Environment Variables

Every OpenSRE setting you can put in the environment or a .env file.

All configuration options for OpenSRE can be set via environment variables. This page provides a complete reference.

Secret storage

Environment variables are checked first. Credentials you enter through opensre onboard for LLM setup, or through opensre integrations setup for tools, are written to .env and to an owner-only file at ~/.opensre/credentials.json (mode 0600). OpenSRE does not write secrets to the OS keychain.

A value in the process environment or a local .env file wins over the credentials file. Keep .env out of source control.

Want credentials only from the environment, never on disk? Set OPENSRE_DISABLE_KEYRING=1 and export everything yourself.

LLM providers

Variable	Default	Description
LLM_PROVIDER	anthropic	Which LLM backend to use — see LLM providers
LLM_MAX_TOKENS	4096	Max tokens for LLM responses
OPENSRE_LLM_TRANSPORT	sdk	sdk (native SDKs) or litellm
OPENSRE_LLM_NATIVE_STRUCTURED_OUTPUT		Opt-in provider-native structured outputs (1/true)

Anthropic

Variable	Default	Description
ANTHROPIC_API_KEY		API key for Anthropic
ANTHROPIC_REASONING_MODEL		Model for reasoning tasks
ANTHROPIC_TOOLCALL_MODEL		Model for tool calling

OpenAI

Variable	Default	Description
OPENAI_API_KEY		API key for OpenAI
OPENAI_REASONING_MODEL		Model for reasoning tasks
OPENAI_TOOLCALL_MODEL		Model for tool calling

OpenRouter

Variable	Default	Description
OPENROUTER_API_KEY		API key for OpenRouter
OPENROUTER_MODEL		Shared model for all tasks
OPENROUTER_REASONING_MODEL		Override model for reasoning
OPENROUTER_TOOLCALL_MODEL		Override model for tool calling

TrustedRouter

Variable	Default	Description
TRUSTEDROUTER_API_KEY		API key for TrustedRouter
TRUSTEDROUTER_MODEL		Shared model for all tasks
TRUSTEDROUTER_REASONING_MODEL		Override model for reasoning
TRUSTEDROUTER_TOOLCALL_MODEL		Override model for tool calling

DeepSeek

Variable	Default	Description
DEEPSEEK_API_KEY		API key for DeepSeek
DEEPSEEK_MODEL		Shared model for all tasks
DEEPSEEK_REASONING_MODEL		Override model for reasoning
DEEPSEEK_TOOLCALL_MODEL		Override model for tool calling

Google Gemini

Variable	Default	Description
GEMINI_API_KEY		API key for Google Gemini
GEMINI_MODEL		Shared model for all tasks
GEMINI_REASONING_MODEL		Override model for reasoning
GEMINI_TOOLCALL_MODEL		Override model for tool calling

NVIDIA

Variable	Default	Description
NVIDIA_API_KEY		API key for NVIDIA NIM
NVIDIA_MODEL		Shared model for all tasks
NVIDIA_REASONING_MODEL		Override model for reasoning
NVIDIA_TOOLCALL_MODEL		Override model for tool calling

MiniMax

Variable	Default	Description
MINIMAX_API_KEY		API key for MiniMax
MINIMAX_MODEL		Shared model for all tasks
MINIMAX_REASONING_MODEL		Override model for reasoning
MINIMAX_TOOLCALL_MODEL		Override model for tool calling

Groq

Variable	Default	Description
GROQ_API_KEY		API key for Groq
GROQ_MODEL		Shared model for all tasks
GROQ_REASONING_MODEL		Override model for reasoning
GROQ_TOOLCALL_MODEL		Override model for tool calling

Azure OpenAI

Variable	Default	Description
AZURE_OPENAI_BASE_URL		Azure OpenAI resource URL (https://<resource>.openai.azure.com)
AZURE_OPENAI_API_KEY		API key for Azure OpenAI
AZURE_OPENAI_API_VERSION	2024-10-21	Azure OpenAI API version
AZURE_OPENAI_MODEL		Shared deployment name for all slots
AZURE_OPENAI_REASONING_MODEL	gpt-5.4-mini	Deployment for reasoning tasks
AZURE_OPENAI_CLASSIFICATION_MODEL	gpt-5.4-mini	Deployment for classification
AZURE_OPENAI_TOOLCALL_MODEL	gpt-5.4-mini	Deployment for tool calling

Amazon Bedrock

Variable	Default	Description
BEDROCK_REASONING_MODEL		Model for reasoning tasks
BEDROCK_TOOLCALL_MODEL		Model for tool calling
BEDROCK_CLASSIFICATION_MODEL	us.anthropic.claude-sonnet-4-6	Model for classification

