Runtime configuration fields, defaults, and environment variables for the standalone binary.
The standalone binary loads its generated configuration from embedded values and the process environment when a command uses it. Configuration fields come from the selected components and the manifest. Changes to environment variables take effect when configuration is loaded again.
Use the config command to inspect resolved values.
The tables below describe configuration paths in the generated binary. Fields marked
manifest value take their value or runtime fallback from the resolved manifest. A field listed
as conditional is generated only when its corresponding configuration is present.
… indicates a required value with no default. null indicates an optional value. Fields with
types linked below have their own shape definitions on this page. JSON value means arbitrary
JSON data whose structure is defined by its consumer.
| Field | Type | Availability | Default | Description |
|---|---|---|---|---|
default_tenant_id | string | Generated configuration | default, or manifest value | Tenant used when the caller supplies no tenant. |
agent | AgentConfig | Generated agent fields | Manifest values | Agent model and optional prompt configuration. |
provider | ProviderConfigs | Providers with generated fields | Manifest values | Credentials, endpoints, and inference settings keyed by provider. |
tool | ToolConfigs | JavaScript, Python, or Bash tools | Manifest values | Tool activation and tool-defined configuration. |
server | ServerConfig | http_server enabled | Defaults below, or manifest values | HTTP listener settings. |
filesystem | FilesystemConfig | Generated configuration | Defaults below | Host directories mounted into the virtual filesystem. |
network | NetworkConfig | Generated configuration | Defaults below, or manifest values | Outbound HTTP settings and access policy. |
mcp | McpConfig | Generated configuration | Manifest values, or empty servers | MCP server transports. |
a2a | A2aConfig | Generated configuration | Manifest values, or empty agents | Outbound A2A targets. |
database | DatabaseConfig | ReAct graph | Defaults below | Persistence connections and migration settings. |
react | ReActConfig | ReAct graph | Defaults below, or manifest values | Graph-level model call policy. |
task_queue | TaskQueueConfig | ReAct graph with HTTP server | Defaults below | Queued work and batching limits. |
pubsub | MemoryPubSub | RedisPubSub | ReAct graph with HTTP server | Memory transport, capacity 4096 | Transport for distributing live run events. |
Inspect a particular binary with the config command. Custom blocks can contribute additional configuration fields.
Path: agent.
| Field | Type | Availability | Default | Description |
|---|---|---|---|---|
model | AgentModel | Generated agent fields | Manifest values | Default provider and model selection. |
capabilities | array<string> | Capabilities configured | Manifest value | Capabilities available to the agent. |
prompt | PromptConfig | Langfuse prompt configured | Manifest values | Remote prompt settings. |
Path: agent.model.
| Field | Type | Default | Description |
|---|---|---|---|
provider | string | Manifest value | Provider selected for model calls. |
name | string | Manifest value | Model identifier sent to the provider. |
Path: agent.prompt.
| Field | Type | Default | Description |
|---|---|---|---|
langfuse | LangfusePromptConfig | Manifest values | Langfuse prompt retrieval settings. |
Path: agent.prompt.langfuse. Optional settings below are generated when supplied by the resolved
prompt configuration. Their values and runtime fallbacks follow the
Langfuse prompt source.
| Field | Type | Availability | Description |
|---|---|---|---|
prompt_name | string | Langfuse prompt configured | Name of the prompt to retrieve. |
public_key | string | Langfuse prompt configured | Public authentication key. |
secret_key | string | Langfuse prompt configured | Secret authentication key. |
base_url | string | Configured | Langfuse service URL. |
label | string | Configured | Label selecting a prompt version. |
version | integer | Configured | Specific prompt version to retrieve. |
cache_ttl_seconds | integer | Configured | Time in seconds to retain a retrieved prompt in the cache. |
fetch_timeout_seconds | integer | Configured | Time in seconds allowed for a retrieval request. |
max_retries | integer | Configured | Maximum retries for prompt retrieval. |
Path: provider. Each generated field is the configuration key of a declared provider.
