env.example

# Copy to .env and adjust:  cp env.example .env
# .env is git-ignored. Real environment variables override values in .env.

# --- PostgreSQL eventdb -------------------------------------------------------
# libpq connection URI. Leave empty to use the standard PGHOST, PGPORT, PGUSER,
# PGDATABASE, PGPASSWORD (or ~/.pgpass) variables instead.
EVENTDB_DSN=postgresql://eventdb_ro@localhost:5432/intelmq-events
# Table with IntelMQ events (use v_events if you separate raws, see IntelMQ docs).
EVENTDB_TABLE=events
# Abort any query after this many milliseconds.
EVENTDB_STATEMENT_TIMEOUT_MS=30000
# Maximum rows returned per query to the MCP client / LLM.
EVENTDB_MAX_ROWS=200
# Refuse to run as a PostgreSQL superuser unless set to true. Keep false in production.
EVENTDB_ALLOW_SUPERUSER=false

# --- FastMCP server -------------------------------------------------------------
# stdio: started by an MCP client (Claude Desktop, ...). http: network service.
MCP_TRANSPORT=stdio
# Only used with MCP_TRANSPORT=http. The server has no authentication: keep it on localhost.
MCP_HOST=127.0.0.1
MCP_PORT=8000

# --- Local LLM (any OpenAI-compatible API: ollama, vLLM, llama.cpp, LM Studio) ----
LLM_BASE_URL=http://localhost:11434/v1
# Most local servers ignore the key, but the OpenAI client needs a value.
LLM_API_KEY=ollama
# The model must support tool (function) calling.
LLM_MODEL=qwen3.8:27b-mlx
# Maximum LLM <-> tool round trips per question.
LLM_MAX_STEPS=8
# Seconds to wait for one LLM response.
LLM_TIMEOUT_S=300

# --- Logging ------------------------------------------------------------------
# Every SQL statement and tool call is logged here (audit trail).
EVENTDB_MCP_LOG_FILE=logs/eventdb-mcp.log