CUSTOM_OPENAI_MODEL`		Shared model for all `custom-openai` roles
`CUSTOM_OPENAI_TOOLCALL_MODEL`		Optional toolcall-model override
`CUSTOM_ANTHROPIC_BASE_URL`		Base URL for an Anthropic-compatible gateway
`CUSTOM_ANTHROPIC_API_KEY`		API key for `custom-anthropic`
`CUSTOM_ANTHROPIC_MODEL`		Shared model for all `custom-anthropic` roles

Output & Debugging

Variable	Default	Description
`TRACER_VERBOSE`	`0`	Verbose OpenSRE CLI/UI output (`1`, `true`, `yes`)
`TRACER_OUTPUT_FORMAT`		OpenSRE result output format
`TRACER_API_URL`		Base URL for the tracer observability integration / report delivery
`NO_COLOR`		Disable colored output (standard convention)
`COLUMNS`	`80`	Terminal column width for output formatting
`ENV`	`development`	Environment (`development`, `production`)

Credentials and authentication

For secrets (*_TOKEN, *_KEY, *_PASSWORD, *_SECRET, and similar), OpenSRE looks in this order:

Your process environment
The owner-only file ~/.opensre/credentials.json

opensre onboard saves LLM credentials there so they still work after you clear .env. Not stored as secrets: webhook-style URLs such as SLACK_WEBHOOK_URL and ROCKETCHAT_WEBHOOK_URL. Those stay in env / store only — treat them as secrets and don’t log them. Want credentials only from the environment, never on disk? Set OPENSRE_DISABLE_KEYRING=1 and export everything yourself.

Variable	Default	Description
`OPENSRE_DISABLE_KEYRING`	`0`	Disable local credential storage; credentials must come from the environment
`OPENSRE_ACCOUNT_TOKEN`		Personal OpenSRE account token; with `OPENSRE_DISABLE_KEYRING=1`, also set `OPENSRE_APP_URL`
`OPENSRE_APP_URL`	`https://app.opensre.com`	OpenSRE app origin; set it explicitly with an environment-only account token
`OPENSRE_ACCOUNT_LLM_MODEL`	`gpt-6.1-sol`	Model-family hint for a non-interactive hosted gateway using the account LLM route; override only when the web app’s hosted model changes family
`OPENSRE_LLM_AUTH_METADATA_PATH`	`~/.opensre/llm-auth.json`	Non-secret LLM auth metadata path used by prompt-safe status checks

Telemetry & Monitoring

Variable	Default	Description
`OPENSRE_NO_TELEMETRY`	`0`	Disable all telemetry, including Sentry and product analytics (covers `$ai_generation` prompt/response events)
`OPENSRE_ANALYTICS_DISABLED`	`0`	Disable product analytics only
`OPENSRE_SENTRY_DISABLED`	`0`	Disable Sentry error reporting
`OPENSRE_SENTRY_DSN`		Override Sentry DSN
`OPENSRE_SENTRY_LOGGING_DISABLED`	`0`	Disable Sentry log integration
`OPENSRE_DEPLOYMENT_METHOD`	`local`	Sentry deployment tag: railway, ec2, vercel, or local
`OPENSRE_PROMPT_LOG_DISABLED`	`0`	Disable prompt logging entirely
`OPENSRE_PROMPT_LOG_LOCAL_DISABLED`	`0`	Disable local prompt log file
`OPENSRE_PROMPT_LOG_REDACT`	`1`	Redact known token shapes from prompts/responses before local or PostHog logging
`OPENSRE_PROMPT_LOG_PATH`	`~/.opensre/prompt_log.jsonl`	Path to local prompt log file
`OPENSRE_OPERATIONS_LOG_DISABLED`	`0`	Disable the local operations log
`OPENSRE_OPERATIONS_LOG_PATH`	`~/.opensre/operations_log.jsonl`	Path to the local operations log
`OPENSRE_OPERATIONS_LOG_MAX_BYTES`	`5242880`	Rotate the local operations log after this many bytes
`DO_NOT_TRACK`	`0`	Honor global do-not-track preference
`SENTRY_TRACES_SAMPLE_RATE`	`1.0`	Trace sampling rate for Sentry
`SENTRY_ERROR_SAMPLE_RATE`	`1.0`	Error sampling rate for Sentry