Provider labels containing punctuation are converted to snake case for this key.
| Field | Type | Description |
|---|---|---|
<provider_key> | ProviderConfig | Settings for the provider with this configuration key. |
Path: provider.<provider_key>. Only configured fields are generated. Values and runtime
fallbacks come from the corresponding provider declaration.
| Field | Type | Availability | Description |
|---|---|---|---|
api_key | string | Configured for a provider supporting credentials | Authentication key. |
base_url | string | Configured for Anthropic, OpenAI, Ollama, or Hugging Face | Service endpoint. |
headers | object | Configured with headers | HTTP headers sent with each model request. Values come from the provider declaration. |
params | InferenceParams | Provider-level parameters configured | Inference defaults shared by the provider's models. |
<model_key> | InferenceParams | Parameters configured for that model | Inference settings for an individual model. |
Model keys replace each non-alphanumeric character in the model name with _. For example,
google/gemma-2-2b-it becomes google_gemma_2_2b_it. A model's settings live directly under this
key, such as provider.cloud.google_gemma_2_2b_it.temperature.
Only configured parameters are generated. Each takes its value or runtime fallback from the corresponding provider or model declaration.
| Field | Type | Description |
|---|---|---|
max_tokens | integer | Maximum output token count. |
temperature | number | Sampling temperature. |
top_p | number | Probability mass used for nucleus sampling. |
top_k | integer | Maximum candidate tokens considered during sampling. |
stop_sequences | array<string> | Sequences that end generation. |
frequency_penalty | number | Penalty based on token repetition frequency. |
presence_penalty | number | Penalty for tokens already present in the response. |
seed | integer | Sampling seed. |
provider_params | JSON value | Provider-specific inference settings. |
Path: tool. Each generated field is the configuration key of a JavaScript, Python, or Bash
tool. Tool labels containing punctuation are converted to snake case for this key.
| Field | Type | Description |
|---|---|---|
<tool_key> | ToolConfig | Settings for the tool with this configuration key. |
Path: tool.<tool_key>. Values and runtime fallbacks come from the tool declaration.
| Field | Type | Availability | Description |
|---|---|---|---|
enabled | boolean | Generated tool fields | Whether the tool is enabled. |
<config_key> | string | Key declared in the tool's config | Tool-defined configuration value. |
Path: server. Defaults apply when the corresponding
HTTP server field is omitted.
| Field | Type | Default | Description |
|---|---|---|---|
host | string | 127.0.0.1 | Address on which the server listens. |
port | integer | 8080 | TCP port on which the server listens. |
max_request_size | integer | 2097152 | Maximum accepted request body size in bytes. |
Path: filesystem.
| Field | Type | Default | Description |
|---|---|---|---|
binds | array<FilesystemBind> | [] | Host directory mounts added after the compiled filesystem topology. |
Path: filesystem.binds.<index>.
| Field | Type | Default | Description |
|---|---|---|---|
path | string | … | Mount location inside the virtual filesystem. |
root | string | … | Host directory exposed by the mount. |
readonly | boolean | false | Whether access through the mount is read-only. |
follow_symlinks | boolean | false | Whether the host backend follows symbolic links. |
Path: network. Defaults below apply when the corresponding
network fields are omitted. Manifest values can replace them.
| Field | Type | Default | Description |
|---|---|---|---|
user_agent | string | null | null | User-Agent header sent with requests. |
headers | map<string, string> | {} | Additional request headers. |
limits | NetworkLimits | Defaults below | Connection, response, and concurrency limits. |
policy | NetworkPolicy | Defaults below | Rules governing outbound destinations and methods. |
Path: network.limits.
| Field | Type | Default | Description |
|---|---|---|---|
connect_timeout_ms | integer | null | null | Time in milliseconds allowed to establish a connection. |
read_timeout_ms | integer | null | null | Time in milliseconds allowed between response body chunks. |
request_timeout_ms | integer | null | null | Time in milliseconds allowed for the entire request. |
max_redirects | integer | 5 | Maximum redirects followed for one request. |
max_response_bytes | integer | null | null | Maximum accepted response body size in bytes. |
concurrency_limit | integer | null | null | Maximum simultaneous requests. |
Path: network.policy.
| Field | Type | Default | Description |
|---|---|---|---|
addresses | NetworkAddresses | Defaults below | Permitted destination address categories. |
methods | array<string> | null | null | Permitted HTTP methods. null permits all methods. |
allow | array<NetworkUrlPattern> | [] | URL patterns that requests must match. An empty array denies every URL. |
Path: network.policy.addresses.
| Field | Type | Default | Description |
|---|---|---|---|
allow_loopback | boolean | false | Allow this machine's loopback addresses, such as 127.0.0.1 and ::1. |
allow_private | boolean | false | Allow private-network destinations, such as 10.0.0.1 and 192.168.1.1. |
allow_link_local | boolean | false | Allow addresses on the immediately connected network, such as 169.254.0.1, including cloud metadata addresses. |
Path: network.policy.allow.<index>.
