Jeder Wert der Laufzeitkonfiguration mit Beschreibung und Standardwert. Die Werte lassen sich im Cockpit, über die HTTP- und MCP-Einstellungs-APIs oder mit sk settings bearbeiten. Die Referenz unten wird aus der Konfiguration generiert und bleibt auf Englisch.
Every value below lives in canonical runtime configuration and is editable via
the Cockpit, HTTP/MCP settings APIs, sk settings configure, or sk settings set. Per-tenant
overrides go into the file's tenants section and only honor leaves
tagged scope=tenant.
Path resolution: tenant overlay → global value → schema default. Environment variables never set a runtime setting.
log #
Logging
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
log.format | enum("dev" | "pretty" | "prod" | "ndjson" | "json") | "ndjson" | global | no | no | Log output format |
log.level | enum("trace" | "debug" | "info" | "warn" | "error" | "fatal") | "info" | global | no | no | Log verbosity |
server #
HTTP server
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
server.hosted_rate_limit.global_per_minute | number | 0 | global | no | no | Operator request ceiling across hosted ingress per minute; zero denies hosted ingress |
server.hosted_rate_limit.peer_per_minute | number | 0 | global | no | no | Operator request ceiling per verified connection peer and minute; zero denies hosted ingress |
server.hosted_rate_limit.principal_per_minute | number | 0 | global | no | no | Operator request ceiling per authenticated principal and tenant per minute; zero denies hosted requests |
server.hosted_rate_limit.tenant_per_minute | number | 0 | global | no | no | Operator request ceiling per hosted tenant and minute; zero denies hosted requests |
server.hosted_rate_limit.tenant_per_month | number | 0 | global | no | no | Operator request allowance per hosted tenant and UTC calendar month; zero denies hosted requests |
server.port | number | 3000 | global | no | yes | HTTP port to bind (1..65535) |
server.public_base_url | string | "" | global | no | no | External-facing URL the engine resolves at. Used by /install, chat link replies, and OAuth2 redirect-URI synthesis. Required for any OAuth2 connector. |
server.restart_supervised | boolean | false | global | no | no | A supervisor (systemd with Restart=on-failure, Docker with a restart policy) starts the engine again after it ends. Enables POST /v1/system/restart (exit code 75). |
server.root_redirect_to_cockpit | boolean | false | global | no | no | Redirect a browser's GET / (Accept: text/html) to /cockpit with a non-cacheable temporary redirect. Other clients keep the Markdown entry point. Disabled by default. |
server.trusted_proxy_hops | number | 0 | global | no | no | Trusted reverse-proxy hops counted from the right of X-Forwarded-For; zero ignores forwarding headers. |
server.trusted_proxy_ips | array | [] | global | no | no | Exact trusted reverse-proxy socket peer IPs. Every configured forwarding hop must match; X-Real-IP is never trusted. |
database #
Database connection
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
database.connect_timeout_ms | number | 10000 | global | no | yes | Deadline for acquiring or establishing a PostgreSQL connection. |
database.idle_timeout_ms | number | 30000 | global | no | yes | Time before an unused pooled connection is closed. |
database.keepalive_delay_ms | number | 10000 | global | no | yes | Initial TCP keepalive delay for PostgreSQL connections. |
database.pool_max | number | 10 | global | no | yes | Maximum application connections per pool and replica. |
database.query_timeout_ms | number | 150000 | global | no | yes | Client-side PostgreSQL query deadline in milliseconds. |
database.statement_timeout_ms | number | 120000 | global | no | yes | Server-side PostgreSQL statement deadline, initialized on each session. |
database.url | string | — | global | yes | yes | Bootstrap-only Postgres connection string. Rotate DATABASE_URL and restart replicas; runtime revisions cannot change this binding. |
llm #
LLM configuration
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
llm.api_key | string | "" | tenant | yes | no | Primary LLM API key |
llm.context_1m | boolean | false | tenant | no | no | Enable 1M context window where supported |
llm.critic.enabled | boolean | false | tenant | no | no | Run the second-stage LLM critic on workflow drafts after every static gate passes |
llm.critic.max_consecutive_rejections | number | 3 | tenant | no | no | After this many consecutive critic_rejected results in a conversation, skip the critic to avoid an infinite re-author loop |
llm.critic.min_steps | number | 3 | tenant | no | no | Minimum step count for the critic to run on a draft (drift in recent drafts also triggers a run) |
llm.fallback_model | string | "" | tenant | no | no | Fallback model identifier |
