Every value below lives in canonical runtime configuration and is editable via
the Cockpit, HTTP/MCP settings APIs, sk settings configure, or sk settings set. Per-tenant
overrides go into the file's tenants section and only honor leaves
tagged scope=tenant.
Path resolution: tenant overlay → global value → schema default. Environment variables never set a runtime setting.
log #
Logging
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
log.format | enum("dev" | "pretty" | "prod" | "ndjson" | "json") | "ndjson" | global | no | no | Log output format |
log.level | enum("trace" | "debug" | "info" | "warn" | "error" | "fatal") | "info" | global | no | no | Log verbosity |
server #
HTTP server
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
server.hosted_rate_limit.global_per_minute | number | 0 | global | no | no | Operator request ceiling across hosted ingress per minute; zero denies hosted ingress |
server.hosted_rate_limit.peer_per_minute | number | 0 | global | no | no | Operator request ceiling per verified connection peer and minute; zero denies hosted ingress |
server.hosted_rate_limit.principal_per_minute | number | 0 | global | no | no | Operator request ceiling per authenticated principal and tenant per minute; zero denies hosted requests |
server.hosted_rate_limit.tenant_per_minute | number | 0 | global | no | no | Operator request ceiling per hosted tenant and minute; zero denies hosted requests |
server.hosted_rate_limit.tenant_per_month | number | 0 | global | no | no | Operator request allowance per hosted tenant and UTC calendar month; zero denies hosted requests |
server.port | number | 3000 | global | no | yes | HTTP port to bind (1..65535) |
server.public_base_url | string | "" | global | no | no | External-facing URL the engine resolves at. Used by /install, chat link replies, and OAuth2 redirect-URI synthesis. Required for any OAuth2 connector. |
server.restart_supervised | boolean | false | global | no | no | A supervisor (systemd with Restart=on-failure, Docker with a restart policy) starts the engine again after it ends. Enables POST /v1/system/restart (exit code 75). |
server.root_redirect_to_cockpit | boolean | false | global | no | no | Redirect a browser's GET / (Accept: text/html) to /cockpit with a non-cacheable temporary redirect. Other clients keep the Markdown entry point. Disabled by default. |
server.trusted_proxy_hops | number | 0 | global | no | no | Trusted reverse-proxy hops counted from the right of X-Forwarded-For; zero ignores forwarding headers. |
server.trusted_proxy_ips | array | [] | global | no | no | Exact trusted reverse-proxy socket peer IPs. Every configured forwarding hop must match; X-Real-IP is never trusted. |
database #
Database connection
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
database.connect_timeout_ms | number | 10000 | global | no | yes | Deadline for acquiring or establishing a PostgreSQL connection. |
database.idle_timeout_ms | number | 30000 | global | no | yes | Time before an unused pooled connection is closed. |
database.keepalive_delay_ms | number | 10000 | global | no | yes | Initial TCP keepalive delay for PostgreSQL connections. |
database.pool_max | number | 10 | global | no | yes | Maximum application connections per pool and replica. |
database.query_timeout_ms | number | 150000 | global | no | yes | Client-side PostgreSQL query deadline in milliseconds. |
database.statement_timeout_ms | number | 120000 | global | no | yes | Server-side PostgreSQL statement deadline, initialized on each session. |
database.url | string | — | global | yes | yes | Bootstrap-only Postgres connection string. Rotate DATABASE_URL and restart replicas; runtime revisions cannot change this binding. |
llm #
LLM configuration
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
llm.api_key | string | "" | tenant | yes | no | Primary LLM API key |
llm.context_1m | boolean | false | tenant | no | no | Enable 1M context window where supported |
llm.critic.enabled | boolean | false | tenant | no | no | Run the second-stage LLM critic on workflow drafts after every static gate passes |
llm.critic.max_consecutive_rejections | number | 3 | tenant | no | no | After this many consecutive critic_rejected results in a conversation, skip the critic to avoid an infinite re-author loop |
llm.critic.min_steps | number | 3 | tenant | no | no | Minimum step count for the critic to run on a draft (drift in recent drafts also triggers a run) |
llm.fallback_model | string | "" | tenant | no | no | Fallback model identifier |
llm.fallback_provider | enum("mock" | "anthropic" | "openai" | "gemini" | "azure" | "bedrock" | "vertex" | "ai_gateway") | null | tenant | no | no | Fallback provider on primary failure |