Google Vertex AI

Variable	Default	Description
VERTEX_AI_PROJECT		GCP project ID (required for Vertex)
VERTEX_AI_LOCATION	us-central1	Vertex AI region
VERTEX_AI_REASONING_MODEL	gemini-2.5-pro	Model for reasoning
VERTEX_AI_TOOLCALL_MODEL	gemini-2.5-flash-lite	Model for tool calling
VERTEX_AI_CLASSIFICATION_MODEL	gemini-2.5-flash	Model for classification
VERTEX_AI_MODEL		Shared model override for all slots

Ollama (Local)

Variable	Default	Description
OLLAMA_MODEL	llama3.2	Model name in Ollama
OLLAMA_HOST	http://localhost:11434	Ollama server URL

LLM Reasoning Effort

Variable	Default	Description
OPENSRE_REASONING_EFFORT		Effort for extended-thinking models: low, medium, high, or xhigh

CLI investigation tools

Codex

Variable	Default	Description
CODEX_BIN		Path to Codex CLI binary
CODEX_MODEL		Model override for Codex

Claude Code

Variable	Default	Description
CLAUDE_CODE_BIN		Path to Claude Code CLI binary
CLAUDE_CODE_MODEL		Model override for Claude Code

Gemini CLI

Variable	Default	Description
GEMINI_CLI_BIN		Path to Gemini CLI binary
GEMINI_CLI_MODEL		Model override for Gemini CLI

Antigravity

Variable	Default	Description
ANTIGRAVITY_CLI_BIN		Path to Antigravity CLI binary
ANTIGRAVITY_CLI_MODEL		Model override for Antigravity
ANTIGRAVITY_CLI_TIMEOUT_SECONDS		Timeout for Antigravity CLI invocations

OpenCode

Variable	Default	Description
OPENCODE_BIN		Path to OpenCode CLI binary
OPENCODE_MODEL		Model override for OpenCode

Cursor

Variable	Default	Description
CURSOR_BIN		Path to Cursor CLI binary
CURSOR_MODEL		Model override for Cursor

Kimi

Variable	Default	Description
KIMI_BIN		Path to Kimi CLI binary
KIMI_MODEL		Model override for Kimi
KIMI_API_KEY		API key for Kimi

GitHub Copilot

Variable	Default	Description
COPILOT_BIN		Path to GitHub Copilot CLI binary
COPILOT_MODEL		Model override for Copilot
COPILOT_HOME		Copilot config directory override
COPILOT_GITHUB_TOKEN		GitHub token for Copilot auth

Grok / xAI

Variable	Default	Description
GROK_CLI_BIN		Path to Grok Build CLI binary
GROK_CLI_MODEL		Model override for Grok Build CLI
XAI_API_KEY		API-key auth for Grok Build CLI
XAI_BASE_URL		Override xAI API base URL
GROK_CLI_TIMEOUT_SECONDS	300	Timeout for Grok CLI invocations

Pi

Variable	Default	Description
PI_BIN		Path to Pi CLI binary
PI_MODEL		Model override for Pi CLI (provider/model)
PI_AGENT_DIR		Pi agent config directory override
PI_CONFIG_DIR		Pi config directory override

Custom endpoints

Variable	Default	Description
CUSTOM_OPENAI_BASE_URL		Base URL for an OpenAI-compatible gateway
CUSTOM_OPENAI_API_KEY		API key for custom-openai
CUSTOM_OPENAI_MODEL		Shared model for all custom-openai roles
CUSTOM_OPENAI_TOOLCALL_MODEL		Optional toolcall-model override
CUSTOM_ANTHROPIC_BASE_URL		Base URL for an Anthropic-compatible gateway
CUSTOM_ANTHROPIC_API_KEY		API key for custom-anthropic
CUSTOM_ANTHROPIC_MODEL		Shared model for all custom-anthropic roles

Output & Debugging

Variable	Default	Description
TRACER_VERBOSE	0	Verbose OpenSRE CLI/UI output (1, true, yes)
TRACER_OUTPUT_FORMAT		OpenSRE result output format
TRACER_API_URL		Base URL for the tracer observability integration / report delivery
NO_COLOR		Disable colored output (standard convention)
COLUMNS	80	Terminal column width for output formatting
ENV	development	Environment (development, production)

Credentials and authentication

For secrets (*_TOKEN, *_KEY, *_PASSWORD, *_SECRET, and similar), OpenSRE looks in this order:

1. Your process environment
2. The owner-only file ~/.opensre/credentials.json

opensre onboard saves LLM credentials there so they still work after you clear .env.

Not stored as secrets: webhook-style URLs such as SLACK_WEBHOOK_URL and ROCKETCHAT_WEBHOOK_URL. Those stay in env / store only — treat them as secrets and don’t log them.