llm.fallback_provider | enum("mock" | "anthropic" | "openai" | "gemini" | "azure" | "bedrock" | "vertex" | "ai_gateway") | null | tenant | no | no | Fallback provider on primary failure |
llm.hosted.enabled | boolean | false | global | no | no | Hosted paid-model service mode; requires tenant context independently of signup policy. |
llm.hosted.global_monthly_microunits | string | "0" | global | no | no | Operator-owned global monthly hosted budget in USD microunits; zero blocks paid calls. |
llm.hosted.models | json | [] | global | no | no | Exact provider:model allowlist with verified provider-enforced context maxima, including extended context, and maximum USD rates for every context tier. No paid native tools or multimodal inputs. |
llm.hosted.tenant_monthly_microunits | string | "0" | global | no | no | Operator-owned monthly hosted budget per tenant in USD microunits; zero blocks paid calls. |
llm.model | string | "" | tenant | no | no | Primary model identifier |
llm.output_guard | enum("soft" | "hard" | "off") | "soft" | global | no | no | LLM output safety mode (soft: rewrite + log, hard: throw, off: bypass — never use in production) |
llm.provider | enum("mock" | "anthropic" | "openai" | "gemini" | "azure" | "bedrock" | "vertex" | "ai_gateway") | "mock" | tenant | no | no | Primary LLM provider |
llm.providers.ai_gateway.api_key | string | "" | global | yes | no | |
llm.providers.ai_gateway.model | string | "" | global | no | no | |
llm.providers.anthropic.api_key | string | "" | tenant | yes | no | API key for this provider |
llm.providers.anthropic.base_url | string | "" | global | no | no | Optional base URL override |
llm.providers.anthropic.model | string | "" | tenant | no | no | Default model identifier |
llm.providers.azure.api_key | string | "" | tenant | yes | no | |
llm.providers.azure.api_version | string | "" | global | no | no | |
llm.providers.azure.base_url | string | "" | global | no | no | |
llm.providers.azure.model | string | "" | tenant | no | no | |
llm.providers.azure.resource_name | string | "" | global | no | no | |
llm.providers.azure.use_deployment_based_urls | boolean | false | global | no | no | |
llm.providers.bedrock.access_key_id | string | "" | global | yes | no | |
llm.providers.bedrock.base_url | string | "" | global | no | no | |
llm.providers.bedrock.model | string | "" | tenant | no | no | |
llm.providers.bedrock.region | string | "" | global | no | no | |
llm.providers.bedrock.secret_access_key | string | "" | global | yes | no | |
llm.providers.bedrock.session_token | string | "" | global | yes | no | |
llm.providers.gemini.api_key | string | "" | tenant | yes | no | API key for this provider |
llm.providers.gemini.base_url | string | "" | global | no | no | Optional base URL override |
llm.providers.gemini.model | string | "" | tenant | no | no | Default model identifier |
llm.providers.openai.api_key | string | "" | tenant | yes | no | API key for this provider |
llm.providers.openai.base_url | string | "" | global | no | no | Optional base URL override |
llm.providers.openai.model | string | "" | tenant | no | no | Default model identifier |
llm.providers.vertex.api_key | string | "" | tenant | yes | no | |
llm.providers.vertex.client_email | string | "" | global | no | no | |
llm.providers.vertex.google_application_credentials | string | "" | global | no | no | |
llm.providers.vertex.location | string | "" | global | no | no | |
llm.providers.vertex.model | string | "" | tenant | no | no | |
llm.providers.vertex.private_key | string | "" | global | yes | no | |
llm.providers.vertex.project | string | "" | global | no | no | |
llm.suggestion_model | string | "claude-haiku-4-5" | tenant | no | no | Small model used to generate post-turn suggestions |
llm.summarize_model | string | "" | tenant | no | no | Model used for summarization passes |
llm.summarize_provider | enum("mock" | "anthropic" | "openai" | "gemini" | "azure" | "bedrock" | "vertex" | "ai_gateway") | null | tenant | no | no | Provider used for summarization passes |
llm.web_search | boolean | true | tenant | no | no | Allow the assistant to use Anthropic-native server-side web search (billed per search; Anthropic models only). Toggle off per tenant via /settings. |
auth #
Authentication
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
auth.enable_signup | boolean | false | global | no | no | Compatibility fallback for self-hosted OIDC providers without signup_policy: allow first-time SSO member accounts. Explicit provider policies override it; hosted signup never uses it. |
auth.hosted.admission.mcp_clients_per_minute | number | 0 | global | no | no | Operator global hosted MCP dynamic-client registration ceiling per minute. |
auth.hosted.admission.mcp_clients_per_peer_per_minute | number | 0 | global | no | no | Operator hosted MCP dynamic-client registration ceiling per verified peer and minute. |
