config.example.toml

[server]
bind = "127.0.0.1:8787"
public_base_url = "https://your-tailnet-or-funnel-hostname"
mcp_path = "/mcp"

[tools]
prefix = "agentbox_"

[exec]
default_workdir = "/home/agent"
default_shell = "/bin/bash"
login_default = true
default_yield_time_ms = 1000
min_yield_time_ms = 50
max_yield_time_ms = 30000
default_max_output_tokens = 6000
hard_max_output_tokens = 50000
max_processes = 64
session_idle_ttl_seconds = 86400
overlay_codex_env = true
deterministic_session_ids = false

[auth]
# Options: none, static_bearer, fake_oauth, oauth_jwks.
mode = "static_bearer"

[auth.static_bearer]
token_env = "agentbox_MCP_TOKEN"
# Optional: hardcode a token in the config instead of using token_env.
# Treat this file like a password if you set it.
# token = "replace-with-a-long-random-token"

[auth.fake_oauth]
client_id = "chatgpt-agentbox"
client_credential_env = "agentbox_FAKE_OAUTH_CLIENT_CREDENTIAL"
# client_credential = "replace-with-a-long-random-client-credential"
allowed_redirect_uri_prefixes = ["https://chatgpt.com/connector/oauth/"]
allowed_redirect_uris = ["https://chatgpt.com/connector_platform_oauth_redirect"]

[auth.oauth]
resource = "https://your-tailnet-or-funnel-hostname"
issuer = "https://your-tailnet-or-funnel-hostname"
# Used by oauth_jwks. Unused by fake_oauth.
jwks_url = "https://your-tailnet-or-funnel-hostname/.well-known/jwks.json"
audience = "https://your-tailnet-or-funnel-hostname"
required_scopes = ["agentbox:exec"]

[skills]
enabled = true
roots = [
  "/home/agent/.agents",
  "/opt/agentbox/skills",
]

[bootstrap]
project_roots = [
  "/home/agent/dev",
  "/srv/projects",
]