| CLIO_CLIENT_ID | Yes | Client ID from your Clio developer application (Settings → Developer Applications) |
| CLIO_CLIENT_SECRET | Yes | Client Secret from your Clio developer application Secret. |
| ENCRYPTION_KEY | No | Optional. Leave unset to auto-generate a key stored in the OS keychain (or ~/.clio-mcp/key.hex as fallback on headless Linux/WSL2). If set, must be a 64-character hex string — it will be migrated to the OS keychain on first use. Secret. |
| CLIO_REDIRECT_PORT | No | Local port for the OAuth callback listener (default: 5678). Change if 5678 is in use. |
| CLIO_REGION | No | Clio data region: 'us' (default, app.clio.com), 'eu' (eu.app.clio.com), 'au' (au.app.clio.com), or 'ca' (ca.app.clio.com). Controls the API and OAuth base URLs. Fixed at Clio account creation; must match the server your firm logs in to. Any other value stops startup. |
| READ_ONLY | No | Optional. 'true', '1' or 'yes' leaves the nine write tools (create_matter, create_note, create_task, update_task, complete_task, create_calendar_entry, log_time_entry, create_activity, upload_document) unregistered so Claude can read Clio but never change it. Works on both transports. |
| CLIO_API_BASE | No | Advanced override for the Clio API base URL (e.g. https://eu.app.clio.com/api/v4). Takes precedence over CLIO_REGION. |
| CLIO_AUTH_URL | No | Override the OAuth authorization endpoint (e.g. https://eu.app.clio.com/oauth/authorize). |
| CLIO_TOKEN_URL | No | Override the OAuth token endpoint (e.g. https://eu.app.clio.com/oauth/token). |
| TOKEN_BROKER_URL | Yes | URL of Oktopeak's hosted token broker for the Clio App Directory listed install. Do not set CLIO_CLIENT_ID/CLIO_CLIENT_SECRET alongside this — the shared app's secret lives only on the broker, never on this machine. |
| ENCRYPTION_KEY | No | Optional. Leave unset to auto-generate a key stored in the OS keychain (or ~/.clio-mcp/key.hex as fallback on headless Linux/WSL2). If set, must be a 64-character hex string — it will be migrated to the OS keychain on first use. Secret. |