auth.hosted.admission.retained_mcp_clients | number | 0 | global | no | no | Operator ceiling for retained MCP client registrations, including retired and disabled clients; zero denies new clients. |
auth.hosted.admission.retained_tenants | number | 0 | global | no | no | Operator ceiling for retained self-service tenant records, including erased ownership tombstones; zero denies new tenants. |
auth.hosted.admission.tenant_creations_per_minute | number | 0 | global | no | no | Operator global ceiling for newly created self-service tenants per minute; idempotent callbacks do not consume it. |
auth.hosted.enabled | boolean | false | global | no | yes | Enable identity-first hosted browser authentication for explicitly opted-in providers. |
auth.hosted.registration_enabled | boolean | false | global | no | no | Allow new hosted identities to provision their own workspace. Existing members and reviewed invitation handoffs remain available while registration is closed. |
auth.mcp_oauth.access_token_ttl_seconds | number | 3600 | global | no | no | Lifetime in seconds for MCP OAuth access tokens. |
auth.mcp_oauth.authorization_code_ttl_seconds | number | 60 | global | no | no | Lifetime in seconds for MCP OAuth authorization codes. |
auth.mcp_oauth.dynamic_registration_enabled | boolean | true | global | no | no | Allow RFC 7591 dynamic client registration at POST /v1/oauth/register. |
auth.mcp_oauth.enabled | boolean | true | global | no | yes | Enable the MCP OAuth 2.1 authorization server (ChatGPT / Claude.ai / Cursor). |
auth.mcp_oauth.refresh_token_ttl_seconds | number | 2592000 | global | no | no | Lifetime in seconds for MCP OAuth refresh tokens (30 days). |
auth.mcp_oauth.scopes_supported | string[] | ["mcp:read","mcp:authoring","mcp:admin","metrics:read"] | global | no | no | OAuth scopes advertised in the authorization server metadata. Add, reorder and remove freely, except metrics:read: GET /metrics enforces it, so it is restored whenever a written value omits it. |
auth.providers | json | [{"protocol":"api_key","id":"api-key","label":"SubKit API key"}] | global | no | no | Authentication adapters: api_key, oidc (public browser client with PKCE, no secret) and oidc_bearer (an issuer's access token as bearer for one product, verified against its JWKS). |
auth.session.secret | string | "" | global | yes | yes | Session signing secret (auto-generated to a 32-byte hex value on first boot if empty); operator-supplied values must be at least 32 chars |
platform #
Chat platform integrations
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
platform.googlechat.audience | string | "" | global | no | yes | |
platform.googlechat.client_email | string | "" | global | no | yes | |
platform.googlechat.private_key | string | "" | global | yes | yes | |
platform.googlechat.project_id | string | "" | global | no | yes | |
platform.googlechat.sync_turn_timeout_ms | number | 25000 | global | no | no | Bounded wait for the inline synchronous Google Chat turn before falling back to detached async delivery (must stay under Google's ~30s sync window) |
platform.slack.client_id | string | "" | global | no | yes | |
platform.slack.client_secret | string | "" | global | yes | yes | |
platform.slack.signing_secret | string | "" | global | yes | yes | |
platform.teams.app_id | string | "" | global | no | yes | |
platform.teams.app_password | string | "" | global | yes | yes |
storage #
Object storage
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
storage.hosted.max_file_bytes | string | "0" | global | no | no | Operator-owned maximum declared bytes of each new hosted file; zero blocks file admission. |
storage.hosted.retained_rows_per_resource | number | 1000 | global | no | no | Operator-owned retained row ceiling, initially 1,000 for the Free offering, for each hosted resource table, including histories and soft-deleted rows; zero blocks resource creation. |
storage.hosted.tenant_bytes | string | "0" | global | no | no | Operator-owned shared logical byte quota for files, object reservations and all retained user content, including copies and revisions. Not a physical bucket or PostgreSQL disk quota. |
storage.object_store.access_key_id | string | "" | global | yes | no | |
storage.object_store.bucket | string | "" | global | no | no | |
storage.object_store.endpoint | string | "" | global | no | no | |
storage.object_store.force_path_style | boolean | true | global | no | no | |
storage.object_store.region | string | "us-east-1" | global | no | no | |
storage.object_store.secret_access_key | string | "" | global | yes | no | |
storage.object_store.session_token | string | "" | global | yes | no |
observability #
Observability
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
observability.analytics.api_key | string | "" | global | yes | no | API key for the analytics endpoint. |
