Skip to content

Configuration

Jump to bottom
RealmsNetwork edited this page Oct 20, 2026 · 2 revisions

Configuration Reference

MAP reads panel configuration from the server-side environment. Never commit live credentials, paste them into issues, or put them in screenshots.

Multi-panel configuration

Each panel must have a unique ID. Tool calls use that ID to select the intended panel. The current repository's .env.example has working-shape examples with placeholder values.

A minimal multi-panel Pterodactyl configuration can look like this:

MAP_PANELS_JSON=[{"id":"ptero-us","name":"Pterodactyl US","provider":"pterodactyl","panel_version":"1.x","base_url":"https://panel-us.example.net","client_api_key":"REPLACE_CLIENT_KEY","application_api_key":"REPLACE_APPLICATION_KEY"},{"id":"ptero-eu","name":"Pterodactyl EU","provider":"pterodactyl","panel_version":"2.x","base_url":"https://panel-eu.example.net","client_api_key":"REPLACE_CLIENT_KEY","application_api_key":"REPLACE_APPLICATION_KEY","admin_api_key":"REPLACE_ROOT_ADMIN_CLIENT_KEY"}]

These are placeholders, not working credentials. Keep panel IDs simple and use the ID in each tool call. Prefer the deployment configuration helper or a secret store for production deployments.

Provider examples

MCSManager 10.x

{"id":"mcsm","name":"MCSManager","provider":"mcsmanager","panel_version":"10.x","base_url":"https://mcsm.example.net","api_key":"REPLACE_MCSM_KEY","auth_type":"query","auth_query_param":"apikey","api_base_path":"/api"}

For MCSManager 9.x, set panel_version to 9.x so the adapter uses remote_uuid for daemon selection. Both are native API integrations; do not use the Pterodactyl client/application namespaces.

Calagopus

{"id":"calagopus","name":"Calagopus","provider":"calagopus","base_url":"https://calagopus.example.net","api_key":"REPLACE_CALAGOPUS_KEY","auth_type":"bearer","api_base_path":"/api"}

Calagopus API keys and endpoints are not interchangeable with Pterodactyl after migration.

Crafty Controller API v2

{"id":"crafty","name":"Crafty","provider":"crafty","base_url":"https://crafty.example.net","api_key":"REPLACE_CRAFTY_KEY","auth_type":"bearer","api_base_path":"/api/v2"}

Verify the actual token/header conventions for your Crafty version. The generic adapter also supports custom header auth.

PufferPanel OAuth2

{"id":"puffer","name":"PufferPanel","provider":"pufferpanel","base_url":"https://puffer.example.net","oauth_client_id":"REPLACE_CLIENT_ID","oauth_client_secret":"REPLACE_CLIENT_SECRET","oauth_token_path":"/oauth2/token","api_base_path":"/api"}

MAP requests a client-credentials token and caches it until shortly before expiry. Alternatively, where appropriate for your panel, configure a bearer api_key instead.

CubeCoders AMP

{"id":"amp","name":"AMP","provider":"amp","base_url":"https://amp.example.net","auth_type":"amp_session","auth_username":"REPLACE_SERVICE_ACCOUNT","auth_password":"REPLACE_PASSWORD","amp_totp_token":"OPTIONAL_TOTP_TOKEN","api_base_path":"/API"}

AMP uses username/password session login, not a Pterodactyl API key. Treat the cached SESSIONID as a secret.

Generic REST API

{"id":"custom","name":"Custom Panel","provider":"generic_rest","base_url":"https://api.example.net","api_base_path":"/v1","api_key":"REPLACE_API_KEY","auth_type":"header","auth_header":"X-API-Key","auth_scheme":""}

Supported authentication types include bearer, header, query, basic, oauth2_client_credentials, and none. The exact token fields depend on the auth type. For nonstandard headers, use custom_headers only when needed, and never override Host, Authorization, Content-Length, or other protected routing headers.

Common environment settings

Variable Purpose
MAP_TRANSPORT http or stdio; default is http.
MAP_SERVER_NAME Custom MCP server display name.
MAP_HOST Bind address. Prefer 127.0.0.1 behind a reverse proxy.
MAP_PORT HTTP port; current default is 8765.
MAP_MCP_BEARER_TOKEN Strong bearer token for protected HTTP deployments.
MAP_MAX_RESPONSE_CHARS Caps large text fields.
MAP_MAX_REQUEST_BODY_BYTES Caps incoming API request bodies.
MAP_MAX_RESPONSE_BYTES Caps upstream API response bodies.
MAP_MAX_INLINE_FILE_BYTES Caps inline binary uploads/downloads.
MAP_TRUSTED_WINGS_HOSTS Comma-separated exact Wings hostnames allowed for binary transfers.
CURL_CFFI_IMPERSONATE Optional TLS client impersonation profile where supported.

Check the current .env.example for defaults and the full list.

Legacy single-panel environment variables

The legacy PANEL_BASE_URL, PANEL_CLIENT_API_KEY, PANEL_APPLICATION_API_KEY, and PANEL_ADMIN_API_KEY variables remain available for Pterodactyl/Pelican deployments. The legacy PANEL_API_KEY alias maps to a Client key. Non-Pterodactyl providers should use the multi-panel JSON configuration so their authentication and prefix settings are explicit.

URL and path rules

  • Panel base URLs must use HTTPS and cannot contain embedded credentials, query strings, or fragments.
  • API base paths must be relative and cannot contain encoded characters, traversal segments, query strings, or fragments.
  • Request paths are relative to the configured API prefix; pass query parameters separately.
  • Keep port and DNS routing under operator control, and do not configure untrusted external hosts.

Credential handling

  • Use separate keys for development and production.
  • Use the minimum panel-side permissions required.
  • Restrict environment files to root and the service account.
  • Never echo secrets in shell commands or print environment files while troubleshooting.
  • Rotate keys if they enter Git history, a terminal transcript, or logs.

Validate before production

  1. Use fake credentials to validate configuration schema.
  2. Call list_panels and check provider and auth readiness.
  3. Test a harmless read endpoint.
  4. Verify auth errors and that returned values contain no keys or sessions.
  5. Test writes and destructive calls only in a test panel.

Clone this wiki locally