llm.hosted.enabled | boolean | false | global | no | no | Hosted paid-model service mode; requires tenant context independently of signup policy. |
llm.hosted.global_monthly_microunits | string | "0" | global | no | no | Operator-owned global monthly hosted budget in USD microunits; zero blocks paid calls. |
llm.hosted.models | json | [] | global | no | no | Exact provider:model allowlist with verified provider-enforced context maxima, including extended context, and maximum USD rates for every context tier. No paid native tools or multimodal inputs. |
llm.hosted.tenant_monthly_microunits | string | "0" | global | no | no | Operator-owned monthly hosted budget per tenant in USD microunits; zero blocks paid calls. |
llm.model | string | "" | tenant | no | no | Primary model identifier |
llm.output_guard | enum("soft" | "hard" | "off") | "soft" | global | no | no | LLM output safety mode (soft: rewrite + log, hard: throw, off: bypass — never use in production) |
llm.provider | enum("mock" | "anthropic" | "openai" | "gemini" | "azure" | "bedrock" | "vertex" | "ai_gateway") | "mock" | tenant | no | no | Primary LLM provider |
llm.providers.ai_gateway.api_key | string | "" | global | yes | no | |
llm.providers.ai_gateway.model | string | "" | global | no | no | |
llm.providers.anthropic.api_key | string | "" | tenant | yes | no | API key for this provider |
llm.providers.anthropic.base_url | string | "" | global | no | no | Optional base URL override |
llm.providers.anthropic.model | string | "" | tenant | no | no | Default model identifier |
llm.providers.azure.api_key | string | "" | tenant | yes | no | |
llm.providers.azure.api_version | string | "" | global | no | no | |
llm.providers.azure.base_url | string | "" | global | no | no | |
llm.providers.azure.model | string | "" | tenant | no | no | |
llm.providers.azure.resource_name | string | "" | global | no | no | |
llm.providers.azure.use_deployment_based_urls | boolean | false | global | no | no | |
llm.providers.bedrock.access_key_id | string | "" | global | yes | no | |
llm.providers.bedrock.base_url | string | "" | global | no | no | |
llm.providers.bedrock.model | string | "" | tenant | no | no | |
llm.providers.bedrock.region | string | "" | global | no | no | |
llm.providers.bedrock.secret_access_key | string | "" | global | yes | no | |
llm.providers.bedrock.session_token | string | "" | global | yes | no | |
llm.providers.gemini.api_key | string | "" | tenant | yes | no | API key for this provider |
llm.providers.gemini.base_url | string | "" | global | no | no | Optional base URL override |
llm.providers.gemini.model | string | "" | tenant | no | no | Default model identifier |
llm.providers.openai.api_key | string | "" | tenant | yes | no | API key for this provider |
llm.providers.openai.base_url | string | "" | global | no | no | Optional base URL override |
llm.providers.openai.model | string | "" | tenant | no | no | Default model identifier |
llm.providers.vertex.api_key | string | "" | tenant | yes | no | |
llm.providers.vertex.client_email | string | "" | global | no | no | |
llm.providers.vertex.google_application_credentials | string | "" | global | no | no | |
llm.providers.vertex.location | string | "" | global | no | no | |
llm.providers.vertex.model | string | "" | tenant | no | no | |
llm.providers.vertex.private_key | string | "" | global | yes | no | |
llm.providers.vertex.project | string | "" | global | no | no | |
llm.suggestion_model | string | "claude-haiku-4-5" | tenant | no | no | Small model used to generate post-turn suggestions |
llm.summarize_model | string | "" | tenant | no | no | Model used for summarization passes |
llm.summarize_provider | enum("mock" | "anthropic" | "openai" | "gemini" | "azure" | "bedrock" | "vertex" | "ai_gateway") | null | tenant | no | no | Provider used for summarization passes |
llm.web_search | boolean | true | tenant | no | no | Allow the assistant to use Anthropic-native server-side web search (billed per search; Anthropic models only). Toggle off per tenant via /settings. |
auth #
Authentication
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
auth.enable_signup | boolean | false | global | no | no | Compatibility fallback for self-hosted OIDC providers without signup_policy: allow first-time SSO member accounts. Explicit provider policies override it; hosted signup never uses it. |
auth.hosted.admission.mcp_clients_per_minute | number | 0 | global | no | no | Operator global hosted MCP dynamic-client registration ceiling per minute. |
auth.hosted.admission.mcp_clients_per_peer_per_minute | number | 0 | global | no | no | Operator hosted MCP dynamic-client registration ceiling per verified peer and minute. |
auth.hosted.admission.retained_mcp_clients | number | 0 | global | no | no | Operator ceiling for retained MCP client registrations, including retired and disabled clients; zero denies new clients. |
auth.hosted.admission.retained_tenants | number | 0 | global | no | no | Operator ceiling for retained self-service tenant records, including erased ownership tombstones; zero denies new tenants. |
auth.hosted.admission.tenant_creations_per_minute | number | 0 | global | no | no | Operator global ceiling for newly created self-service tenants per minute; idempotent callbacks do not consume it. |
auth.hosted.enabled | boolean | false | global | no | yes | Enable identity-first hosted browser authentication for explicitly opted-in providers. |
auth.hosted.registration_enabled | boolean | false | global | no | no | Allow new hosted identities to provision their own workspace. Existing members and reviewed invitation handoffs remain available while registration is closed. |
auth.mcp_oauth.access_token_ttl_seconds | number | 3600 | global | no | no | Lifetime in seconds for MCP OAuth access tokens. |
auth.mcp_oauth.authorization_code_ttl_seconds | number | 60 | global | no | no | Lifetime in seconds for MCP OAuth authorization codes. |
auth.mcp_oauth.dynamic_registration_enabled | boolean | true | global | no | no | Allow RFC 7591 dynamic client registration at POST /v1/oauth/register. |
auth.mcp_oauth.enabled | boolean | true | global | no | yes | Enable the MCP OAuth 2.1 authorization server (ChatGPT / Claude.ai / Cursor). |
auth.mcp_oauth.refresh_token_ttl_seconds | number | 2592000 | global | no | no | Lifetime in seconds for MCP OAuth refresh tokens (30 days). |
auth.mcp_oauth.scopes_supported | string[] | ["mcp:read","mcp:authoring","mcp:admin","metrics:read"] | global | no | no | OAuth scopes advertised in the authorization server metadata. Add, reorder and remove freely, except metrics:read: GET /metrics enforces it, so it is restored whenever a written value omits it. |
auth.providers | json | [{"protocol":"api_key","id":"api-key","label":"SubKit API key"}] | global | no | no | Authentication adapters: api_key, oidc (public browser client with PKCE, no secret) and oidc_bearer (an issuer's access token as bearer for one product, verified against its JWKS). |
auth.session.secret | string | "" | global | yes | yes | Session signing secret (auto-generated to a 32-byte hex value on first boot if empty); operator-supplied values must be at least 32 chars |
platform #
Chat platform integrations
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
platform.googlechat.audience | string | "" | global | no | yes | |
platform.googlechat.client_email | string | "" | global | no | yes | |
platform.googlechat.private_key | string | "" | global | yes | yes | |
platform.googlechat.project_id | string | "" | global | no | yes | |
platform.googlechat.sync_turn_timeout_ms | number | 25000 | global | no | no | Bounded wait for the inline synchronous Google Chat turn before falling back to detached async delivery (must stay under Google's ~30s sync window) |
platform.slack.client_id | string | "" | global | no | yes | |
platform.slack.client_secret | string | "" | global | yes | yes | |
platform.slack.signing_secret | string | "" | global | yes | yes | |
platform.teams.app_id | string | "" | global | no | yes | |
platform.teams.app_password | string | "" | global | yes | yes |
storage #
Object storage
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
storage.hosted.max_file_bytes | string | "0" | global | no | no | Operator-owned maximum declared bytes of each new hosted file; zero blocks file admission. |
storage.hosted.retained_rows_per_resource | number | 1000 | global | no | no | Operator-owned retained row ceiling, initially 1,000 for the Free offering, for each hosted resource table, including histories and soft-deleted rows; zero blocks resource creation. |
storage.hosted.tenant_bytes | string | "0" | global | no | no | Operator-owned shared logical byte quota for files, object reservations and all retained user content, including copies and revisions. Not a physical bucket or PostgreSQL disk quota. |
storage.object_store.access_key_id | string | "" | global | yes | no | |
storage.object_store.bucket | string | "" | global | no | no | |
storage.object_store.endpoint | string | "" | global | no | no | |
storage.object_store.force_path_style | boolean | true | global | no | no | |
storage.object_store.region | string | "us-east-1" | global | no | no | |
storage.object_store.secret_access_key | string | "" | global | yes | no | |
storage.object_store.session_token | string | "" | global | yes | no |
observability #
Observability
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
observability.analytics.api_key | string | "" | global | yes | no | API key for the analytics endpoint. |