observability.analytics.enabled | boolean | false | global | no | no | Enable product-analytics emission. Off by default — no external calls are made unless this is true and an endpoint is configured. |
observability.analytics.endpoint | string | "" | global | no | no | Self-hostable analytics ingest endpoint. Empty disables emission even when enabled=true. |
observability.analytics.project | string | "" | global | no | no | Project or workspace identifier on the analytics platform. |
observability.deployment_environment | string | "production" | global | no | no | Deployment identity used for the OpenTelemetry deployment.environment.name resource attribute. |
observability.field_truncation_chars | number | 2048 | global | no | no | Per-field cap (in characters / UTF-16 code units, not bytes) applied to structured log fields after redaction. |
observability.langfuse.host | string | "" | global | no | no | |
observability.langfuse.public_key | string | "" | global | no | no | |
observability.langfuse.secret_key | string | "" | global | yes | no | |
observability.otlp.endpoint | string | "" | global | no | no | |
observability.otlp.service_name | string | "subkit" | global | no | no | |
observability.predictive.connector_unhealthy_pct | number | 80 | global | no | no | Percent of recent connector calls returning a non-ok health verdict above which connector drift is flagged. |
observability.predictive.dlq_critical_depth | number | 5 | global | no | no | Standing dead-letter-queue depth at or above which DLQ accumulation is flagged critical (a worker-failure backlog, not a per-window delta). |
observability.predictive.llm_fallback_pct | number | 80 | global | no | no | Percent of LLM calls falling back to the secondary provider above which primary-provider degradation is flagged. |
observability.predictive.memory_cap_fraction | number | 0.9 | global | no | no | Fraction of the host memory cap the RSS high-water may reach before an OOM-risk warning. |
observability.predictive.pool_saturation_pct | number | 80 | global | no | no | Percent of the Postgres pool in use (or any waiting clients) above which saturation is flagged. |
observability.predictive.transient_retry_rate | number | 1 | global | no | no | Transient-DB-retries-per-minute above which a flapping Postgres is flagged. |
observability.usage.enabled | boolean | false | global | no | no | Persist privacy-safe, tenant-scoped product usage events locally. Disabled by default; requires hmac_secret when enabled. |
observability.usage.hmac_secret | string | "" | global | yes | no | Product-local HMAC secret for actor and session pseudonyms. Set at least 32 characters before enabling usage telemetry. |
observability.usage.retention_days | number | 90 | global | no | no | Raw usage-event retention in days; aggregate reports may outlive raw rows. |
egress #
Egress filter
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
egress.mode | enum("strict" | "permissive") | null | global | no | no | Egress mode: strict blocks private/loopback hosts, permissive allows them. Null falls back to NODE_ENV default. |
egress.provider_hosts_extra | string[] | [] | global | no | no | Extra hostnames counted as LLM providers for token accounting and per-run budgets. Does NOT affect the egress filter — adding a host makes calls to it metered, not permitted. |
mcp #
MCP transport
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
mcp.api_key | string | "" | global | yes | no | |
mcp.read_only | boolean | false | global | no | no |
errors #
Error ring buffer
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
errors.ring_size | number | 100 | global | no | yes |
spec #
Spec fetcher
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
spec.allow_private_fetch | boolean | false | global | no | no | Allow OpenAPI spec fetches from private/loopback hosts (test-only) |
queue #
Queue worker
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
queue.abort_poll_interval_ms | number | 500 | global | no | no | Hot-reloadable interval for workers to observe durable cross-replica execution cancellation requests. |
queue.concurrency | number | 1 | global | no | yes | Executions this replica runs at once. Raising it trades isolation for throughput. Restart required. |
queue.crash_recovery_sweep_interval_ms | number | 60000 | global | no | no | Hot-reloadable interval for reconciling executions orphaned by a worker or engine restart. |
queue.crash_recovery_threshold_ms | number | 0 | global | no | no | Hard age threshold for crash recovery. 0 uses each workflow timeout multiplied by its grace factor. |
queue.hosted.chat_concurrency | number | 0 | global | no | no | Operator ceiling for simultaneous hosted chat turns per tenant, including direct calls; zero denies work. |