Want credentials only from the environment, never on disk? Set OPENSRE_DISABLE_KEYRING=1 and export everything yourself.

Variable	Default	Description
OPENSRE_DISABLE_KEYRING	0	Disable local credential storage; credentials must come from the environment
OPENSRE_LLM_AUTH_METADATA_PATH	~/.opensre/llm-auth.json	Non-secret LLM auth metadata path used by prompt-safe status checks
OPENSRE_API_KEY		API key for remote OpenSRE instances

Telemetry & Monitoring

Variable	Default	Description
OPENSRE_NO_TELEMETRY	0	Disable all telemetry, including Sentry and PostHog (covers $ai_generation prompt/response events)
OPENSRE_ANALYTICS_DISABLED	0	Disable PostHog analytics only
OPENSRE_SENTRY_DISABLED	0	Disable Sentry error reporting
OPENSRE_SENTRY_DSN		Override Sentry DSN
OPENSRE_SENTRY_LOGGING_DISABLED	0	Disable Sentry log integration
OPENSRE_DEPLOYMENT_METHOD	local	Sentry deployment tag: railway, ec2, vercel, or local
OPENSRE_PROMPT_LOG_DISABLED	0	Disable prompt logging entirely
OPENSRE_PROMPT_LOG_LOCAL_DISABLED	0	Disable local prompt log file
OPENSRE_PROMPT_LOG_REDACT	1	Redact known token shapes from prompts/responses before local or PostHog logging
OPENSRE_PROMPT_LOG_PATH	~/.opensre/prompt_log.jsonl	Path to local prompt log file
OPENSRE_OPERATIONS_LOG_DISABLED	0	Disable the local operations log
OPENSRE_OPERATIONS_LOG_PATH	~/.opensre/operations_log.jsonl	Path to the local operations log
OPENSRE_OPERATIONS_LOG_MAX_BYTES	5242880	Rotate the local operations log after this many bytes
DO_NOT_TRACK	0	Honor global do-not-track preference
SENTRY_TRACES_SAMPLE_RATE	1.0	Trace sampling rate for Sentry
SENTRY_ERROR_SAMPLE_RATE	1.0	Error sampling rate for Sentry

Paths & Directories

Variable	Default	Description
INVESTIGATIONS_DIR	~/.opensre/investigations	Directory for saved investigations
OPENSRE_HOME	~/.opensre	Root directory for local OpenSRE state
OPENSRE_PROJECT_ENV_PATH	PROJECT_ROOT/.env	Path to project-level .env file
OPENSRE_WIZARD_STORE_PATH	~/.opensre/opensre.json	Path to the local wizard/provider selection store
OPENSRE_CONTEXT_ROOT		Override OpenSRE home/context root
OPENSRE_INTEGRATIONS_STORE_PATH		Override integrations store path

Memory

Variable	Default	Description
OPENSRE_MEMORY_DISABLED	0	Disable long-term memory
OPENSRE_MEMORY_DIR		Override memory storage directory
OPENSRE_MEMORY_AUTOEXTRACT_DISABLED	0	Disable automatic memory extraction
OPENSRE_MEMORY_GATEWAY_ENABLED	0	Opt-in memory on shared gateway hosts

Remote sync

Mirror conversation history and memory to a user-owned object store. Details: Remote sync.

Variable	Default	Description
OPENSRE_REMOTE_SYNC		Enable remote sync (1/true)
OPENSRE_REMOTE_SYNC_PROVIDER	aws	Store backend (aws, gcs, vercel, azure, or s3compat)
OPENSRE_REMOTE_SYNC_BUCKET		Bucket / Blob store name (required when sync is on)
OPENSRE_REMOTE_SYNC_PREFIX	opensre	Key prefix inside the store
OPENSRE_REMOTE_SYNC_REGION		Region override
OPENSRE_REMOTE_SYNC_PROFILE		Named credentials profile
OPENSRE_REMOTE_SYNC_ENDPOINT_URL		Custom S3 endpoint when provider is s3compat
OPENSRE_REMOTE_SYNC_EXCLUDE		Comma-separated globs to exclude from sync
OPENSRE_REMOTE_SYNC_EXCLUDE_OFF		Ignore configured exclusions for one run
BLOB_READ_WRITE_TOKEN		Vercel Blob token (when provider is vercel)

Masking

Variable	Default	Description
OPENSRE_MASK_ENABLED	false	Enable reversible identifier masking before external LLM calls
OPENSRE_MASK_KINDS		Comma-separated mask kinds to enable
OPENSRE_MASK_EXTRA_REGEX		JSON map of extra mask kinds to regex patterns

