Configuration reference

Node startup reads process environment variables and does not automatically load .env. Export variables or inject them through secret storage. Compose uses its selected environment file for interpolation. Use 0/1 for boolean runtime flags.

Local server

Variable	Default / purpose
`PORT`	`3737`; choose a free port per instance
`HOST`	`127.0.0.1` in development, `0.0.0.0` in production; remote binding requires access control
`QA_SUITE_DATA_DIR`	Checkout `data/`; use a distinct absolute private path per instance
`QA_SUITE_PUBLIC_URL`	Unset locally; explicit HTTPS origin required in production, without path/query/credentials
`NODE_ENV`	Production requires built assets, public origin and credentials
`BUGSPRAY_ADMIN_PASSWORD`	Unset for ordinary loopback; at least 12 characters when access control is enabled
`QA_SUITE_TOKEN`	Unset for ordinary loopback; bootstrap/internal REST token, at least 32 characters with access control
`BUGSPRAY_ENABLE_REPRO_EXECUTION`	Disabled by default; explicitly use `0` for evaluation or `1` for reviewed execution
`BUGSPRAY_ENABLE_LOCAL_AUTH_BROWSER`	Enabled in development, disabled in production; visible local authentication requires Chromium
`QA_SUITE_API_ONLY`	`1` omits the frontend for isolated API checks
`PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH`	Optional explicit browser path

Development-only BUGSPRAY_UI_PREVIEW=1 uses synthetic display fixtures and blocks provider/repro actions. BUGSPRAY_ENABLE_HOSTED_MCP_SETUP=1 exposes hosted setup controls locally without provisioning services. Neither establishes hosted capability or production readiness.

Clients

Variable	Consumer
`BUGSPRAY_URL`	Stdio MCP bridge origin; default `http://127.0.0.1:3737`
`QA_SUITE_URL`	Submission CLI full endpoint; default `http://localhost:3737/api/findings`
`QA_SUITE_TOKEN`	Securely injected credential for a protected REST/stdio bridge connection

Changing a client URL does not change server binding. MCP-scoped hosted service tokens are distinct from the bootstrap REST token.

Optional integrations and suites

Direct Node providers use BUGSPRAY_LINEAR_CLIENT_ID / BUGSPRAY_LINEAR_CLIENT_SECRET, BUGSPRAY_SLACK_CLIENT_ID / BUGSPRAY_SLACK_CLIENT_SECRET, or BUGSPRAY_GITHUB_APP_ID, BUGSPRAY_GITHUB_APP_SLUG and BUGSPRAY_GITHUB_APP_PRIVATE_KEY. Signed webhook delivery also needs BUGSPRAY_GITHUB_WEBHOOK_SECRET. Complete Settings connection/selection after credentials are configured. Suite discovery defaults use BUGSPRAY_TENANT_ID (local local), BUGSPRAY_SUITE_PRODUCT_ID and BUGSPRAY_SUITE_MANIFEST_PATH. Administrator-saved discovery settings can take precedence. BUGSPRAY_SUITE_PLANNING_POLICY is trusted experimental planning policy, not execution approval.

Hosted operators

BUGSPRAY_OPERATIONS_DIR selects the existing absolute private manifest directory outside the repository. BUGSPRAY_TENANT_SECRETS_DIR selects private recovery bundles. Cloudflare API credentials, Access configuration, per-tenant encryption, broker trust and backup keys belong to operator-managed secret/configuration stores. None is required for local startup. Use the complete maintained configuration reference and executable startup/tenant schemas when adding settings. Do not direct real tokens to development API endpoint overrides.

Self-hosting

Reference

Project

Configuration reference

Local server

Clients

Optional integrations and suites

Hosted operators

​Local server

​Clients

​Optional integrations and suites

​Hosted operators

Local server

Clients

Optional integrations and suites

Hosted operators