Configure Your Environment

Configure Your Environment

First time here? See Getting Started for installation, auth, and common --modules combinations. This page is the complete reference for all environment variables and advanced configuration.

---

Environment Variables

Variable	Required	Default	Description
GCP_PROJECT_ID	yes	—	GCP project ID used for all API calls
GOOGLE_APPLICATION_CREDENTIALS	no	ADC	Path to service account key JSON file
ANONYMIZE_ENABLED	no	false	Set true to enable PII scrubbing on all tool outputs
ANONYMIZE_CONFIG_PATH	no	—	Path to YAML anonymization config file
RECOMMENDER_ENABLED	no	false	Set true to enable Cloud Recommender API for Aura Score efficiency signals (requires roles/recommender.viewer)
SAFETY_ENABLED	no	true	Set false to disable the two-step mutation confirmation gate (development only — logged as WARNING)
MCP_TRANSPORT	no	stdio	Set sse to enable HTTP Server-Sent Events mode
PORT	no	8080	HTTP port for SSE mode (Cloud Run sets this automatically)
MCP_BASE_URL	no	—	Public HTTPS URL used in SSE endpoint references (required in SSE mode)
TRACE_BACKEND	no	trace	trace uses Cloud Trace v1 API; monitoring uses a Monitoring metric proxy
GRAPH_TIMEOUT_SECONDS	no	120	Timeout in seconds for gcp_export_architecture_graph and gcp_export_serverless_graph sub-calls

---

CLI Flags

Flag	Default	Description
--modules <list>	(all)	Comma-separated list of module names to enable. Use none for zero tools.
--version	—	Print version string and exit.

---

Selecting Modules

Omit --modules to start all 26 modules. Pass a comma-separated list to restrict startup:

# All modules (default)
GCP_PROJECT_ID=my-project ./aura-tracker-gcp

# Serverless stack only
GCP_PROJECT_ID=my-project ./aura-tracker-gcp \
  --modules cloudrun,functions,pubsub,eventarc,scheduler,workflows,tasks

# GKE-focused
GCP_PROJECT_ID=my-project ./aura-tracker-gcp \
  --modules gke,gke_workloads,gke_mesh,monitoring,logging

# Intelligence features only
GCP_PROJECT_ID=my-project ./aura-tracker-gcp \
  --modules aura,topology,archgraph,coverage

# Zero tools (MCP Resources and Prompts still available)
GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules none

Modules excluded at startup also skip their GCP SDK client initialization, reducing memory usage and narrowing the OAuth token scope.

Full module list: Module Reference

---

Enabling SSE Mode (Cloud Run Deployment)

SSE mode exposes the server as an HTTP endpoint — useful for shared/multi-user environments or when deploying on Cloud Run.

MCP_TRANSPORT=sse \
MCP_BASE_URL=https://aura-tracker.my-org.com \
PORT=8080 \
GCP_PROJECT_ID=my-project \
./aura-tracker-gcp

Deploy to Cloud Run

# Build and push the container
gcloud builds submit --tag gcr.io/MY_PROJECT/aura-tracker-gcp

# Deploy
gcloud run deploy aura-tracker-gcp \
  --image gcr.io/MY_PROJECT/aura-tracker-gcp \
  --set-env-vars GCP_PROJECT_ID=MY_PROJECT,MCP_TRANSPORT=sse \
  --set-env-vars MCP_BASE_URL=https://$(gcloud run services describe aura-tracker-gcp --format 'value(status.url)') \
  --region us-central1

In SSE mode, the MCP endpoint is GET $MCP_BASE_URL/sse and messages are sent to POST $MCP_BASE_URL/message.

---

Anonymization Engine

The anonymization engine scrubs PII and credentials from every tool result before the LLM sees it. Off by default.

Enable with defaults

ANONYMIZE_ENABLED=true GCP_PROJECT_ID=my-project ./aura-tracker-gcp

Enable with a YAML config file

# anonymize.yaml
enabled: true
mode: local          # local | dlp | both
audit_only: false    # true = show what would be masked, mask nothing

# Add custom regex patterns beyond the 5 built-in ones
patterns:
  - name: internal_project_id
    regex: 'proj-[a-z0-9]{8}'
  - name: internal_ticket
    regex: 'JIRA-[0-9]+'

# Keys whose values are never masked (e.g. "name", "region")
json_key_whitelist:
  - name
  - region
  - project_id

ANONYMIZE_ENABLED=true \
ANONYMIZE_CONFIG_PATH=/path/to/anonymize.yaml \
GCP_PROJECT_ID=my-project \
./aura-tracker-gcp

See Security and Safety#PII Scrubbing for built-in patterns and audit mode details.