observability.analytics.enabled | boolean | false | global | no | no | Enable product-analytics emission. Off by default — no external calls are made unless this is true and an endpoint is configured. |
observability.analytics.endpoint | string | "" | global | no | no | Self-hostable analytics ingest endpoint. Empty disables emission even when enabled=true. |
observability.analytics.project | string | "" | global | no | no | Project or workspace identifier on the analytics platform. |
observability.deployment_environment | string | "production" | global | no | no | Deployment identity used for the OpenTelemetry deployment.environment.name resource attribute. |
observability.field_truncation_chars | number | 2048 | global | no | no | Per-field cap (in characters / UTF-16 code units, not bytes) applied to structured log fields after redaction. |
observability.langfuse.host | string | "" | global | no | no | |
observability.langfuse.public_key | string | "" | global | no | no | |
observability.langfuse.secret_key | string | "" | global | yes | no | |
observability.otlp.endpoint | string | "" | global | no | no | |
observability.otlp.service_name | string | "subkit" | global | no | no | |
observability.predictive.connector_unhealthy_pct | number | 80 | global | no | no | Percent of recent connector calls returning a non-ok health verdict above which connector drift is flagged. |
observability.predictive.dlq_critical_depth | number | 5 | global | no | no | Standing dead-letter-queue depth at or above which DLQ accumulation is flagged critical (a worker-failure backlog, not a per-window delta). |
observability.predictive.llm_fallback_pct | number | 80 | global | no | no | Percent of LLM calls falling back to the secondary provider above which primary-provider degradation is flagged. |
observability.predictive.memory_cap_fraction | number | 0.9 | global | no | no | Fraction of the host memory cap the RSS high-water may reach before an OOM-risk warning. |
observability.predictive.pool_saturation_pct | number | 80 | global | no | no | Percent of the Postgres pool in use (or any waiting clients) above which saturation is flagged. |
observability.predictive.transient_retry_rate | number | 1 | global | no | no | Transient-DB-retries-per-minute above which a flapping Postgres is flagged. |
observability.usage.enabled | boolean | false | global | no | no | Persist privacy-safe, tenant-scoped product usage events locally. Disabled by default; requires hmac_secret when enabled. |
observability.usage.hmac_secret | string | "" | global | yes | no | Product-local HMAC secret for actor and session pseudonyms. Set at least 32 characters before enabling usage telemetry. |
observability.usage.retention_days | number | 90 | global | no | no | Raw usage-event retention in days; aggregate reports may outlive raw rows. |
egress #
Egress filter
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
egress.mode | enum("strict" | "permissive") | null | global | no | no | Egress mode: strict blocks private/loopback hosts, permissive allows them. Null falls back to NODE_ENV default. |
egress.provider_hosts_extra | string[] | [] | global | no | no | Extra hostnames counted as LLM providers for token accounting and per-run budgets. Does NOT affect the egress filter — adding a host makes calls to it metered, not permitted. |
mcp #
MCP transport
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
mcp.api_key | string | "" | global | yes | no | |
mcp.read_only | boolean | false | global | no | no |
errors #
Error ring buffer
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
errors.ring_size | number | 100 | global | no | yes |
spec #
Spec fetcher
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
spec.allow_private_fetch | boolean | false | global | no | no | Allow OpenAPI spec fetches from private/loopback hosts (test-only) |
queue #
Queue worker
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
queue.abort_poll_interval_ms | number | 500 | global | no | no | Hot-reloadable interval for workers to observe durable cross-replica execution cancellation requests. |
queue.concurrency | number | 1 | global | no | yes | Executions this replica runs at once. Raising it trades isolation for throughput. Restart required. |
queue.crash_recovery_sweep_interval_ms | number | 60000 | global | no | no | Hot-reloadable interval for reconciling executions orphaned by a worker or engine restart. |
queue.crash_recovery_threshold_ms | number | 0 | global | no | no | Hard age threshold for crash recovery. 0 uses each workflow timeout multiplied by its grace factor. |
queue.hosted.chat_concurrency | number | 0 | global | no | no | Operator ceiling for simultaneous hosted chat turns per tenant, including direct calls; zero denies work. |
queue.hosted.execution_concurrency | number | 0 | global | no | no | Operator ceiling for simultaneous hosted root executions per tenant; zero denies work. |
