Environment Variables

For serve, an explicit CLI flag overrides its environment variable, which overrides the corresponding service-configuration field and built-in default. Empty values are explicit overrides. Keep actual credentials in secret-backed environment variables rather than the JSON configuration.

Variable	Consumer	Purpose
AKRITAS_CONFIG	serve	Strict versioned JSON service configuration selected before other environment overrides.
AKRITAS_ADDRESS	serve	HTTP listen address (address, -address).
AKRITAS_BASE_URL	serve	Upstream OpenAI-compatible /v1 URL (base_url, -base-url).
AKRITAS_UPSTREAM_BASE_URL	serve	Deprecated compatibility alias for AKRITAS_BASE_URL; the new name wins when both are set.
AKRITAS_UPSTREAM_MODEL	serve	Upstream model ID (upstream_model, -upstream-model).
AKRITAS_MODEL	serve	Model ID exposed by Akritas (model, -model).
AKRITAS_UPSTREAM_API_KEY_ENV	serve	Name of the variable containing the upstream key (upstream_api_key_env, -upstream-api-key-env).
AKRITAS_API_KEY_ENV	serve	Name of the variable containing the inbound key (api_key_env, -api-key-env).
AKRITAS_SYSTEM_INSTRUCTIONS	serve	Global instruction path (system_instructions, -system-instructions).
AKRITAS_SKILLS_DIR	serve	Selective skill-catalog path (skills_dir, -skills-dir).
AKRITAS_RESPONSE_LANGUAGE	serve	Model prose language (response_language, -response-language).
AKRITAS_RAG_INDEX	serve	RAG index path (rag_index, -rag-index).
AKRITAS_MCP_CONFIG	serve	MCP configuration path (mcp_config, -mcp-config).
AKRITAS_NOTIFICATIONS_CONFIG	serve	Notification receiver configuration path (notifications_config, -notifications-config).
AKRITAS_ALERT_SOURCES_CONFIG	serve	Provider alert-source configuration path (alert_sources_config, -alert-sources-config).
AKRITAS_ALERT_STORE	serve	Alert delivery, event, incident, and investigation-job JSONL path (alert_store, -alert-store).
AKRITAS_PUBLIC_URL	serve	External Akritas base URL used in notification Run links (public_url, -public-url).
AKRITAS_WORKSPACE_CONFIG	serve	Workspace-catalog path (workspace_config, -workspace-config).
AKRITAS_AUDIT_LOG	serve	Audit JSONL path (audit_log, -audit-log).
AKRITAS_SEARCH_TOP_K	serve	RAG result count (search_top_k, -search-top-k).
AKRITAS_RESULT_RUNES	serve	Maximum runes per RAG excerpt (result_runes, -result-runes).
AKRITAS_MAX_TOKENS	serve	Default response-token limit (max_tokens, -max-tokens).
AKRITAS_MAX_TOKENS_LIMIT	serve	Hard response-token limit (max_tokens_limit, -max-tokens-limit).
AKRITAS_MAX_TOOL_CALLS	serve	Read-only tool calls per Run (max_tool_calls, -max-tool-calls).
AKRITAS_MAX_ITERATIONS	serve	Model calls per Run (max_iterations, -max-iterations).
AKRITAS_MAX_TOOL_RESULT_BYTES	serve	Aggregate tool-result byte limit (max_tool_result_bytes, -max-tool-result-bytes).
AKRITAS_MAX_RETRIEVED_CONTEXT_BYTES	serve	Retrieved-context byte limit (max_retrieved_context_bytes, -max-retrieved-context-bytes).
AKRITAS_MAX_CONTEXT_TOKENS	serve	Conservative context-token limit (max_context_tokens, -max-context-tokens).
AKRITAS_MAX_MODEL_TOKENS	serve	Aggregate model-output token limit (max_model_tokens, -max-model-tokens).
AKRITAS_TEMPERATURE	serve	Model sampling temperature (temperature, -temperature).
AKRITAS_REQUEST_TIMEOUT	serve	Go duration for Run and upstream timeout (request_timeout, -request-timeout).
AKRITAS_WORKSPACES	serve	JSON array or comma-separated name=directory values (workspaces, repeatable -workspace).
AKRITAS_CHANGE_VALIDATORS	serve	JSON array or comma-separated validator profiles (change_validators, repeatable -change-validator).
OPENAI_API_KEY	Akritas	Default upstream OpenAI-compatible Bearer key.
AKRITAS_API_KEY	Akritas	Default inbound API Bearer key; empty disables application authentication.
Variable selected by -upstream-api-key-env	Akritas	Overrides the upstream key variable name.
Variable selected by -api-key-env	Akritas	Overrides the inbound key variable name.
Variables selected by notification receiver *_env fields	Akritas	Supply webhook URLs, chat/channel IDs, bot tokens, Bearer tokens, and HMAC secrets.
Variables selected by bot inbound_secret_env and allowlist *_env fields	Akritas	Authenticate provider webhooks and restrict accepted conversation/user IDs; Telegram polling does not require an inbound secret.
Variables selected by alert-source bearer_token_env, hmac_secret_env, or secret_env fields	Akritas	Authenticate one configured monitoring source without placing its secret in JSON.
Variable selected by mcp-victoriametrics -bearer-token-env	VictoriaMetrics MCP child	Supplies its bearer token.
Variables selected by mcp-victoriametrics -username-env and -password-env	VictoriaMetrics MCP child	Supply basic-auth credentials; both are required together.
AKRITAS_REPOSITORY_URL	Documentation build	Overrides the Akritas-Docs repository URL used for page-level Edit links. Unset, empty, and whitespace-only values default to https://github.com/sysroot-io/akritas-docs.

MCP stdio children inherit the Akritas process environment and may also receive explicit values from their JSON env object. Prefer passing only an environment variable name in command arguments; never place a credential directly in args. Validator environments do not inherit API keys.