Skip to Content
dbmcp
GitHub repository

Interpolation and secrets

Reference environment variables with ${} and keep secrets out of config files

Every string value in the config file is ${}-interpolated before it is cast to its type, using the syntax below. Keys are never interpolated. Because casting happens afterwards, port: ${DB_PORT} and read_only: ${READ_ONLY} work.

SyntaxResult
$VAR, ${VAR}Value of VAR; an unset variable becomes "" and logs a warning
${VAR:-default}default if VAR is unset or empty
${VAR-default}default if VAR is unset
${VAR:+alt}alt if VAR is set and non-empty, otherwise ""
${VAR+alt}alt if VAR is set, otherwise ""
${VAR:?message}Error if VAR is unset or empty
${VAR?message}Error if VAR is unset
$$A literal $

Defaults, alternates, and error messages can nest further references (${A:-${B:-fallback}}). A $ followed by anything other than a name, {, or $ stays literal; a malformed ${ is an error (invalid interpolation format; escape a literal $ as $$).

Variables are looked up in the process environment first, then in the last env file that sets them. Any name works, not only DBMCP_*, so an MCP client's env block or the env file can feed values such as DB_PASSWORD into the YAML.

An unset plain reference produces a warning on stderr, for example:

WARN dbmcp_cli::cli: /srv/dbmcp/dbmcp.yaml:5:13: database.password: the "DB_PASSWORD" variable is not set; defaulting to a blank string

The resulting empty string is a real value for string settings; at integer, boolean, and list settings it means unset. For required values, prefer ${VAR:?} (or ${VAR:?message}) so a missing variable stops startup instead.

Secrets

Plaintext secrets in the config file work, but keeping them out of it is safer, especially when the file is committed:

  • Reference them with ${} and supply the value from the MCP client's env block, the shell, or an env file: password: ${DB_PASSWORD:?}. The :? form stops startup when the variable is missing instead of silently using an empty password.
  • Or set the DBMCP_* variable directly (DBMCP_DB_PASSWORD, DBMCP_HTTP_AUTH_TOKEN, DBMCP_SSH_PASSWORD, DBMCP_SSH_KEY_PASSPHRASE) and leave the key out of the YAML.
  • Restrict the env file's permissions (chmod 600).

Type errors never include the offending value, so a mistyped secret is not printed in error output.

On this page

Secrets