queue.hosted.pending_jobs | number | 0 | global | no | no | Operator ceiling for queued hosted execution and conversation jobs per tenant; zero denies queue admission. |
tokens #
Token budget
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
tokens.currency | string | "USD" | tenant | no | no | ISO 4217 code for tokens.prices. The built-in catalog is in USD and applies only while this is USD; otherwise only tokens.prices entries price anything. |
tokens.monthly_budget | number | 0 | tenant | no | no | Hard cap on tokens consumed per calendar month. 0 = unlimited. |
tokens.prices | json | [] | tenant | no | no | Per-model price overrides on top of the built-in catalog, per 1M tokens. An entry replaces its model's catalog price. A model with neither is reported as unpriced, not as zero. |
operations #
Startup operations
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
operations.seed_skills_at_boot | boolean | true | global | no | yes | Upsert embedded skill seeds for all tenants during startup |
operations.update_check_enabled | boolean | true | global | no | yes | Check for a newer engine release during startup |
sandbox #
QuickJS JS sandbox limits
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
sandbox.ipc_max_bytes | number | 33554432 | global | no | no | Maximum sandbox worker request or response size in bytes. Default 32 MB. |
sandbox.max_transform_wall_ms | number | 300000 | global | no | no | Operator ceiling for a transform step's wall-clock, in ms. A step timeout_ms above it runs with the ceiling and sandbox_limit_clamped_total counts the cut. Default 5 min. |
sandbox.memory_bytes | number | 134217728 | global | no | no | Hard WASM heap cap for a JS sandbox run, in bytes. Default 128 MB. |
sandbox.queue_limit | number | 32 | global | no | no | Maximum queued sandbox jobs across one worker lane. Default 32. |
sandbox.stack_bytes | number | 2097152 | global | no | no | Max stack size for a JS sandbox run, in bytes. Default 2 MB. |
sandbox.tenant_queue_limit | number | 8 | global | no | no | Maximum queued sandbox jobs for one tenant in one worker lane. Default 8. |
sandbox.tick_budget | number | 10000000 | global | no | no | Interrupt-tick budget (coarse runaway backstop, not an opcode count). |
sandbox.transform_wall_ms | number | 60000 | global | no | no | Wall-clock cap for transform steps, in ms (overridable per step via timeout_ms). Long synchronous transforms block the worker — chunk via for_each instead of raising. Default 60 s. |
sandbox.wall_ms | number | 30000 | global | no | no | Default wall-clock cap for a JS sandbox run, in ms. Default 30 s. |
sandbox.worker_rss_bytes | number | 536870912 | global | no | no | RSS threshold that recycles a sandbox worker after a job, in bytes. Default 512 MB. |
repl #
sk REPL session preferences
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
repl.permissionMode | enum("ask" | "auto" | "plan" | "yolo") | "auto" | tenant | no | no | Default REPL permission mode for the principal: ask, auto, plan, or yolo. |
repl.portalTokenTtlMin | number | 15 | tenant | no | no | TTL in minutes for portal tokens minted by the /session slash (1..1440). |
ui #
REPL chrome preferences
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
ui.personality | enum("concise" | "balanced" | "verbose") | "balanced" | tenant | no | no | Assistant response style: concise | balanced | verbose. |
ui.statusline.format | enum("minimal" | "compact" | "detailed") | "compact" | tenant | no | no | Status-line layout: minimal | compact | detailed. |
ui.theme | enum("auto" | "light" | "dark" | "high-contrast") | "auto" | tenant | no | no | REPL color theme: auto | light | dark | high-contrast. |
ui.title.format | enum("session-id" | "tenant-session" | "model-tenant-session") | "session-id" | tenant | no | no | Window-title format used by the sk REPL. |
notifications #
sk REPL notification preferences
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
notifications.inbox.retention_days | number | 30 | global | no | no | Days a notification inbox task survives before the retention sweep deletes it. |
notifications.push.enabled | boolean | false | tenant | no | no | OS push notifications for long-running execution completion. |
notifications.push.quietHoursEnd | string | "" | tenant | no | no | Quiet-hours window end (HH:MM, local TZ). Empty disables the window. |
notifications.push.quietHoursStart | string | "" | tenant | no | no | Quiet-hours window start (HH:MM, local TZ). Empty disables the window. |
notifications.push.thresholdSec | number | 30 | tenant | no | no | Minimum elapsed turn seconds before a notification fires. |
connectors #
Per-connector tunables. Each sub-section is owned by one connector template.
