.env.mcp.example

# Firetower MCP test server — environment configuration (do not commit real values)
# Used by the dedicated test-only MCP image. GET /health is unauthenticated for
# service probes; the /mcp transport requires OAuth.

# Hop 1: Google OAuth client (Workspace-gated to sentry.io)
MCP_GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
MCP_GOOGLE_CLIENT_SECRET=your-client-secret
# Public base URL of the MCP server (same origin serves the OAuth endpoints).
MCP_BASE_URL=https://mcp-test.firetower.getsentry.net
# Google's upstream OAuth client has exactly one callback:
# https://mcp-test.firetower.getsentry.net/auth/callback. The callbacks below are
# downstream MCP-client callbacks handled by FastMCP, not Google callbacks.
#
# This allowlist is REQUIRED. Native MCP clients, including pi and Claude Code,
# use loopback callbacks with ephemeral ports. Hosted Claude callbacks are trusted
# explicitly. Never leave this unrestricted: FastMCP 3.4.1 accepts unsafe schemes
# and non-loopback HTTP callbacks when allowed_client_redirect_uris is None.
MCP_ALLOWED_REDIRECT_URIS=https://claude.ai/api/mcp/auth_callback,https://claude.com/api/mcp/auth_callback,http://localhost:*,http://127.0.0.1:*

# Hop 2: service identity used to read firetower (sees non-private incidents only)
FIRETOWER_SERVICE_ACCOUNT=firetower-mcp@your-project.iam.gserviceaccount.com

# Dedicated required secret used to sign FastMCP JWTs.
MCP_JWT_SIGNING_KEY=your-signing-key

# Optional
FIRETOWER_URL=
MCP_HOST=0.0.0.0
PORT=8080

# MULTI-INSTANCE / AUTOSCALING CONSTRAINT
# FastMCP's default client_storage is a per-instance encrypted FILE store. Under
# Cloud Run autoscaling, OAuth state (client registrations + encrypted tokens)
# issued by one instance will NOT resolve on another, causing intermittent auth
# failures (failed token exchanges/refreshes) as requests land on different
# instances. To run more than one instance safely, configure a SHARED client_storage
# backend (e.g. Redis/GCS-backed AsyncKeyValue) and set MCP_JWT_SIGNING_KEY so every
# instance signs/verifies with the same key. Until then, pin the service to a single
# instance (min=max=1).