| SCHOLAR_MCP_KV_STORE_URL | No | Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. |
| SCHOLAR_MCP_TOOLS_ALLOW | No | Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. |
| SCHOLAR_MCP_TOOLS_DENY | No | Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. |
| SCHOLAR_MCP_SERVER_NAME | No | Rename this server instance; defaults to the project name. |
| SCHOLAR_MCP_INSTANCE_DESCRIPTION | No | Concise routing context that distinguishes this deployment's material or responsibility. |
| SCHOLAR_MCP_INSTRUCTIONS_EXTRA | No | Deployment-specific behavioral policy added to the generated MCP instructions. |
| SCHOLAR_MCP_INSTRUCTIONS | No | Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). |
| FASTMCP_LOG_LEVEL | No | Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. |
| FASTMCP_ENABLE_RICH_LOGGING | No | Set false for plain or structured JSON log output. |
| SCHOLAR_GITHUB_TOKEN | No | GitHub token used to raise rate limits when fetching standards documents from GitHub. Optional; unauthenticated requests work at reduced limits. Secret. |
| SCHOLAR_MCP_READ_ONLY | No | When true, write-tagged tools (PDF download and conversion cache writes) are hidden. Set false to enable them. |
| SCHOLAR_MCP_S2_API_KEY | No | Semantic Scholar API key. Optional but strongly recommended: unauthenticated requests are limited to ~1 req/s. Request one at https://www.semanticscholar.org/product/api#api-key-form. Secret. |
| SCHOLAR_MCP_DOCLING_URL | No | Base URL of a running docling-serve instance for PDF conversion (e.g. http://localhost:5001). When unset, PDF conversion tools return an error. |
| SCHOLAR_MCP_VLM_API_URL | No | OpenAI-compatible VLM endpoint for formula and figure enrichment during PDF conversion. |
| SCHOLAR_MCP_VLM_API_KEY | No | API key for the VLM endpoint. Secret. |
| SCHOLAR_MCP_VLM_MODEL | No | Model name to use with the VLM endpoint. |
| SCHOLAR_MCP_CACHE_DIR | No | Directory for the SQLite cache database (cache.db) and downloaded PDFs (pdfs/, md/). |
| SCHOLAR_MCP_CONTACT_EMAIL | No | Contact email for the OpenAlex polite pool (improves rate limits). Also enables Unpaywall lookups as a PDF fallback source. |
| SCHOLAR_MCP_EPO_CONSUMER_KEY | No | EPO Open Patent Services consumer key. Optional; patent tools are hidden when unset. Register at https://developers.epo.org/user/register. |
| SCHOLAR_MCP_EPO_CONSUMER_SECRET | No | EPO Open Patent Services consumer secret. Optional; patent tools are hidden when unset. Secret. |
| SCHOLAR_MCP_GOOGLE_BOOKS_API_KEY | No | Google Books API key. Optional; book tools work unauthenticated at reduced rate limits. Secret. |
| SCHOLAR_MCP_JOBS_SOFT_DEADLINE_S | No | Seconds a long-running tool call may run in the foreground before it is promoted to a background job and a job handle is returned instead. |
| SCHOLAR_MCP_JOBS_RESULT_TTL_S | No | Seconds a background-job record (working or finished) is retained for polling before it expires from the store. |
| SCHOLAR_MCP_JOBS_MAX_PER_SUBJECT | No | Maximum live background jobs per calling subject; further promotions are rejected until older records expire. |
| SCHOLAR_MCP_BASE_URL | No | Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset. |
| SCHOLAR_MCP_BEARER_TOKEN | No | Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence. Secret. |
| SCHOLAR_MCP_OIDC_CONFIG_URL | No | OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`. |
| SCHOLAR_MCP_OIDC_CLIENT_ID | No | OIDC client identifier registered with the provider. |
| SCHOLAR_MCP_OIDC_CLIENT_SECRET | No | OIDC client secret registered with the provider. Secret. |
| SCHOLAR_MCP_OIDC_AUDIENCE | No | Expected `aud` claim; tokens issued for another audience are rejected. |
| SCHOLAR_MCP_OIDC_REQUIRED_SCOPES | No | Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode. |
| SCHOLAR_MCP_OIDC_ADVERTISED_SCOPES | No | Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token. |
| SCHOLAR_MCP_OIDC_JWT_SIGNING_KEY | No | Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`. Secret. |
