Deployment and configuration

Prepare the database, browser origin, secrets, object storage, and sandbox boundary before making MCPKite available to users.

Production checklist

Serve the application and API over HTTPS; set AUTH_COOKIE_SECURE=true.
Set a stable, strong AUTH_JWT_SECRET of at least 32 bytes and a non-default database password.
Keep the UI and API on the same site so the existing SameSite=Lax authentication cookies work.
Configure exact browser origins in CORS_ALLOWED_ORIGINS; never use * with credentials.
Set and securely back up WORKSPACE_SECRET_ENCRYPTION_KEY together with database backups.
Use private production object storage, least-privilege storage credentials, and production-grade PostgreSQL backups.
Do not expose the runner or Docker socket. Restrict database and administration services to trusted networks.
Set the public MCP endpoint origin so the UI shows client-reachable URLs.

Core configuration

Compose reads deployment settings from the root .env; the backend reads private settings from backend/.env; browser-visible Vite settings belong in frontend/.env. Never put secrets in frontend variables: Vite embeds VITE_* values into the browser bundle.

Variable	Purpose
`POSTGRES_PASSWORD`	Database password; replace the local development default.
`AUTH_JWT_SECRET`	Persistent key for signing authentication tokens; use at least 32 bytes.
`AUTH_COOKIE_SECURE`	Set to `true` when serving over HTTPS.
`CORS_ALLOWED_ORIGINS`	Comma-separated exact browser origins allowed to make credentialed requests. Do not use a wildcard.
`WORKSPACE_SECRET_ENCRYPTION_KEY`	Base64-encoded 32-byte key for workspace secrets; keep stable and backed up.
`VITE_API_BASE_URL`	Browser API prefix; defaults to same-origin `/api/v1`.
`VITE_MCP_ENDPOINT_BASE_URL`	Public MCP endpoint origin shown and copied by the UI. Set it to the externally reachable origin.
`RESOURCE_STORAGE_PROVIDER`	`s3` or `azure_blob` for binary resources.

When UI and API use different ports, include the UI's exact origin in CORS settings. The frontend uses credentialed requests. Cross-site cookie authentication is not supported.

Resource storage configuration

Choose one provider and keep its bucket or container private.

Variable	Purpose
`RESOURCE_S3_BUCKET`	Private S3-compatible bucket.
`RESOURCE_S3_REGION`	Bucket region.
`RESOURCE_S3_ENDPOINT_URL`	Optional S3-compatible endpoint; leave empty for Amazon S3.
`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`	Optional paired credentials; when unset, the AWS SDK credential chain is used.
`RESOURCE_AZURE_CONNECTION_STRING`	Required connection string when Azure Blob is selected.
`RESOURCE_AZURE_CONTAINER`	Private Azure Blob container name.

Compose starts S3Mock and Azurite for local development only. For S3, configure the bucket and region; remove or empty the endpoint URL for Amazon S3. For Azure, provide the production connection string and container outside the Compose defaults.

Sandbox limits

All execution and proxy limits are operator settings in the root .env; workspace members cannot change them.

Setting	Local default	What it limits
`TOOL_SANDBOX_CPU_LIMIT`	1	CPU quota per sandbox and proxy container.
`TOOL_SANDBOX_MEMORY_MIB`	256	Sandbox memory in MiB.
`TOOL_SANDBOX_PIDS_LIMIT`	32	Maximum sandbox processes and threads.
`TOOL_SANDBOX_TIMEOUT_SECONDS`	10	Maximum duration of a tool call.
`TOOL_SANDBOX_TMPFS_MIB`	32	Temporary filesystem size in MiB.
`TOOL_SANDBOX_MAX_CONCURRENT_RUNS`	4	Maximum simultaneous tool calls.
`TOOL_SANDBOX_QUEUE_TIMEOUT_SECONDS`	2	Maximum time waiting for a runner slot.
`TOOL_SANDBOX_MAX_SOURCE_BYTES`	20000	Maximum saved function source size in UTF-8 bytes.
`TOOL_SANDBOX_MAX_PARAMETERS`	64	Maximum annotated function parameters.
`TOOL_SANDBOX_MAX_INPUT_BYTES`	65536	Maximum serialized arguments per call.
`TOOL_SANDBOX_MAX_OUTPUT_BYTES`	262144	Maximum serialized result per call.
`TOOL_SANDBOX_PROXY_MAX_CONNECTIONS`	128	Simultaneous proxy connections per invocation.
`TOOL_SANDBOX_PROXY_IDLE_TIMEOUT_SECONDS`	15	Proxy DNS, connection, and idle-read timeout.
`TOOL_SANDBOX_PROXY_MAX_TUNNEL_BYTES`	10485760	Bytes transferred through one proxy connection.
`TOOL_SANDBOX_PROXY_MAX_HEADER_BYTES`	65536	Maximum HTTP proxy request-header size.

Runtime trust boundaries

FastAPI uses one Uvicorn worker because mounted FastMCP apps and lifecycle tasks are process-local. Do not increase the worker count without changing the runtime architecture.

The trusted runner controls Docker and has access to the Docker daemon socket. It is not exposed as a host port and must only be run on a host you trust. Tool code runs in an ephemeral non-root sandbox with no Docker access, host mounts, or deployment credentials. The per-call network includes only the sandbox and its egress proxy; the proxy resolves destinations and rejects non-public IP addresses.

Use HTTPS, strong credentials, private database and storage networks, and carefully scoped access. Never share authenticated Inspector URLs, bearer tokens, workspace secrets, or redacted logs containing credentials.