queue.hosted.execution_concurrency | number | 0 | global | no | no | Operator ceiling for simultaneous hosted root executions per tenant; zero denies work. |
queue.hosted.pending_jobs | number | 0 | global | no | no | Operator ceiling for queued hosted execution and conversation jobs per tenant; zero denies queue admission. |
tokens #
Token budget
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
tokens.currency | string | "USD" | tenant | no | no | ISO 4217 code for tokens.prices. The built-in catalog is in USD and applies only while this is USD; otherwise only tokens.prices entries price anything. |
tokens.monthly_budget | number | 0 | tenant | no | no | Hard cap on tokens consumed per calendar month. 0 = unlimited. |
tokens.prices | json | [] | tenant | no | no | Per-model price overrides on top of the built-in catalog, per 1M tokens. An entry replaces its model's catalog price. A model with neither is reported as unpriced, not as zero. |
operations #
Startup operations
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
operations.seed_skills_at_boot | boolean | true | global | no | yes | Upsert embedded skill seeds for all tenants during startup |
operations.update_check_enabled | boolean | true | global | no | yes | Check for a newer engine release during startup |
sandbox #
QuickJS JS sandbox limits
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
sandbox.ipc_max_bytes | number | 33554432 | global | no | no | Maximum sandbox worker request or response size in bytes. Default 32 MB. |
sandbox.max_transform_wall_ms | number | 300000 | global | no | no | Operator ceiling for a transform step's wall-clock, in ms. A step timeout_ms above it runs with the ceiling and sandbox_limit_clamped_total counts the cut. Default 5 min. |
sandbox.memory_bytes | number | 134217728 | global | no | no | Hard WASM heap cap for a JS sandbox run, in bytes. Default 128 MB. |
sandbox.queue_limit | number | 32 | global | no | no | Maximum queued sandbox jobs across one worker lane. Default 32. |
sandbox.stack_bytes | number | 2097152 | global | no | no | Max stack size for a JS sandbox run, in bytes. Default 2 MB. |
sandbox.tenant_queue_limit | number | 8 | global | no | no | Maximum queued sandbox jobs for one tenant in one worker lane. Default 8. |
sandbox.tick_budget | number | 10000000 | global | no | no | Interrupt-tick budget (coarse runaway backstop, not an opcode count). |
sandbox.transform_wall_ms | number | 60000 | global | no | no | Wall-clock cap for transform steps, in ms (overridable per step via timeout_ms). Long synchronous transforms block the worker — chunk via for_each instead of raising. Default 60 s. |
sandbox.wall_ms | number | 30000 | global | no | no | Default wall-clock cap for a JS sandbox run, in ms. Default 30 s. |
sandbox.worker_rss_bytes | number | 536870912 | global | no | no | RSS threshold that recycles a sandbox worker after a job, in bytes. Default 512 MB. |
repl #
sk REPL session preferences
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
repl.permissionMode | enum("ask" | "auto" | "plan" | "yolo") | "auto" | tenant | no | no | Default REPL permission mode for the principal: ask, auto, plan, or yolo. |
repl.portalTokenTtlMin | number | 15 | tenant | no | no | TTL in minutes for portal tokens minted by the /session slash (1..1440). |
ui #
REPL chrome preferences
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
ui.personality | enum("concise" | "balanced" | "verbose") | "balanced" | tenant | no | no | Assistant response style: concise | balanced | verbose. |
ui.statusline.format | enum("minimal" | "compact" | "detailed") | "compact" | tenant | no | no | Status-line layout: minimal | compact | detailed. |
ui.theme | enum("auto" | "light" | "dark" | "high-contrast") | "auto" | tenant | no | no | REPL color theme: auto | light | dark | high-contrast. |
ui.title.format | enum("session-id" | "tenant-session" | "model-tenant-session") | "session-id" | tenant | no | no | Window-title format used by the sk REPL. |
notifications #
sk REPL notification preferences
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
notifications.inbox.retention_days | number | 30 | global | no | no | Days a notification inbox task survives before the retention sweep deletes it. |
notifications.push.enabled | boolean | false | tenant | no | no | OS push notifications for long-running execution completion. |
notifications.push.quietHoursEnd | string | "" | tenant | no | no | Quiet-hours window end (HH:MM, local TZ). Empty disables the window. |
notifications.push.quietHoursStart | string | "" | tenant | no | no | Quiet-hours window start (HH:MM, local TZ). Empty disables the window. |
notifications.push.thresholdSec | number | 30 | tenant | no | no | Minimum elapsed turn seconds before a notification fires. |
connectors #
Per-connector tunables. Each sub-section is owned by one connector template.
