Configuration

Configuration

delamain's Python gateway reads configuration from an optional config.toml file plus environment variables. The Java backend is configured entirely via CLI flags and environment variables (there is no Java-side TOML file). See Deployment for how these get mounted/passed in each deployment method, and FAQ for the token model explained in plain language.

Precedence

Environment variable > .env (Compose) > TOML file > built-in default.

Concretely, in gateway/main.py:

• The JADX-backend token (jadx_token) resolves as DELAMAIN_AUTH_TOKEN env → [defaults].jadx_token in TOML → --auth-token CLI flag.
• The MCP client token whitelist resolves as DELAMAIN_AUTH_TOKENS env (comma/newline separated) merged with [server] allowed_tokens in TOML — both contribute, duplicates are deduped, and the process refuses to start if the merged list is empty.
• The JADX backend host/port resolves as --jadx host:port CLI flag > [jadx] TOML section > default 127.0.0.1:8650.

The TOML file itself is loaded once at startup with no hot-reload (ConfigLoader.load() in gateway/src/config/config_loader.py); if the file path passed via --config doesn't exist, the gateway logs a warning and falls back to all-defaults rather than failing.

The config.toml file

Copy config.toml.example to get started, then mount it read-only at /data/config/config.toml (Compose does this automatically via JADX_CONFIG_DIR; docker/entrypoint.sh passes --config /data/config/config.toml to the gateway only if that file exists).

[server]
host = "0.0.0.0"
port = 8651
# transfer_public_url = "http://your-host:8651"
allowed_tokens = [
    # "replace-with-a-random-32-plus-character-secret",
]

[defaults]
# jadx_token = ""

[jadx]
host = "127.0.0.1"
port = 8650
# token = ""

Every section is optional — an absent key just falls back to the dataclass default in config_loader.py; nothing in this file is required for the gateway to start (though at least one MCP client token must come from somewhere, TOML or env).

Environment variable reference

Variable	Where it applies	Default	Purpose
DELAMAIN_AUTH_TOKENS	Gateway (Python)	— (required)	Comma/newline-separated whitelist of MCP client bearer tokens. Any token in the list grants full, identical access — there is no per-token role. Compose fails fast if unset.
DELAMAIN_AUTH_TOKEN	Gateway↔Java, bare-metal only	—	Singular internal token the gateway presents to the Java backend. Only relevant when running the two processes yourself; the fused container doesn't need it (see JADX_INTERNAL_TOKEN).
JADX_INTERNAL_TOKEN	Fused container only	random, auto-generated	The internal gateway↔Java token inside the container. docker/entrypoint.sh generates one if unset and shares it between both in-container processes; never exposed to MCP clients.
JADX_FILE_ROOT	Java backend	/apks (in the image)	Sandbox root for load_file and out-of-band uploads. If unset and no /apks exists, load_file and the transfer endpoints are disabled entirely.
JADX_TRANSFER_MAX_MB	Java backend	1024	Max size (MB) of a single out-of-band upload; larger uploads are rejected (HTTP 413 mid-stream, or at token-creation time if size_bytes is given upfront).
JADX_TRANSFER_TTL_MIN	Java backend	30	Minutes a create_transfer_token token stays valid before expiring.
JADX_TRANSFER_PUBLIC_URL	Gateway	—	This gateway's own externally-reachable base URL, used to build create_transfer_token's upload_url when the bind address (e.g. 0.0.0.0) isn't itself a usable client-facing hostname. Equivalent TOML key: [server] transfer_public_url (env wins).
JADX_CACHE_MAX_GB	Java backend	50	LRU quota (GB) for the on-disk decompile-index cache; 0 disables eviction (unbounded growth).
JADX_APK_DIR	Compose only (host-side)	/data/apks	Host directory mounted read-write at /apks in the container.
JADX_CONFIG_DIR	Compose only (host-side)	/data/config	Host directory mounted read-only at /data/config, expected to contain config.toml.
JADX_GATEWAY_PORT	Compose only (host-side)	8651	Host-side port published for the gateway.
DELAMAIN_PORT	Java backend (bare-metal)	8650	Java server listen port.
DELAMAIN_WARMUP_ON_START	Java backend	true	Auto-starts background warmup (Phase 1 decompile + Phase 2 index build) once the server is up.
DELAMAIN_WARMUP_DECOMPILE_WORKERS	Java backend	8	Phase 1 parallel decompile worker count.
DELAMAIN_WARMUP_INDEX_WORKERS	Java backend	—	Phase 2 (trigram/shard build) worker count.
DELAMAIN_CODE_INDEX_ENABLED	Java backend	true	Toggles the in-memory trigram code index.
DELAMAIN_CODE_INDEX_MAX_TRIGRAMS	Java backend	200000	Trigram cap — an OOM guard on the in-memory index.
DELAMAIN_CODE_INDEX_EVICTION_ENABLED	Java backend	—	Enables heap-pressure eviction for the trigram index.
DELAMAIN_INLINE_RESPONSE_MAX_BYTES	Java backend	—	Inline response size cap before a tool must fall back to batching/chunking (see the "response too large" signal in docs/mcp-tool-design-guide.md).
DELAMAIN_LOG_LEVEL	Gateway	INFO	Python logging level (stderr only, no file logs).

The three-token model

delamain has exactly three distinct tokens; mixing them up is the most common configuration mistake. See FAQ for a task-oriented walkthrough of "which token do I use where."

Token	Env var	Scope	Where it's needed
MCP client whitelist (plural)	DELAMAIN_AUTH_TOKENS	Gateway ↔ any MCP client (AI agent)	Always required. Any value in this comma/newline list authenticates a client with full, equal access — there is no per-token role.
Internal gateway↔Java token (singular, bare-metal)	DELAMAIN_AUTH_TOKEN	Gateway process ↔ Java backend process, when run as two separate processes yourself	Only used in bare-metal/dev runs; irrelevant to the fused container.
Internal container token	JADX_INTERNAL_TOKEN	Gateway ↔ Java backend, inside the fused container only	Auto-generated by docker/entrypoint.sh if unset; never presented to an MCP client. Set only if you need a fixed, known internal value (e.g. for debugging).

In the fused Compose/docker run deployment, an external caller only ever needs a DELAMAIN_AUTH_TOKENS value — the internal token is entirely container-local and self-managing.