Feature Flags

Variable	Default	Description
OSRE_HELM_INTEGRATION		Enable Helm integration (1/true/yes)
HELM_PATH	helm	Path to the Helm binary
HELM_KUBE_CONTEXT		kubectl context for Helm
HELM_KUBECONFIG		kubeconfig path for Helm
HELM_NAMESPACE		Default Helm namespace
GITLAB_MR_WRITEBACK		Enable GitLab merge request writeback (true, 1, yes)
OPENSRE_RELEASES_API_URL	GitHub releases API	Override releases API endpoint

Integration credentials

Observability & Monitoring

Variable	Default	Description
GRAFANA_INSTANCE_URL		Grafana instance URL
GRAFANA_READ_TOKEN		Grafana API token
GRAFANA_WRITE_TOKEN		Grafana token for writing annotations (log sink)
GRAFANA_LOKI_PUSH_URL		Loki push URL for the Grafana investigation log sink
GRAFANA_LOKI_DATASOURCE_UID		UID of Loki datasource in Grafana
GRAFANA_TEMPO_DATASOURCE_UID		UID of Tempo datasource in Grafana
GRAFANA_MIMIR_DATASOURCE_UID		UID of Mimir datasource in Grafana
TEMPO_URL		Grafana Tempo / Tempo API base URL
TEMPO_API_KEY		Tempo API key (or use username/password)
TEMPO_USERNAME		Tempo basic-auth username
TEMPO_PASSWORD		Tempo basic-auth password
TEMPO_ORG_ID		Tempo org ID (multi-tenant)
GRAFANA_VERIFY_SSL	true	Verify Grafana SSL certificate
GRAFANA_CA_BUNDLE		Path to a CA bundle for Grafana TLS verification (self-signed/internal CA)
DD_API_KEY		Datadog API key
DD_APP_KEY		Datadog application key
DD_SITE	datadoghq.com	Datadog site (us/eu)
GROUNDCOVER_API_KEY		groundcover read-only service-account token (alias: GROUNDCOVER_MCP_TOKEN)
GROUNDCOVER_MCP_URL	https://mcp.groundcover.com/api/mcp	groundcover MCP endpoint
GROUNDCOVER_TENANT_UUID		Tenant UUID (multi-workspace accounts)
GROUNDCOVER_BACKEND_ID		Backend ID (multi-backend tenants)
GROUNDCOVER_TIMEZONE	UTC	Timezone for returned timestamps (X-Timezone)
HONEYCOMB_API_KEY		Honeycomb API key
HONEYCOMB_DATASET	__all__	Honeycomb dataset slug
HONEYCOMB_API_URL	https://api.honeycomb.io	Honeycomb API endpoint
CORALOGIX_API_KEY		Coralogix API key
CORALOGIX_API_URL	https://api.coralogix.com	Coralogix API endpoint
CORALOGIX_APPLICATION_NAME		Application name in Coralogix
CORALOGIX_SUBSYSTEM_NAME		Subsystem name in Coralogix
SIGNOZ_URL		SigNoz instance URL
SIGNOZ_API_KEY		SigNoz API key
ALERTMANAGER_URL		Alertmanager URL
ALERTMANAGER_BEARER_TOKEN		Bearer token for Alertmanager
ALERTMANAGER_USERNAME		Username for Alertmanager basic auth
ALERTMANAGER_PASSWORD		Password for Alertmanager basic auth
SPLUNK_URL		Splunk instance URL
SPLUNK_TOKEN		Splunk API token
SPLUNK_INDEX	main	Splunk index
SPLUNK_VERIFY_SSL	true	Verify Splunk SSL certificate
SPLUNK_CA_BUNDLE		Path to a CA bundle for Splunk TLS verification
SENTRY_URL	https://sentry.io	Sentry instance URL
SENTRY_ORG_SLUG		Sentry organization slug
SENTRY_PROJECT_SLUG		Sentry project slug
SENTRY_AUTH_TOKEN		Sentry auth token
POSTHOG_PROJECT_ID		PostHog project ID
POSTHOG_PERSONAL_API_KEY		PostHog personal API key
POSTHOG_BASE_URL	https://us.i.posthog.com	PostHog API instance base URL
POSTHOG_TIMEOUT_SECONDS	15.0	Timeout in seconds for PostHog API requests
NEW_RELIC_API_KEY		New Relic User key (NRAK-...)
NEW_RELIC_ACCOUNT_ID		New Relic account ID
NEW_RELIC_API_URL	https://api.newrelic.com	New Relic API URL (EU/JP endpoints supported)