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
connectors.http.max_response_bytes | number | 104857600 | tenant | no | no | Max bytes read from a single HTTP/GraphQL connector response before it is rejected as response_too_large. OOM guard; generous default (100 MB). |
connectors.mcp.per_server_manifest_byte_cap | number | 30000 | tenant | no | no | Byte cap on one external MCP connector's serialized tool manifest; the heaviest tools are dropped first when exceeded |
connectors.mcp.remote_tool_call_timeout_ms | number | 30000 | tenant | no | no | Bounded timeout (ms) for one remote external MCP tools/call invocation |
connectors.mcp.tools_list_max_pages | number | 5 | tenant | no | no | Max tools/list pages followed per external MCP handshake; a server paginating past this keeps only the pages read |
connectors.web_scraper.authoring.extract_too_large_yellow_pct | number | 30 | tenant | no | no | Past-run extract_too_large ratio (over last 20 runs) above which the gate Yellows. |
connectors.web_scraper.authoring.red_sitemap_threshold | number | 100000 | tenant | no | no | Sitemap entry count above which analyze_scrape_target refuses (Red). |
connectors.web_scraper.authoring.yellow_sitemap_threshold | number | 10000 | tenant | no | no | Sitemap entry count above which analyze_scrape_target returns Yellow. |
connectors.web_scraper.optimization.min_runs_before_proposing | number | 3 | tenant | no | no | Minimum recent runs before any candidate is emitted. |
connectors.web_scraper.optimization.sample_size | number | 10 | tenant | no | no | Number of recent runs the analyzer reads per recipe. |
connectors.web_scraper.optimization.scan_cron | string | "0 3 * * *" | global | no | no | Crontab for the per-tenant optimization scan (default daily 03:00). |
connectors.web_scraper.optimization.trivial_markdown_bytes | number | 512 | tenant | no | no | Pages whose MarkdownOutput.bytes is below this count as trivial. |
connectors.web_scraper.robots_cache.max_entries | number | 2000 | global | no | no | LRU ceiling shared across tenants (keyed by tenant_id + origin). |
connectors.web_scraper.robots_cache.ttl_ms | number | 3600000 | global | no | no | TTL for the per-tenant robots.txt LRU. |
connectors.web_scraper.runtime.default_wait_ms | number | 0 | tenant | no | no | Floor for between-page wait inside the crawl loop. Raised if robots.txt declares a higher Crawl-delay. |
connectors.web_scraper.runtime.max_chars_markdown | number | 100000 | tenant | no | no | Per-page markdown output cap (extract_too_large). |
connectors.web_scraper.runtime.max_chars_readability | number | 100000 | tenant | no | no | Per-page input cap into Readability (extract_too_large). |
connectors.web_scraper.runtime.max_pages | number | 1000 | tenant | no | no | Per-run crawl cap. Hard ceiling 10 000 (crawl_max_pages_exceeded). |
connectors.web_scraper.runtime.respect_robots | boolean | true | tenant | no | no | Skip URLs that robots.txt disallows for the configured User-Agent. |
connectors.web_scraper.runtime.user_agent | string | "" | tenant | no | no | User-Agent header on every fetch; passed to robots-parser matching. Empty means sk-web-scraper/<version> (+<server.public_base_url>/bot), or the project URL when no public base URL is set. |
products #
Product settings keyed by product_id for product principals (oidc_bearer providers)
| path | type | default | scope | sensitive | requiresRestart | description |
|---|---|---|---|---|---|---|
products | json | — | global | no | no | Product settings keyed by product_id for product principals (oidc_bearer providers) |
Authentication providers #
auth.providers is one atomic, validated runtime setting available through Cockpit, HTTP, MCP, sk settings, and the canonical config file. Records use protocol: api_key or oidc; one API-key adapter and multiple named direct OIDC adapters may coexist. Provider ids must be unique, and every OIDC callback is /v1/identity/login/callback on server.public_base_url. A successful write is active for subsequent browser-login requests without an engine restart.
OIDC records are public clients using Authorization Code with PKCE. Runtime configuration intentionally has no client_secret field and rejects one if supplied; use an issuer that supports public clients with token_endpoint_auth_method=none. The environment is not an auth-provider source.
Configured labels are diagnostic metadata only. The common mcp-auth surface derives its two user actions from protocol and always presents Continue with SSO before Continue with API key. Discovery exposes the canonical labels SSO and API key; no provider-specific route or parallel configuration tree is accepted.