| Field | Type | Default | Description |
|---|---|---|---|
protocol | string | null | null | URL scheme pattern. |
hostname | string | null | null | Host name pattern. |
port | string | null | null | Port pattern. |
pathname | string | null | null | URL path pattern. |
A null component matches any value. See URL patterns
for pattern syntax.
export AGENT__NETWORK__POLICY__ALLOW__0__HOSTNAME=somehost.comPath: mcp.
| Field | Type | Default | Description |
|---|---|---|---|
servers | map<string, McpStdioTransport | McpHttpTransport> | Manifest transports, or {} | MCP connections keyed by manifest tool label. |
Path: mcp.servers.<label> when type = stdio.
| Field | Type | Default | Description |
|---|---|---|---|
type | stdio | … | Transport discriminator. |
command | string | Manifest value | Executable used to start the MCP server. |
args | array<string> | [], or manifest values | Arguments passed to the executable. |
env | map<string, string> | {}, or manifest values | Environment values supplied to the MCP process. |
Path: mcp.servers.<label> when type = http.
| Field | Type | Default | Description |
|---|---|---|---|
type | http | … | Transport discriminator. |
url | string | Manifest value | MCP server URL. |
auth_token | string | null | null, or manifest value | Authentication token. |
headers | map<string, string> | {}, or manifest values | Additional request headers. |
Path: a2a.
| Field | Type | Default | Description |
|---|---|---|---|
agents | map<string, A2aAgent> | Manifest targets, or {} | Outbound A2A targets keyed by manifest tool label. |
Path: a2a.agents.<label>. Manifest values and runtime fallbacks take precedence over the
defaults below.
| Field | Type | Default | Description |
|---|---|---|---|
url | string | Empty string | Target service URL. |
auth_token | string | null | null | Authentication token. |
headers | map<string, string> | {} | Additional request headers. |
tenant | A2aTenant | inherit policy | Tenant identity forwarded to the target. |
timeout_secs | integer | 60 | Request timeout in seconds. |
default_accepted_output_modes | array<string> | [] | Accepted output modes used by default. |
description | string | null | null | Description presented for the target. |
capabilities | array<string> | [] | Capabilities associated with the target. |
enabled | boolean | true | Whether the target is enabled. |
Path: a2a.agents.<label>.tenant.
| Field | Type | Default | Description |
|---|---|---|---|
policy | inherit | none | fixed | inherit for an omitted tenant | Tenant selection policy. |
id | string | … | Tenant ID, required for fixed. |
inherit forwards the caller's effective tenant. none sends the request without tenant
identity. fixed forwards id.
Path: database. Available with the ReAct graph.
| Field | Type | Default | Description |
|---|---|---|---|
primary | string | sqlite://database.db?mode=rwc | Primary database connection URL. |
replicas | array<string> | [] | Database connection URLs available for read operations. |
options | DatabaseOptions | Defaults below | Connection pool and logging settings. |
auto_migrate | boolean | true | Apply pending migrations when an execution command starts. |
The CLI reference defines the migration command and
the --no-migrations override.
Path: database.options. When this entire setting is omitted, optional limits are null and
enable_logging is false. When supplying an options object, include enable_logging.
| Field | Type | Default when omitted | Description |
|---|---|---|---|
max_connections | integer | null | null | Maximum pool connections. |
min_connections | integer | null | null | Minimum pool connections. |
connect_timeout | Duration | null | null | Time allowed to establish a database connection. |
idle_timeout | Duration | null | null | Time an unused connection may remain in the pool. |
acquire_timeout | Duration | null | null | Time allowed to acquire a connection from the pool. |
max_lifetime | Duration | null | null | Maximum lifetime of a pooled connection. |
enable_logging | boolean | … | Enable database statement logging. |
| Field | Type | Default | Description |
|---|---|---|---|
secs | integer | … | Whole seconds. |
nanos | integer | … | Additional nanoseconds. |
For example, configure a ten-second connection acquisition timeout:
export AGENT__DATABASE__OPTIONS__ENABLE_LOGGING=false
export AGENT__DATABASE__OPTIONS__ACQUIRE_TIMEOUT__SECS=10
export AGENT__DATABASE__OPTIONS__ACQUIRE_TIMEOUT__NANOS=0Path: react. Available with the ReAct graph.
| Field | Type | Default | Description |
|---|---|---|---|
model | ReActModelConfig | Defaults below | Default policy for model calls. |
Path: react.model. Configured graph model values supply
embedded values or runtime fallbacks.