Paths & Directories

Variable	Default	Description
`OPENSRE_HOME`	`~/.opensre`	Host root for scheduler files, gateway state, local configuration, and sessions when no organization context root is set
`OPENSRE_PROJECT_ENV_PATH`	`PROJECT_ROOT/.env`	Path to project-level `.env` file
`OPENSRE_WIZARD_STORE_PATH`	`~/.opensre/opensre.json`	Path to the local wizard/provider selection store
`OPENSRE_CONTEXT_ROOT`		Mounted organization-scoped root for context and sessions; requires `ORGANIZATION_ID`
`OPENSRE_INTEGRATIONS_STORE_PATH`		Override integrations store path

Conversation history

Variable	Default	Description
`OPENSRE_HISTORY_TOKEN_BUDGET`	`48000`	Estimated tokens of conversation history before it is compacted
`OPENSRE_TOOL_OUTPUT_TOKEN_LIMIT`	`10000`	Approximate tokens per tool observation; output keeps its beginning and end, using four UTF-8 bytes per token
`OPENSRE_HISTORY_TOOL_RESULT_CHARS`		Optional additional character cap for recorded tool results; unset keeps the tool observation budget with 20% extra space
`OPENSRE_LLM_COMPACTION`	`1`	Set to `0` to compact history without a model-written summary
`OPENSRE_STRUCTURED_HISTORY`	`1`	Set to `0` to send earlier turns as one text block instead of replaying them

Memory

Variable	Default	Description
`OPENSRE_MEMORY_DISABLED`	`0`	Disable long-term memory
`OPENSRE_MEMORY_DIR`		Override memory storage directory
`OPENSRE_MEMORY_AUTOEXTRACT_DISABLED`	`0`	Disable automatic memory extraction and background upkeep
`OPENSRE_MEMORY_GATEWAY_ENABLED`	`0`	Opt-in memory on shared gateway hosts

Remote sync

Mirror conversation history and memory to a user-owned object store. Details: Remote sync.

Variable	Default	Description
`OPENSRE_REMOTE_SYNC`		Enable remote sync (`1`/`true`)
`OPENSRE_REMOTE_SYNC_PROVIDER`	`aws`	Store backend (`aws`, `gcs`, `vercel`, `azure`, or `s3compat`)
`OPENSRE_REMOTE_SYNC_BUCKET`		Bucket / Blob store name (required when sync is on)
`OPENSRE_REMOTE_SYNC_PREFIX`	`opensre`	Key prefix inside the store
`OPENSRE_REMOTE_SYNC_REGION`		Region override
`OPENSRE_REMOTE_SYNC_PROFILE`		Named credentials profile
`OPENSRE_REMOTE_SYNC_ENDPOINT_URL`		Custom S3 endpoint when provider is `s3compat`
`OPENSRE_REMOTE_SYNC_EXCLUDE`		Comma-separated globs to exclude from sync
`OPENSRE_REMOTE_SYNC_EXCLUDE_OFF`		Ignore configured exclusions for one run
`BLOB_READ_WRITE_TOKEN`		Vercel Blob token (when provider is `vercel`)

Masking

Variable	Default	Description
`OPENSRE_MASK_ENABLED`	`false`	Enable reversible identifier masking before external LLM calls
`OPENSRE_MASK_KINDS`		Comma-separated mask kinds to enable
`OPENSRE_MASK_EXTRA_REGEX`		JSON map of extra mask kinds to regex patterns

Feature Flags

Variable	Default	Description
`OSRE_HELM_INTEGRATION`		Enable Helm integration (1/true/yes)
`HELM_PATH`	`helm`	Path to the Helm binary
`HELM_KUBE_CONTEXT`		kubectl context for Helm
`HELM_KUBECONFIG`		kubeconfig path for Helm
`HELM_NAMESPACE`		Default Helm namespace
`OPENSRE_RELEASES_API_URL`	GitHub releases API	Override releases API endpoint

Gateway and scheduler runtime

Variable	Default	Description
`MODE`	`web`	Container entrypoint: `web`, `gateway`, or `scheduler`
`PORT`	`8000`	HTTP port for the web surface
`OPENSRE_HOME`	`~/.opensre`	Host root for scheduler files, gateway state, local configuration, and sessions when `OPENSRE_CONTEXT_ROOT` is unset
`DATABASE_URL`		Postgres connection for gateway records shared across replicas; required for Slack Events API unless the single-replica local-dedup escape hatch is enabled
`OPENSRE_SIZE_PROFILE`	`SMALL`	Deployment size profile; default turn caps are `SMALL=1`, `MEDIUM=2`, `LARGE=4`
`OPENSRE_MAX_CONCURRENT_TURNS`	size-profile limit	Override the process-wide concurrent-turn cap with a positive integer
`OPENSRE_SCHEDULER_MAX_CONCURRENT_RUNS`	`2`	Maximum scheduled callbacks executing at once; agent turns also need a process-wide turn permit
`OPENSRE_GATEWAY_HOST_SCHEDULER`	`1`	Run the scheduler inside the gateway; set `0` when a dedicated `MODE=scheduler` service owns it
`OPENSRE_SESSION_FILE_LOCK`	`0`	Serialize session-file writes with an OS lock; a shared mount is still required across processes

Integration credentials

Observability & Monitoring

Variable	Default	Description
`GRAFANA_INSTANCE_URL`		Grafana instance URL
`GRAFANA_READ_TOKEN`		Grafana API token
`GRAFANA_LOKI_DATASOURCE_UID`		UID of Loki datasource in Grafana
`GRAFANA_TEMPO_DATASOURCE_UID`		UID of Tempo datasource in Grafana
`GRAFANA_MIMIR_DATASOURCE_UID`		UID of Mimir datasource in Grafana
`TEMPO_URL`		Grafana Tempo / Tempo API base URL
`TEMPO_API_KEY`		Tempo API key (or use username/password)
`TEMPO_USERNAME`		Tempo basic-auth username
`TEMPO_PASSWORD`		Tempo basic-auth password
`TEMPO_ORG_ID`		Tempo org ID (multi-tenant)
`GRAFANA_VERIFY_SSL`	`true`	Verify Grafana SSL certificate
`GRAFANA_CA_BUNDLE`		Path to a CA bundle for Grafana TLS verification (self-signed/internal CA)
`DD_API_KEY`		Datadog API key
`DD_APP_KEY`		Datadog application key
`DD_SITE`	`datadoghq.com`	Datadog site (us/eu)
`GROUNDCOVER_API_KEY`		groundcover read-only service-account token (alias: `GROUNDCOVER_MCP_TOKEN`)
`GROUNDCOVER_MCP_URL`	`https://mcp.groundcover.com/api/mcp`	groundcover MCP endpoint
`GROUNDCOVER_TENANT_UUID`		Tenant UUID (multi-workspace accounts)
`GROUNDCOVER_BACKEND_ID`		Backend ID (multi-backend tenants)
`GROUNDCOVER_TIMEZONE`	`UTC`	Timezone for returned timestamps (`X-Timezone`)
`HONEYCOMB_API_KEY`		Honeycomb API key
`HONEYCOMB_DATASET`	`__all__`	Honeycomb dataset slug
`HONEYCOMB_API_URL`	`https://api.honeycomb.io`	Honeycomb API endpoint
`CORALOGIX_API_KEY`		Coralogix API key
`CORALOGIX_API_URL`	`https://api.coralogix.com`	Coralogix API endpoint
`CORALOGIX_APPLICATION_NAME`		Application name in Coralogix
`CORALOGIX_SUBSYSTEM_NAME`		Subsystem name in Coralogix
`SIGNOZ_URL`		SigNoz instance URL
`SIGNOZ_API_KEY`		SigNoz API key
`ALERTMANAGER_URL`		Alertmanager URL
`ALERTMANAGER_BEARER_TOKEN`		Bearer token for Alertmanager
`ALERTMANAGER_USERNAME`		Username for Alertmanager basic auth
`ALERTMANAGER_PASSWORD`		Password for Alertmanager basic auth
`SPLUNK_URL`		Splunk instance URL
`SPLUNK_TOKEN`		Splunk API token
`SPLUNK_INDEX`	`main`	Splunk index
`SPLUNK_VERIFY_SSL`	`true`	Verify Splunk SSL certificate
`SPLUNK_CA_BUNDLE`		Path to a CA bundle for Splunk TLS verification
`SENTRY_URL`	`https://sentry.io`	Sentry instance URL
`SENTRY_ORG_SLUG`		Sentry organization slug
`SENTRY_PROJECT_SLUG`		Sentry project slug
`SENTRY_AUTH_TOKEN`		Sentry auth token
`POSTHOG_PROJECT_ID`		PostHog project ID
`POSTHOG_PERSONAL_API_KEY`		PostHog personal API key
`POSTHOG_BASE_URL`	`https://us.posthog.com`	PostHog app URL (`https://eu.posthog.com` for EU)
`POSTHOG_TIMEOUT_SECONDS`	`15.0`	Timeout in seconds for PostHog API requests
`NEW_RELIC_API_KEY`		New Relic User key (`NRAK-...`)
`NEW_RELIC_ACCOUNT_ID`		New Relic account ID
`NEW_RELIC_API_URL`	`https://api.newrelic.com`	New Relic API URL (EU/JP endpoints supported)

Cloud Platforms

Variable	Default	Description
`AWS_REGION`	`us-east-1`	AWS region
`AWS_ROLE_ARN`		AWS role ARN for cross-account access
`AWS_EXTERNAL_ID`		External ID for AWS cross-account role
`AWS_ACCESS_KEY_ID`		AWS access key
`AWS_SECRET_ACCESS_KEY`		AWS secret access key
`AWS_SESSION_TOKEN`		AWS session token
`CLOUD_PROVIDER`		Cloud provider hint for ambient region discovery
`CLOUD_REGION`		Cloud region (falls back to `AWS_REGION`)
`KUBECONFIG`		Path to kubeconfig file
`KUBECONFIG_CONTENT`		Inline kubeconfig contents
`KUBECONFIG_CONTEXT`		kubectl context
`KUBECONFIG_NAMESPACE`	`default`	Default Kubernetes namespace
`RDS_DB_INSTANCE_IDENTIFIER`		AWS RDS DB instance identifier
`RDS_REGION`		AWS region for RDS (falls back to `AWS_REGION`)
`RAILWAY_TOKEN`		Railway API token
`RAILWAY_PROJECT`		Railway project
`RAILWAY_SERVICE`		Railway service
`RAILWAY_ENVIRONMENT`	`production`	Railway environment
`RAILWAY_PATH`	`railway`	Path to Railway CLI
`ARGOCD_BASE_URL`		Argo CD API base URL
`ARGOCD_AUTH_TOKEN`		Argo CD auth token
`ARGOCD_TOKEN`		Alias for `ARGOCD_AUTH_TOKEN`
`ARGOCD_USERNAME`		Argo CD username (basic auth)
`ARGOCD_PASSWORD`		Argo CD password (basic auth)
`ARGOCD_PROJECT`		Argo CD project
`ARGOCD_APP_NAMESPACE`		Argo CD app namespace
`ARGOCD_VERIFY_SSL`	`true`	Verify Argo CD TLS

