DATABASE_URL="mysql://USER:PASSWORD@HOST:3306/worthpath"
PORT=3100
# Local tunnel testing may use WEB_ORIGIN=*. Production requires an exact origin.
WEB_ORIGIN=http://localhost:5173
COOKIE_SECURE=false
# Canonical OAuth protected resource. Production must use HTTPS.
MCP_PUBLIC_URL=http://localhost:3100/mcp
# Web confirmation page, normally the same origin as WEB_ORIGIN.
MCP_WEB_URL=http://localhost:5173
# Exact browser Origin allowlist; never use *. Non-browser clients may omit Origin.
MCP_ALLOWED_ORIGINS=http://localhost:5173