Cloud Platforms

Variable	Default	Description
AWS_REGION	us-east-1	AWS region
AWS_ROLE_ARN		AWS role ARN for cross-account access
AWS_EXTERNAL_ID		External ID for AWS cross-account role
AWS_ACCESS_KEY_ID		AWS access key
AWS_SECRET_ACCESS_KEY		AWS secret access key
AWS_SESSION_TOKEN		AWS session token
CLOUD_PROVIDER		Cloud provider hint for ambient region discovery
CLOUD_REGION		Cloud region (falls back to AWS_REGION)
KUBECONFIG		Path to kubeconfig file
KUBECONFIG_CONTENT		Inline kubeconfig contents
KUBECONFIG_CONTEXT		kubectl context
KUBECONFIG_NAMESPACE	default	Default Kubernetes namespace
RDS_DB_INSTANCE_IDENTIFIER		AWS RDS DB instance identifier
RDS_REGION		AWS region for RDS (falls back to AWS_REGION)
RAILWAY_TOKEN		Railway API token
RAILWAY_PROJECT		Railway project
RAILWAY_SERVICE		Railway service
RAILWAY_ENVIRONMENT	production	Railway environment
RAILWAY_PATH	railway	Path to Railway CLI
ARGOCD_BASE_URL		Argo CD API base URL
ARGOCD_AUTH_TOKEN		Argo CD auth token
ARGOCD_TOKEN		Alias for ARGOCD_AUTH_TOKEN
ARGOCD_USERNAME		Argo CD username (basic auth)
ARGOCD_PASSWORD		Argo CD password (basic auth)
ARGOCD_PROJECT		Argo CD project
ARGOCD_APP_NAMESPACE		Argo CD app namespace
ARGOCD_VERIFY_SSL	true	Verify Argo CD TLS
YC_FOLDER_ID		Yandex Cloud folder ID
YC_CLOUD_ID		Yandex Cloud cloud ID
YC_SA_KEY_FILE		Path to a Yandex Cloud service-account key JSON file
YC_SA_KEY		Yandex Cloud service-account key, inline
YC_TOKEN		Yandex Cloud OAuth token
YC_IAM_TOKEN		Yandex Cloud IAM token
YC_USE_METADATA		Use the Yandex Cloud VM metadata service (true)

Messaging

Variable	Default	Description
SLACK_WEBHOOK_URL		Slack incoming webhook URL
SLACK_BOT_TOKEN		Slack bot token
SLACK_DEFAULT_CHAT_ID		Default Slack channel for scheduled delivery (bot-token path)
SLACK_APP_TOKEN		Slack app-level token (Socket Mode)
SLACK_GATEWAY_INBOUND_TRANSPORT	socket_mode	How Slack delivers events: socket_mode or events_api_http
SLACK_SIGNING_SECRET		Request-signature secret. Required for events_api_http
SLACK_GATEWAY_HTTP_PORT	3000	Port the events_api_http listener binds
SLACK_GATEWAY_ALLOW_LOCAL_DEDUP		Accept process-local event dedup when DATABASE_URL is unset. Single replica only
SLACK_ALLOWED_USERS		Comma-separated Slack user IDs allowed to talk to the bot
SLACK_ALLOW_OPEN_WORKSPACE		Allow any workspace user (1 for dogfood)
SLACK_ACCESS_TOKEN		Slack user token
SLACK_GITHUB_ISSUES_WEBHOOK_URL		Slack webhook for GitHub issues
DISCORD_BOT_TOKEN		Discord bot token
DISCORD_APPLICATION_ID		Discord application ID
DISCORD_PUBLIC_KEY		Discord public key
DISCORD_DEFAULT_CHANNEL_ID		Default Discord channel
DISCORD_ALLOWED_USERS		Comma-separated Discord user IDs allowed to talk to the bot
DISCORD_ALLOW_OPEN_GUILD		Allow any guild member (1 for dogfood)
TELEGRAM_BOT_TOKEN		Telegram bot token
TELEGRAM_DEFAULT_CHAT_ID		Default Telegram chat ID
TELEGRAM_ALLOWED_USERS		Comma-separated Telegram user IDs allowed to talk to the bot
ROCKETCHAT_SERVER_URL		Rocket.Chat server base URL
ROCKETCHAT_AUTH_TOKEN		Rocket.Chat personal access token
ROCKETCHAT_USER_ID		Rocket.Chat user ID for the token
ROCKETCHAT_DEFAULT_CHANNEL		Default Rocket.Chat channel
ROCKETCHAT_WEBHOOK_URL		Rocket.Chat incoming webhook URL
TWILIO_ACCOUNT_SID		Twilio account SID
TWILIO_AUTH_TOKEN		Twilio auth token
TWILIO_WHATSAPP_FROM		WhatsApp sender number (Twilio)
WHATSAPP_DEFAULT_TO		Default WhatsApp recipient
TWILIO_SMS_FROM		SMS sender number (Twilio)
TWILIO_SMS_MESSAGING_SERVICE_SID		SMS messaging service SID
TWILIO_SMS_DEFAULT_TO		Default SMS recipient
SMTP_HOST		SMTP server hostname
SMTP_PORT	587	SMTP port
SMTP_SECURITY	starttls	SMTP security (starttls, ssl, or none)
SMTP_USERNAME		SMTP username
SMTP_PASSWORD		SMTP password
SMTP_FROM_ADDRESS		From address for outbound mail
SMTP_DEFAULT_TO		Default recipient for notifications