Messaging

Variable	Default	Description
`SLACK_WEBHOOK_URL`		Slack incoming webhook URL
`SLACK_BOT_TOKEN`		Slack bot token
`SLACK_DEFAULT_CHAT_ID`		Default Slack channel for scheduled delivery (bot-token path)
`SLACK_APP_TOKEN`		Slack app-level token (Socket Mode)
`SLACK_GATEWAY_INBOUND_TRANSPORT`	`socket_mode`	How Slack delivers events: `socket_mode` or `events_api_http`
`SLACK_SIGNING_SECRET`		Request-signature secret. Required for `events_api_http`
`SLACK_GATEWAY_HTTP_PORT`	`3000`	Port the `events_api_http` listener binds
`SLACK_GATEWAY_ALLOW_LOCAL_DEDUP`		Accept process-local event dedup when `DATABASE_URL` is unset. Single replica only
`SLACK_GATEWAY_MAX_CONCURRENT`	size-profile limit	Parallel Slack turns before the process-wide cap is applied
`SLACK_ALLOWED_USERS`		Comma-separated Slack user IDs allowed to talk to the bot
`SLACK_ALLOW_OPEN_WORKSPACE`		Allow any workspace user (`1` for dogfood)
`SLACK_ACCESS_TOKEN`		Slack user token
`SLACK_GITHUB_ISSUES_WEBHOOK_URL`		Slack webhook for GitHub issues
`DISCORD_BOT_TOKEN`		Discord bot token
`DISCORD_APPLICATION_ID`		Discord application ID
`DISCORD_PUBLIC_KEY`		Discord public key
`DISCORD_DEFAULT_CHANNEL_ID`		Default Discord channel
`DISCORD_ALLOWED_USERS`		Comma-separated Discord user IDs allowed to talk to the bot
`DISCORD_ALLOW_OPEN_GUILD`		Allow any guild member (`1` for dogfood)
`DISCORD_GATEWAY_MAX_CONCURRENT`	size-profile limit	Parallel Discord turns before the process-wide cap is applied
`TELEGRAM_BOT_TOKEN`		Telegram bot token
`TELEGRAM_DEFAULT_CHAT_ID`		Default Telegram chat ID
`TELEGRAM_ALLOWED_USERS`		Comma-separated Telegram user IDs allowed to talk to the bot
`TELEGRAM_GATEWAY_MAX_CONCURRENT`	size-profile limit	Parallel Telegram turns before the process-wide cap is applied
`BUZZ_PRIVATE_KEY`		Nostr private key used by the Buzz integration and gateway
`BUZZ_RELAY_URL`	`http://localhost:3000`	Buzz relay URL
`BUZZ_DEFAULT_CHANNEL`		Default Buzz channel UUID for delivery
`BUZZ_AUTH_TAG`		Optional NIP-OA owner-attestation JSON
`BUZZ_PATH`	`buzz`	Path to the Buzz CLI
`BUZZ_ALLOWED_PUBKEYS`		Comma-separated 64-character hex pubkeys allowed to talk to the gateway
`BUZZ_GATEWAY_MAX_CONCURRENT`	`4`	Parallel Buzz turns before the process-wide cap is applied
`ROCKETCHAT_SERVER_URL`		Rocket.Chat server base URL
`ROCKETCHAT_AUTH_TOKEN`		Rocket.Chat personal access token
`ROCKETCHAT_USER_ID`		Rocket.Chat user ID for the token
`ROCKETCHAT_DEFAULT_CHANNEL`		Default Rocket.Chat channel
`ROCKETCHAT_WEBHOOK_URL`		Rocket.Chat incoming webhook URL
`TWILIO_ACCOUNT_SID`		Twilio account SID
`TWILIO_AUTH_TOKEN`		Twilio auth token
`TWILIO_WHATSAPP_FROM`		WhatsApp sender number (Twilio)
`WHATSAPP_DEFAULT_TO`		Default WhatsApp recipient
`TWILIO_SMS_FROM`		SMS sender number (Twilio)
`TWILIO_SMS_MESSAGING_SERVICE_SID`		SMS messaging service SID
`TWILIO_SMS_DEFAULT_TO`		Default SMS recipient
`SMTP_HOST`		SMTP server hostname
`SMTP_PORT`	`587`	SMTP port
`SMTP_SECURITY`	`starttls`	SMTP security (`starttls`, `ssl`, or `none`)
`SMTP_USERNAME`		SMTP username
`SMTP_PASSWORD`		SMTP password
`SMTP_FROM_ADDRESS`		From address for outbound mail
`SMTP_DEFAULT_TO`		Default recipient for notifications

Code & Collaboration

Variable	Default	Description
`GITHUB_MCP_MODE`	`streamable-http`	GitHub MCP transport mode
`GITHUB_MCP_URL`		GitHub MCP server URL
`GITHUB_MCP_COMMAND`		GitHub MCP command to execute
`GITHUB_MCP_ARGS`		GitHub MCP command arguments
`GITHUB_MCP_AUTH_TOKEN`		Does not authorize agent GitHub tools
`GITHUB_MCP_TOOLSETS`	`repos,issues,pull_requests,actions,search`	Enabled GitHub MCP toolsets
`OPENSRE_GITHUB_MCP_REPO_PROBE_LIMIT`	`50`	Max repos to probe (5-500)
`GITLAB_BASE_URL`		GitLab instance URL
`GITLAB_ACCESS_TOKEN`		GitLab personal access token
`GITLAB_PROJECT_ID`		GitLab project ID
`JIRA_BASE_URL`		Jira instance URL
`JIRA_EMAIL`		Jira user email
`JIRA_API_TOKEN`		Jira API token
`JIRA_PROJECT_KEY`		Default Jira project key
`BITBUCKET_WORKSPACE`		Bitbucket workspace name
`BITBUCKET_USERNAME`		Bitbucket username
`BITBUCKET_APP_PASSWORD`		Bitbucket app password
`BITBUCKET_MAX_RESULTS`	`25`	Max results per API call
`INCIDENT_IO_BASE_URL`		incident.io API URL
`INCIDENT_IO_API_KEY`		incident.io API key
`PAGERDUTY_API_KEY`		PagerDuty API key
`PAGERDUTY_BASE_URL`		PagerDuty API base URL
`SERVICENOW_INSTANCE_URL`		ServiceNow instance URL
`SERVICENOW_USERNAME`		ServiceNow username
`SERVICENOW_PASSWORD`		ServiceNow password
`VERCEL_API_TOKEN`		Vercel API token
`VERCEL_TEAM_ID`		Vercel team ID
`VERCEL_RUNTIME_LOGS_READ_TIMEOUT`	`600`	Seconds to wait per Vercel runtime-log read (minimum `30`)
`GOOGLE_CREDENTIALS_FILE`		Path to Google service-account JSON for Docs export
`GOOGLE_DRIVE_FOLDER_ID`		Google Drive folder for Docs export

