# Interpolation and secrets

Source: https://dbmcp.haymon.ai/configuration/interpolation/

Reference environment variables with ${} and keep secrets out of config files

Every string **value** in the config file is `${}`-interpolated before it is cast to its type, using the syntax below. Keys are never interpolated. Because casting happens afterwards, `port: ${DB_PORT}` and `read_only: ${READ_ONLY}` work.

| Syntax | Result |
|--------|--------|
| `$VAR`, `${VAR}` | Value of `VAR`; an unset variable becomes `""` and logs a warning |
| `${VAR:-default}` | `default` if `VAR` is unset or empty |
| `${VAR-default}` | `default` if `VAR` is unset |
| `${VAR:+alt}` | `alt` if `VAR` is set and non-empty, otherwise `""` |
| `${VAR+alt}` | `alt` if `VAR` is set, otherwise `""` |
| `${VAR:?message}` | Error if `VAR` is unset or empty |
| `${VAR?message}` | Error if `VAR` is unset |
| `$$` | A literal `$` |

Defaults, alternates, and error messages can nest further references (`${A:-${B:-fallback}}`). A `$` followed by anything other than a name, `{`, or `$` stays literal; a malformed `${` is an error (`invalid interpolation format; escape a literal $ as $$`).

Variables are looked up in the process environment first, then in the last env file that sets them. Any name works, not only `DBMCP_*`, so an MCP client's `env` block or the env file can feed values such as `DB_PASSWORD` into the YAML.

An unset plain reference produces a warning on stderr, for example:

```text
WARN dbmcp_cli::cli: /srv/dbmcp/dbmcp.yaml:5:13: database.password: the "DB_PASSWORD" variable is not set; defaulting to a blank string
```

The resulting empty string is a real value for string settings; at integer, boolean, and list settings it means unset. For required values, prefer `${VAR:?}` (or `${VAR:?message}`) so a missing variable stops startup instead.

## Secrets

Plaintext secrets in the config file work, but keeping them out of it is safer, especially when the file is committed:

- Reference them with `${}` and supply the value from the MCP client's `env` block, the shell, or an env file: `password: ${DB_PASSWORD:?}`. The `:?` form stops startup when the variable is missing instead of silently using an empty password.
- Or set the `DBMCP_*` variable directly (`DBMCP_DB_PASSWORD`, `DBMCP_HTTP_AUTH_TOKEN`, `DBMCP_SSH_PASSWORD`, `DBMCP_SSH_KEY_PASSPHRASE`) and leave the key out of the YAML.
- Restrict the env file's permissions (`chmod 600`).

Type errors never include the offending value, so a mistyped secret is not printed in error output.