Code & Collaboration

Variable	Default	Description
GITHUB_MCP_MODE	streamable-http	GitHub MCP transport mode
GITHUB_MCP_URL		GitHub MCP server URL
GITHUB_MCP_COMMAND		GitHub MCP command to execute
GITHUB_MCP_ARGS		GitHub MCP command arguments
GITHUB_MCP_AUTH_TOKEN		GitHub MCP auth token
GITHUB_MCP_TOOLSETS	repos,issues,pull_requests,actions,search	Enabled GitHub MCP toolsets
OPENSRE_GITHUB_MCP_REPO_PROBE_LIMIT	50	Max repos to probe (5-500)
GITLAB_BASE_URL		GitLab instance URL
GITLAB_ACCESS_TOKEN		GitLab personal access token
GITLAB_PROJECT_ID		GitLab project ID
GITLAB_REPO_URL		GitLab repository URL
GITLAB_MR_IID		Merge request IID for writeback context
JIRA_BASE_URL		Jira instance URL
JIRA_EMAIL		Jira user email
JIRA_API_TOKEN		Jira API token
JIRA_PROJECT_KEY		Default Jira project key
BITBUCKET_WORKSPACE		Bitbucket workspace name
BITBUCKET_USERNAME		Bitbucket username
BITBUCKET_APP_PASSWORD		Bitbucket app password
BITBUCKET_MAX_RESULTS	25	Max results per API call
INCIDENT_IO_BASE_URL		incident.io API URL
INCIDENT_IO_API_KEY		incident.io API key
PAGERDUTY_API_KEY		PagerDuty API key
PAGERDUTY_BASE_URL		PagerDuty API base URL
SERVICENOW_INSTANCE_URL		ServiceNow instance URL
SERVICENOW_USERNAME		ServiceNow username
SERVICENOW_PASSWORD		ServiceNow password
OPSGENIE_API_KEY		Opsgenie API key
OPSGENIE_REGION	us	Opsgenie region (us/eu)
VERCEL_API_TOKEN		Vercel API token
VERCEL_TEAM_ID		Vercel team ID
VERCEL_POLL_PROJECT_IDS		Project IDs for Vercel polling (CSV)
VERCEL_RUNTIME_LOGS_READ_TIMEOUT	600	Seconds to wait per Vercel runtime-log read (minimum 30)
GOOGLE_CREDENTIALS_FILE		Path to Google service-account JSON for Docs export
GOOGLE_DRIVE_FOLDER_ID		Google Drive folder for Docs export

Databases

Variable	Default	Description
MONGODB_CONNECTION_STRING		MongoDB connection string
MONGODB_DATABASE		MongoDB database name
MONGODB_AUTH_SOURCE	admin	MongoDB auth source
MONGODB_TLS	true	Enable MongoDB TLS
MONGODB_ATLAS_PUBLIC_KEY		MongoDB Atlas public API key
MONGODB_ATLAS_PRIVATE_KEY		MongoDB Atlas private API key
MONGODB_ATLAS_PROJECT_ID		MongoDB Atlas project ID
MONGODB_ATLAS_BASE_URL	https://cloud.mongodb.com/api/atlas/v2	MongoDB Atlas API base URL
REDIS_HOST		Redis host
REDIS_PORT	6379	Redis port
REDIS_USERNAME		Redis ACL username (Redis 6+)
REDIS_PASSWORD		Redis password
REDIS_DATABASE	0	Redis database number
REDIS_SSL	false	Connect using TLS
POSTGRESQL_HOST		PostgreSQL host
POSTGRESQL_PORT	5432	PostgreSQL port
POSTGRESQL_DATABASE		PostgreSQL database name
POSTGRESQL_USERNAME	postgres	PostgreSQL username
POSTGRESQL_PASSWORD		PostgreSQL password
POSTGRESQL_SSL_MODE	prefer	PostgreSQL SSL mode
MYSQL_HOST		MySQL host
MYSQL_PORT	3306	MySQL port
MYSQL_DATABASE		MySQL database name
MYSQL_USERNAME	root	MySQL username
MYSQL_PASSWORD		MySQL password
MYSQL_SSL_MODE	preferred	MySQL SSL mode
MARIADB_HOST		MariaDB host
MARIADB_PORT	3306	MariaDB port
MARIADB_DATABASE		MariaDB database name
MARIADB_USERNAME		MariaDB username
MARIADB_PASSWORD		MariaDB password
MARIADB_SSL	true	Enable MariaDB SSL