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
connectors.http.max_response_bytes | number | 104857600 | tenant | no | no | Max bytes read from a single HTTP/GraphQL connector response before it is rejected as response_too_large. OOM guard; generous default (100 MB). |
connectors.mcp.per_server_manifest_byte_cap | number | 30000 | tenant | no | no | Byte cap on one external MCP connector's serialized tool manifest; the heaviest tools are dropped first when exceeded |
connectors.mcp.remote_tool_call_timeout_ms | number | 30000 | tenant | no | no | Bounded timeout (ms) for one remote external MCP tools/call invocation |
connectors.mcp.tools_list_max_pages | number | 5 | tenant | no | no | Max tools/list pages followed per external MCP handshake; a server paginating past this keeps only the pages read |
connectors.web_scraper.authoring.extract_too_large_yellow_pct | number | 30 | tenant | no | no | Past-run extract_too_large ratio (over last 20 runs) above which the gate Yellows. |
connectors.web_scraper.authoring.red_sitemap_threshold | number | 100000 | tenant | no | no | Sitemap entry count above which analyze_scrape_target refuses (Red). |
connectors.web_scraper.authoring.yellow_sitemap_threshold | number | 10000 | tenant | no | no | Sitemap entry count above which analyze_scrape_target returns Yellow. |
connectors.web_scraper.optimization.min_runs_before_proposing | number | 3 | tenant | no | no | Minimum recent runs before any candidate is emitted. |
connectors.web_scraper.optimization.sample_size | number | 10 | tenant | no | no | Number of recent runs the analyzer reads per recipe. |
connectors.web_scraper.optimization.scan_cron | string | "0 3 * * *" | global | no | no | Crontab for the per-tenant optimization scan (default daily 03:00). |
connectors.web_scraper.optimization.trivial_markdown_bytes | number | 512 | tenant | no | no | Pages whose MarkdownOutput.bytes is below this count as trivial. |
connectors.web_scraper.robots_cache.max_entries | number | 2000 | global | no | no | LRU ceiling shared across tenants (keyed by tenant_id + origin). |
connectors.web_scraper.robots_cache.ttl_ms | number | 3600000 | global | no | no | TTL for the per-tenant robots.txt LRU. |
connectors.web_scraper.runtime.default_wait_ms | number | 0 | tenant | no | no | Floor for between-page wait inside the crawl loop. Raised if robots.txt declares a higher Crawl-delay. |
connectors.web_scraper.runtime.max_chars_markdown | number | 100000 | tenant | no | no | Per-page markdown output cap (extract_too_large). |
connectors.web_scraper.runtime.max_chars_readability | number | 100000 | tenant | no | no | Per-page input cap into Readability (extract_too_large). |
connectors.web_scraper.runtime.max_pages | number | 1000 | tenant | no | no | Per-run crawl cap. Hard ceiling 10 000 (crawl_max_pages_exceeded). |
connectors.web_scraper.runtime.respect_robots | boolean | true | tenant | no | no | Skip URLs that robots.txt disallows for the configured User-Agent. |
connectors.web_scraper.runtime.user_agent | string | "" | tenant | no | no | User-Agent header on every fetch; passed to robots-parser matching. Empty means sk-web-scraper/<version> (+<server.public_base_url>/bot), or the project URL when no public base URL is set. |
products #
Product settings keyed by product_id for product principals (oidc_bearer providers)
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
products | json | — | global | no | no | Product settings keyed by product_id for product principals (oidc_bearer providers) |
Authentication providers #
auth.providers is one atomic, validated runtime setting available through Cockpit, HTTP, MCP, sk settings, and the canonical config file. Records use protocol: api_key or oidc; one API-key adapter and multiple named direct OIDC adapters may coexist. Provider ids must be unique, and every OIDC callback is /v1/identity/login/callback on server.public_base_url. A successful write is active for subsequent browser-login requests without an engine restart.
OIDC records are public clients using Authorization Code with PKCE. Runtime configuration intentionally has no client_secret field and rejects one if supplied; use an issuer that supports public clients with token_endpoint_auth_method=none. The environment is not an auth-provider source.
Configured labels are diagnostic metadata only. The common mcp-auth surface derives its two user actions from protocol and always presents Continue with SSO before Continue with API key. Discovery exposes the canonical labels SSO and API key; no provider-specific route or parallel configuration tree is accepted.