| SCHOLAR_MCP_OIDC_VERIFY_ACCESS_TOKEN | No | Validate the access token instead of the id token. |
| SCHOLAR_MCP_KV_STORE_URL | No | Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. |
| SCHOLAR_MCP_APP_DOMAIN | No | MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`. |
| SCHOLAR_MCP_TOOLS_ALLOW | No | Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. |
| SCHOLAR_MCP_TOOLS_DENY | No | Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. |
| SCHOLAR_MCP_AUTH_MODE | No | Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning. |
| SCHOLAR_MCP_BEARER_TOKENS_FILE | No | Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode. |
| SCHOLAR_MCP_BEARER_DEFAULT_SUBJECT | No | Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects. |
| SCHOLAR_MCP_SERVER_NAME | No | Rename this server instance; defaults to the project name. |
| SCHOLAR_MCP_INSTANCE_DESCRIPTION | No | Concise routing context that distinguishes this deployment's material or responsibility. |
| SCHOLAR_MCP_INSTRUCTIONS_EXTRA | No | Deployment-specific behavioral policy added to the generated MCP instructions. |
| SCHOLAR_MCP_INSTRUCTIONS | No | Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). |
| SCHOLAR_MCP_HTTP_PATH | No | Mount path for the MCP endpoint; the health routes derive their prefix from it. |
| SCHOLAR_MCP_HEALTH_DETAIL | No | How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only). |
| PUID | No | Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match. |
| PGID | No | Run the server process as this GID; pair with PUID to match the owner of a mounted volume. |
| FASTMCP_LOG_LEVEL | No | Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. |
| FASTMCP_ENABLE_RICH_LOGGING | No | Set false for plain or structured JSON log output. |
| SCHOLAR_GITHUB_TOKEN | No | GitHub token used to raise rate limits when fetching standards documents from GitHub. Optional; unauthenticated requests work at reduced limits. Secret. |
| SCHOLAR_MCP_READ_ONLY | No | When true, write-tagged tools (PDF download and conversion cache writes) are hidden. Set false to enable them. |
| SCHOLAR_MCP_S2_API_KEY | No | Semantic Scholar API key. Optional but strongly recommended: unauthenticated requests are limited to ~1 req/s. Request one at https://www.semanticscholar.org/product/api#api-key-form. Secret. |
| SCHOLAR_MCP_DOCLING_URL | No | Base URL of a running docling-serve instance for PDF conversion (e.g. http://localhost:5001). When unset, PDF conversion tools return an error. |
| SCHOLAR_MCP_VLM_API_URL | No | OpenAI-compatible VLM endpoint for formula and figure enrichment during PDF conversion. |
| SCHOLAR_MCP_VLM_API_KEY | No | API key for the VLM endpoint. Secret. |
| SCHOLAR_MCP_VLM_MODEL | No | Model name to use with the VLM endpoint. |
| SCHOLAR_MCP_CACHE_DIR | No | Directory for the SQLite cache database (cache.db) and downloaded PDFs (pdfs/, md/). |
| SCHOLAR_MCP_CONTACT_EMAIL | No | Contact email for the OpenAlex polite pool (improves rate limits). Also enables Unpaywall lookups as a PDF fallback source. |
| SCHOLAR_MCP_EPO_CONSUMER_KEY | No | EPO Open Patent Services consumer key. Optional; patent tools are hidden when unset. Register at https://developers.epo.org/user/register. |
| SCHOLAR_MCP_EPO_CONSUMER_SECRET | No | EPO Open Patent Services consumer secret. Optional; patent tools are hidden when unset. Secret. |
| SCHOLAR_MCP_GOOGLE_BOOKS_API_KEY | No | Google Books API key. Optional; book tools work unauthenticated at reduced rate limits. Secret. |
| SCHOLAR_MCP_JOBS_SOFT_DEADLINE_S | No | Seconds a long-running tool call may run in the foreground before it is promoted to a background job and a job handle is returned instead. |
| SCHOLAR_MCP_JOBS_RESULT_TTL_S | No | Seconds a background-job record (working or finished) is retained for polling before it expires from the store. |
| SCHOLAR_MCP_JOBS_MAX_PER_SUBJECT | No | Maximum live background jobs per calling subject; further promotions are rejected until older records expire. |