Message Queues & Other Services

Variable	Default	Description
RABBITMQ_HOST		RabbitMQ host
RABBITMQ_MANAGEMENT_PORT	15672	RabbitMQ management port
RABBITMQ_USERNAME		RabbitMQ username
RABBITMQ_PASSWORD		RabbitMQ password
RABBITMQ_VHOST	/	RabbitMQ vhost
RABBITMQ_SSL	false	Enable RabbitMQ SSL
RABBITMQ_VERIFY_SSL	true	Verify RabbitMQ SSL certificate
BETTERSTACK_QUERY_ENDPOINT		Better Stack query endpoint
BETTERSTACK_USERNAME		Better Stack username
BETTERSTACK_PASSWORD		Better Stack password
BETTERSTACK_SOURCES		Better Stack sources
KAFKA_BOOTSTRAP_SERVERS		Kafka broker addresses
KAFKA_SECURITY_PROTOCOL	PLAINTEXT	Kafka security protocol
KAFKA_SASL_MECHANISM		Kafka SASL mechanism
KAFKA_SASL_USERNAME		Kafka SASL username
KAFKA_SASL_PASSWORD		Kafka SASL password
DAGSTER_ENDPOINT		Dagster GraphQL endpoint
DAGSTER_API_TOKEN		Dagster Cloud User Token (leave empty for unauthenticated local OSS)
TEMPORAL_API_URL		Temporal Cloud / server API URL
TEMPORAL_NAMESPACE	default	Temporal namespace
TEMPORAL_API_KEY		Temporal API key (optional for local)
JENKINS_URL		Jenkins base URL
JENKINS_USER		Jenkins username
JENKINS_API_TOKEN		Jenkins API token

Data & Search

Variable	Default	Description
OPENSEARCH_URL		OpenSearch instance URL
OPENSEARCH_USERNAME		OpenSearch username
OPENSEARCH_PASSWORD		OpenSearch password
OPENSEARCH_API_KEY		OpenSearch API key (alternative to username/password)
OPENSEARCH_INDEX_PATTERN	*	OpenSearch index pattern
OPENSEARCH_MAX_RESULTS	100	Max OpenSearch results
OPENOBSERVE_URL		OpenObserve instance URL
OPENOBSERVE_TOKEN		OpenObserve API token
OPENOBSERVE_USERNAME		OpenObserve username
OPENOBSERVE_PASSWORD		OpenObserve password
OPENOBSERVE_ORG	default	OpenObserve organization
OPENOBSERVE_STREAM		OpenObserve stream
OPENOBSERVE_MAX_RESULTS	100	Max OpenObserve results
VICTORIA_LOGS_URL		VictoriaLogs instance URL
VICTORIA_LOGS_TENANT_ID		VictoriaLogs tenant ID
HERMES_LOG_PATH	~/.hermes/logs/errors.log	Hermes log path saved by opensre integrations setup hermes; also defines the path sandbox for get_hermes_logs
OPENSRE_HERMES_INVESTIGATE		Set to 1 to enable Hermes watch auto-investigation when the CLI flag is omitted
CLICKHOUSE_HOST		ClickHouse host
CLICKHOUSE_PORT	8123	ClickHouse port
CLICKHOUSE_DATABASE	default	ClickHouse database
CLICKHOUSE_USER	default	ClickHouse username
CLICKHOUSE_PASSWORD		ClickHouse password
CLICKHOUSE_SECURE	false	Enable ClickHouse TLS
SNOWFLAKE_ACCOUNT_IDENTIFIER		Snowflake account identifier
SNOWFLAKE_ACCOUNT		Snowflake account (alternative)
SNOWFLAKE_TOKEN		Snowflake token
SNOWFLAKE_USER		Snowflake username
SNOWFLAKE_PASSWORD		Snowflake password
SNOWFLAKE_WAREHOUSE		Snowflake warehouse
SNOWFLAKE_ROLE		Snowflake role
SNOWFLAKE_DATABASE		Snowflake database
SNOWFLAKE_SCHEMA		Snowflake schema
SNOWFLAKE_MAX_RESULTS	50	Max Snowflake results
AZURE_SQL_SERVER		Azure SQL server name
AZURE_SQL_DATABASE		Azure SQL database name
AZURE_SQL_PORT	1433	Azure SQL port
AZURE_SQL_USERNAME		Azure SQL username
AZURE_SQL_PASSWORD		Azure SQL password
AZURE_SQL_DRIVER	ODBC Driver 18 for SQL Server	Azure SQL ODBC driver
AZURE_SQL_ENCRYPT	true	Enable Azure SQL encryption
AZURE_LOG_ANALYTICS_WORKSPACE_ID		Azure Log Analytics workspace ID
AZURE_LOG_ANALYTICS_TOKEN		Azure Log Analytics token
AZURE_LOG_ANALYTICS_ENDPOINT	https://api.loganalytics.io	Log Analytics Query API endpoint (sovereign clouds)
AZURE_TENANT_ID		Azure tenant ID
AZURE_SUBSCRIPTION_ID		Azure subscription ID
AZURE_MAX_RESULTS	100	Max Azure results