Databases

Variable	Default	Description
`MONGODB_CONNECTION_STRING`		MongoDB connection string
`MONGODB_DATABASE`		MongoDB database name
`MONGODB_AUTH_SOURCE`	`admin`	MongoDB auth source
`MONGODB_TLS`	`true`	Enable MongoDB TLS
`MONGODB_ATLAS_PUBLIC_KEY`		MongoDB Atlas public API key
`MONGODB_ATLAS_PRIVATE_KEY`		MongoDB Atlas private API key
`MONGODB_ATLAS_PROJECT_ID`		MongoDB Atlas project ID
`MONGODB_ATLAS_BASE_URL`	`https://cloud.mongodb.com/api/atlas/v2`	MongoDB Atlas API base URL
`REDIS_HOST`		Redis host
`REDIS_PORT`	`6379`	Redis port
`REDIS_USERNAME`		Redis ACL username (Redis 6+)
`REDIS_PASSWORD`		Redis password
`REDIS_DATABASE`	`0`	Redis database number
`REDIS_SSL`	`false`	Connect using TLS
`POSTGRESQL_HOST`		PostgreSQL host
`POSTGRESQL_PORT`	`5432`	PostgreSQL port
`POSTGRESQL_DATABASE`		PostgreSQL database name
`POSTGRESQL_USERNAME`	`postgres`	PostgreSQL username
`POSTGRESQL_PASSWORD`		PostgreSQL password
`POSTGRESQL_SSL_MODE`	`prefer`	PostgreSQL SSL mode
`MYSQL_HOST`		MySQL host
`MYSQL_PORT`	`3306`	MySQL port
`MYSQL_DATABASE`		MySQL database name
`MYSQL_USERNAME`	`root`	MySQL username
`MYSQL_PASSWORD`		MySQL password
`MYSQL_SSL_MODE`	`preferred`	MySQL SSL mode
`MARIADB_HOST`		MariaDB host
`MARIADB_PORT`	`3306`	MariaDB port
`MARIADB_DATABASE`		MariaDB database name
`MARIADB_USERNAME`		MariaDB username
`MARIADB_PASSWORD`		MariaDB password
`MARIADB_SSL`	`true`	Enable MariaDB SSL

Message Queues & Other Services

Variable	Default	Description
`RABBITMQ_HOST`		RabbitMQ host
`RABBITMQ_MANAGEMENT_PORT`	`15672`	RabbitMQ management port
`RABBITMQ_USERNAME`		RabbitMQ username
`RABBITMQ_PASSWORD`		RabbitMQ password
`RABBITMQ_VHOST`	`/`	RabbitMQ vhost
`RABBITMQ_SSL`	`false`	Enable RabbitMQ SSL
`RABBITMQ_VERIFY_SSL`	`true`	Verify RabbitMQ SSL certificate
`BETTERSTACK_QUERY_ENDPOINT`		Better Stack query endpoint
`BETTERSTACK_USERNAME`		Better Stack username
`BETTERSTACK_PASSWORD`		Better Stack password
`BETTERSTACK_SOURCES`		Better Stack sources
`KAFKA_BOOTSTRAP_SERVERS`		Kafka broker addresses
`KAFKA_SECURITY_PROTOCOL`	`PLAINTEXT`	Kafka security protocol
`KAFKA_SASL_MECHANISM`		Kafka SASL mechanism
`KAFKA_SASL_USERNAME`		Kafka SASL username
`KAFKA_SASL_PASSWORD`		Kafka SASL password
`DAGSTER_ENDPOINT`		Dagster GraphQL endpoint
`DAGSTER_API_TOKEN`		Dagster Cloud User Token (leave empty for unauthenticated local OSS)
`TEMPORAL_API_URL`		Temporal Cloud / server API URL
`TEMPORAL_NAMESPACE`	`default`	Temporal namespace
`TEMPORAL_API_KEY`		Temporal API key (optional for local)
`JENKINS_URL`		Jenkins base URL
`JENKINS_USER`		Jenkins username
`JENKINS_API_TOKEN`		Jenkins API token

Data & Search

Variable	Default	Description
`OPENSEARCH_URL`		OpenSearch instance URL
`OPENSEARCH_USERNAME`		OpenSearch username
`OPENSEARCH_PASSWORD`		OpenSearch password
`OPENSEARCH_API_KEY`		OpenSearch API key (alternative to username/password)
`OPENSEARCH_INDEX_PATTERN`	`*`	OpenSearch index pattern
`OPENSEARCH_MAX_RESULTS`	`100`	Max OpenSearch results
`OPENOBSERVE_URL`		OpenObserve instance URL
`OPENOBSERVE_TOKEN`		OpenObserve API token
`OPENOBSERVE_USERNAME`		OpenObserve username
`OPENOBSERVE_PASSWORD`		OpenObserve password
`OPENOBSERVE_ORG`	`default`	OpenObserve organization
`OPENOBSERVE_STREAM`		OpenObserve stream
`OPENOBSERVE_MAX_RESULTS`	`100`	Max OpenObserve results
`VICTORIA_LOGS_URL`		VictoriaLogs instance URL
`VICTORIA_LOGS_TENANT_ID`		VictoriaLogs tenant ID
`CLICKHOUSE_HOST`		ClickHouse host
`CLICKHOUSE_PORT`	`8123`	ClickHouse port
`CLICKHOUSE_DATABASE`	`default`	ClickHouse database
`CLICKHOUSE_USER`	`default`	ClickHouse username
`CLICKHOUSE_PASSWORD`		ClickHouse password
`CLICKHOUSE_SECURE`	`false`	Enable ClickHouse TLS
`SNOWFLAKE_ACCOUNT_IDENTIFIER`		Snowflake account identifier
`SNOWFLAKE_ACCOUNT`		Snowflake account (alternative)
`SNOWFLAKE_TOKEN`		Snowflake token
`SNOWFLAKE_USER`		Snowflake username
`SNOWFLAKE_PASSWORD`		Snowflake password
`SNOWFLAKE_WAREHOUSE`		Snowflake warehouse
`SNOWFLAKE_ROLE`		Snowflake role
`SNOWFLAKE_DATABASE`		Snowflake database
`SNOWFLAKE_SCHEMA`		Snowflake schema
`SNOWFLAKE_MAX_RESULTS`	`50`	Max Snowflake results
`AZURE_SQL_SERVER`		Azure SQL server name
`AZURE_SQL_DATABASE`		Azure SQL database name
`AZURE_SQL_PORT`	`1433`	Azure SQL port
`AZURE_SQL_USERNAME`		Azure SQL username
`AZURE_SQL_PASSWORD`		Azure SQL password
`AZURE_SQL_DRIVER`	`ODBC Driver 18 for SQL Server`	Azure SQL ODBC driver
`AZURE_SQL_ENCRYPT`	`true`	Enable Azure SQL encryption
`AZURE_LOG_ANALYTICS_WORKSPACE_ID`		Azure Log Analytics workspace ID
`AZURE_LOG_ANALYTICS_TOKEN`		Azure Log Analytics token
`AZURE_LOG_ANALYTICS_ENDPOINT`	`https://api.loganalytics.io`	Log Analytics Query API endpoint (sovereign clouds)
`AZURE_TENANT_ID`		Azure tenant ID
`AZURE_SUBSCRIPTION_ID`		Azure subscription ID
`AZURE_MAX_RESULTS`	`100`	Max Azure results