| Field | Type | Default | Description |
|---|---|---|---|
timeout | integer | null | null | Model call timeout in milliseconds. |
retry | ReActRetryConfig | null | null | Retry policy for model calls. |
Path: react.model.retry. All three fields are required when a retry policy is supplied.
| Field | Type | Default | Description |
|---|---|---|---|
max_attempts | integer | … | Maximum attempts for a model call. |
initial_backoff | integer | … | Initial retry delay in milliseconds. |
max_backoff | integer | … | Maximum retry delay in milliseconds. |
Path: task_queue. Available with the ReAct graph and HTTP server.
| Field | Type | Default | Description |
|---|---|---|---|
worker_count | integer | 64 | Number of workers processing queued work. |
max_queue_capacity | integer | 256 | Maximum queue capacity. |
batch_size | integer | 16 | Maximum items collected into a batch. |
batch_timeout_ms | integer | 25 | Maximum wait in milliseconds when collecting a batch. |
Path: pubsub. Available with the ReAct graph and HTTP server. The whole section defaults to
kind = memory and capacity = 4096. Supplying the section explicitly requires both fields.
| Field | Type | Default | Description |
|---|---|---|---|
kind | memory | … | Select the in-process event transport. |
capacity | integer | … | Event buffer capacity. |
Path: pubsub when kind = redis.
| Field | Type | Default | Description |
|---|---|---|---|
kind | redis | … | Select the Redis event transport. |
url | string | … | Redis connection URL. |
export AGENT__PUBSUB__KIND=redis
export AGENT__PUBSUB__URL=redis://localhost:6379/1| Manifest value | Configuration behavior |
|---|---|
| A literal value | Embedded as a fixed value. An environment override targeting it fails configuration loading. |
runtime("NAME", default) | Read from the environment, with the embedded default as fallback. |
runtime("NAME") | Read from the environment. A required field must have a value when configuration is loaded. |
For manifest expression syntax, see Runtime values.
Fields supplied by configuration sections also have their own defaults. A field's manifest or component reference defines its settings and defaults.
The prefix is AGENT__. Separate nested field names with __ and write them in uppercase:
| Configuration path | Environment variable |
|---|---|
default_tenant_id | AGENT__DEFAULT_TENANT_ID |
server.port | AGENT__SERVER__PORT |
database.primary | AGENT__DATABASE__PRIMARY |
The field must be present in the binary's generated configuration and permit environment values. For example, server fields are generated when the HTTP server is enabled.
A runtime("NAME", ...) expression also maps NAME to that field. Both the named variable and
its AGENT__... form address the same setting. When both set that setting, the named variable wins.
http_server {
port = runtime("HTTP_PORT", 8080)
}export AGENT__SERVER__PORT=8081
export HTTP_PORT=9090The resolved port is 9090. With both variables unset, it is 8080.
Aliases also support nested keys and list positions using the same __ separator. For example:
network {
policy {
allow = runtime("ALLOW", [])
}
}export ALLOW__0__HOSTNAME=somehost.com
export ALLOW__0__PORT=8080These variables set the first allowed URL pattern's hostname and port. ALLOW__0__PORT addresses
the same field as AGENT__NETWORK__POLICY__ALLOW__0__PORT.
Write scalar values as text. Numbers are parsed into the field's numeric type, and true or
false set boolean fields. Lists and maps accept delimited field paths or JSON values:
export AGENT__DATABASE__AUTO_MIGRATE=false
export AGENT__DATABASE__REPLICAS__0=postgresql://user:password@replica:5432/dbnameNested keys address individual fields. Numeric segments address list positions, as 0 does above.
Alternatively, supply a complete list or map as a JSON value:
export AGENT__DATABASE__REPLICAS='["postgresql://user:password@replica:5432/dbname"]'When both a parent value and a nested value are supplied, the parent is applied first and the nested value is applied afterward.
An empty environment value unsets its configuration path after embedded defaults are applied. The field's type and defaults determine the resulting value or missing-value error.
Configuration loading fails when a required value is missing, a value cannot be parsed into its field's type, or an environment variable attempts to change a fixed value. The error identifies the affected configuration path.
| Settings | Reference |
|---|---|
| Default tenant | runtime |
| Provider credentials and model parameters | Providers |
| Agent settings | agent |
| HTTP listener | http_server |
| Filesystem | filesystem |
| Outbound HTTP | network |
| Logging, telemetry export, and error reporting | Observability |
Observability variables are read separately from the generated configuration and use the names listed in their reference.
© 2026 pogue.dev. All rights reserved.
CC BY 4.0