MCP Servers

Variable	Default	Description
OPENCLAW_MCP_URL		OpenClaw MCP server URL
OPENCLAW_MCP_COMMAND		OpenClaw MCP command to execute
OPENCLAW_MCP_MODE	streamable-http	OpenClaw MCP transport mode
OPENCLAW_MCP_ARGS		OpenClaw MCP command arguments
OPENCLAW_MCP_AUTH_TOKEN		OpenClaw MCP auth token
POSTHOG_MCP_MODE	streamable-http	PostHog MCP transport mode
POSTHOG_MCP_URL	https://mcp.posthog.com/mcp	PostHog MCP URL
POSTHOG_MCP_AUTH_TOKEN		PostHog MCP auth token
POSTHOG_MCP_PROJECT_ID		PostHog project scoped to MCP
POSTHOG_MCP_ORGANIZATION_ID		PostHog organization scoped to MCP
POSTHOG_MCP_FEATURES		Comma-separated PostHog MCP features
POSTHOG_MCP_READ_ONLY	true	Restrict PostHog MCP to read-only
POSTHOG_MCP_COMMAND		PostHog MCP stdio command
POSTHOG_MCP_ARGS		PostHog MCP stdio args
SENTRY_MCP_MODE	streamable-http	Sentry MCP transport mode
SENTRY_MCP_URL	https://mcp.sentry.dev/mcp	Sentry MCP URL
SENTRY_MCP_AUTH_TOKEN		Sentry MCP auth token
SENTRY_MCP_HOST		Self-hosted Sentry MCP host
SENTRY_MCP_ORGANIZATION_SLUG		Sentry org slug for MCP
SENTRY_MCP_PROJECT_SLUG		Sentry project slug for MCP
SENTRY_MCP_SKILLS		Enabled Sentry MCP skills
SENTRY_MCP_COMMAND		Sentry MCP stdio command
SENTRY_MCP_ARGS		Sentry MCP stdio args
X_MCP_MODE	streamable-http	X MCP transport mode
X_MCP_URL	http://127.0.0.1:8000/mcp	X MCP URL
X_MCP_AUTH_TOKEN		X MCP transport auth token
X_MCP_COMMAND		X MCP stdio command
X_MCP_ARGS		X MCP stdio args
X_BEARER_TOKEN		X API bearer token (not MCP transport auth)

Git Integrations

Variable	Default	Description
GITHUB_EVENT_PATH		GitHub Actions event payload path
GITHUB_REPOSITORY		GitHub repository (owner/repo)
GITHUB_TOKEN		GitHub personal access token
GH_TOKEN		Alias for GITHUB_TOKEN

Multi-instance integrations

Need more than one Datadog, Grafana, or AWS account (for example prod and staging)? Use a JSON *_INSTANCES variable:

Variable	What it configures
GRAFANA_INSTANCES	Multiple Grafana instances
DD_INSTANCES	Multiple Datadog sites/accounts
GROUNDCOVER_INSTANCES	Multiple groundcover instances
HONEYCOMB_INSTANCES	Multiple Honeycomb instances
CORALOGIX_INSTANCES	Multiple Coralogix instances
SPLUNK_INSTANCES	Multiple Splunk instances
AWS_INSTANCES	Multiple AWS accounts
ARGOCD_INSTANCES	Multiple Argo CD instances

Format and examples: Multi-instance integrations.

LLM classification models

If you don’t set these, OpenSRE falls back to the reasoning model (or the provider default):

Variable	Default	Description
ANTHROPIC_CLASSIFICATION_MODEL		Anthropic classification model
OPENAI_CLASSIFICATION_MODEL		OpenAI classification model
OPENROUTER_CLASSIFICATION_MODEL		OpenRouter classification model
TRUSTEDROUTER_CLASSIFICATION_MODEL		TrustedRouter classification model
DEEPSEEK_CLASSIFICATION_MODEL		DeepSeek classification model
GEMINI_CLASSIFICATION_MODEL		Gemini classification model
NVIDIA_CLASSIFICATION_MODEL		NVIDIA classification model
MINIMAX_CLASSIFICATION_MODEL		MiniMax classification model
GROQ_CLASSIFICATION_MODEL		Groq classification model