MCP Servers

Variable	Default	Description
`POSTHOG_MCP_MODE`	`streamable-http`	PostHog MCP transport mode
`POSTHOG_MCP_URL`	`https://mcp.posthog.com/mcp`	PostHog MCP URL
`POSTHOG_MCP_AUTH_TOKEN`		PostHog MCP auth token
`POSTHOG_MCP_PROJECT_ID`		PostHog project scoped to MCP
`POSTHOG_MCP_ORGANIZATION_ID`		PostHog organization scoped to MCP
`POSTHOG_MCP_FEATURES`		Comma-separated PostHog MCP features
`POSTHOG_MCP_READ_ONLY`	`true`	Restrict PostHog MCP to read-only
`POSTHOG_MCP_COMMAND`		PostHog MCP stdio command
`POSTHOG_MCP_ARGS`		PostHog MCP stdio args
`SENTRY_MCP_MODE`	`streamable-http`	Sentry MCP transport mode
`SENTRY_MCP_URL`	`https://mcp.sentry.dev/mcp`	Sentry MCP URL
`SENTRY_MCP_AUTH_TOKEN`		Sentry MCP auth token
`SENTRY_MCP_HOST`		Self-hosted Sentry MCP host
`SENTRY_MCP_ORGANIZATION_SLUG`		Sentry org slug for MCP
`SENTRY_MCP_PROJECT_SLUG`		Sentry project slug for MCP
`SENTRY_MCP_SKILLS`		Enabled Sentry MCP skills
`SENTRY_MCP_COMMAND`		Sentry MCP stdio command
`SENTRY_MCP_ARGS`		Sentry MCP stdio args

Git Integrations

Variable	Default	Description
`GITHUB_EVENT_PATH`		GitHub Actions event payload path
`GITHUB_REPOSITORY`		GitHub repository (owner/repo)
`GITHUB_TOKEN`		Does not authorize agent GitHub tools; connect GitHub in the OpenSRE app
`GH_TOKEN`		Does not authorize agent GitHub tools

Multi-instance integrations

Need more than one Datadog, Grafana, or AWS account (for example prod and staging)? Use a JSON *_INSTANCES variable:

Variable	What it configures
`GRAFANA_INSTANCES`	Multiple Grafana instances
`DD_INSTANCES`	Multiple Datadog sites/accounts
`GROUNDCOVER_INSTANCES`	Multiple groundcover instances
`HONEYCOMB_INSTANCES`	Multiple Honeycomb instances
`CORALOGIX_INSTANCES`	Multiple Coralogix instances
`SPLUNK_INSTANCES`	Multiple Splunk instances
`AWS_INSTANCES`	Multiple AWS accounts
`ARGOCD_INSTANCES`	Multiple Argo CD instances

Format and examples: Multi-instance integrations.

LLM classification models

If you don’t set these, OpenSRE falls back to the reasoning model (or the provider default):

Variable	Default	Description
`ANTHROPIC_CLASSIFICATION_MODEL`		Anthropic classification model
`OPENAI_CLASSIFICATION_MODEL`		OpenAI classification model
`OPENROUTER_CLASSIFICATION_MODEL`		OpenRouter classification model
`TRUSTEDROUTER_CLASSIFICATION_MODEL`		TrustedRouter classification model
`DEEPSEEK_CLASSIFICATION_MODEL`		DeepSeek classification model
`GEMINI_CLASSIFICATION_MODEL`		Gemini classification model
`NVIDIA_CLASSIFICATION_MODEL`		NVIDIA classification model
`MINIMAX_CLASSIFICATION_MODEL`		MiniMax classification model
`GROQ_CLASSIFICATION_MODEL`		Groq classification model

Welcome

Get started

CI/CD

Using the shell

Guides

Run it anywhere

Platform

Integrations

Community

Secret storage

LLM providers

LLM Reasoning Effort

CLI providers

Output & Debugging

Credentials and authentication

Telemetry & Monitoring

Paths & Directories

Conversation history

Memory

Remote sync

Masking

Feature Flags

Gateway and scheduler runtime

Integration credentials

Multi-instance integrations

LLM classification models

​Secret storage

​LLM providers

​LLM Reasoning Effort

​CLI providers

​Output & Debugging

​Credentials and authentication

​Telemetry & Monitoring

​Paths & Directories

​Conversation history

​Memory

​Remote sync

​Masking

​Feature Flags

​Gateway and scheduler runtime

​Integration credentials

​Multi-instance integrations

​LLM classification models

Secret storage

LLM providers

LLM Reasoning Effort

CLI providers

Output & Debugging

Credentials and authentication

Telemetry & Monitoring

Paths & Directories

Conversation history

Memory

Remote sync

Masking

Feature Flags

Gateway and scheduler runtime

Integration credentials

Multi-instance integrations

LLM classification models