ctxlayer
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ADMIN_EMAILS | Yes | Comma-separated emails that auto-promote to admin on first sign-in (e.g. "you@acme.com,ops@acme.com"). The one binding set via `wrangler secret put` (do not declare it in [vars]). | |
| ACCESS_POLICY | No | Admission policy for authenticated-but-not-allowlisted identities: `open_domain` (default, allowlists are the gate), `request` (admin-approval queue), or `invite` (invite / join-code only). | open_domain |
| ENCRYPTION_KEY | Yes | 32 random bytes, base64 (generate with `openssl rand -base64 32`). Used for AES-GCM encryption at rest of every user_credentials.ciphertext and every shared_bearer token. Losing or rotating it invalidates every stored upstream credential. | |
| PUBLIC_BASE_URL | No | The public base URL of the deployment (e.g. https://ctxlayer.acme.com). Every IdP callback URL bakes this in. Injected at deploy time from .prod.vars; defaults to https://localhost:8787 for local dev. | |
| GITHUB_CLIENT_ID | No | Client ID of the GitHub OAuth App used for sign-in. | |
| GOOGLE_CLIENT_ID | No | Client ID of the Google OAuth client used for sign-in. | |
| ALERT_WEBHOOK_URL | No | Optional ops alerting: cron failures and unknown queues are POSTed as JSON to this URL. Leave unset to disable. | |
| ALLOWED_GOOGLE_HD | No | Google Workspace hosted domain (e.g. "acme.com"). When set, Google forces the account chooser to that domain and the worker verifies the `hd` claim on the returned id_token. | |
| ALLOWED_GITHUB_ORG | No | GitHub org slug; a user passes the allowlist when their login is in ALLOWED_GITHUB_USERS or they are a member of this org (requires read:org scope). | |
| ALLOWED_GITHUB_USERS | No | Comma-separated GitHub logins allowed to sign in. Injected at deploy time from the gitignored .prod.vars. Leaving it (and ALLOWED_GITHUB_ORG) empty disables GitHub sign-in entirely. | |
| GITHUB_CLIENT_SECRET | No | Client secret of the GitHub OAuth App used for sign-in. | |
| GOOGLE_CLIENT_SECRET | No | Client secret of the Google OAuth client used for sign-in. | |
| ALLOWED_GOOGLE_EMAILS | No | Comma-separated Google emails (case-insensitive) allowed to sign in. Both this and ALLOWED_GOOGLE_HD empty disables Google sign-in. | |
| SESSION_COOKIE_SECRET | Yes | 32+ random bytes, base64 (generate with `openssl rand -base64 32`). Used to HMAC-sign the __Host-ctx_session cookie and the IdP state cookie. Rotation logs every user out. | |
| CI_SMOKE_OAUTH_CLIENT_ID | No | Optional. Only for CI smoke runs that drive an inbound MCP OAuth handshake. | |
| CI_SMOKE_OAUTH_CLIENT_SECRET | No | Optional. Only for CI smoke runs that drive an inbound MCP OAuth handshake. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues