Configuration #

The server is configured entirely through environment variables, set in your MCP client’s server config (the env block).

Authentication #

Two modes; the token wins if both are set:

Personal access token (recommended) — scoped, revocable, and keeps your password out of config files. Create one at Dashboard → Developers → API tokens.

"env": {
  "MICROBOOKS_TOKEN": "<personal access token>"
}

Email + password — the server logs into the auth service itself and manages the token lifecycle (lazy login, proactive refresh, re-login on persistent 401s).

"env": {
  "MICROBOOKS_EMAIL": "you@example.com",
  "MICROBOOKS_PASSWORD": "..."
}

Reference #

Variable	Default	Purpose
`MICROBOOKS_TOKEN`	—	Personal access token (recommended; overrides email/password)
`MICROBOOKS_EMAIL` / `MICROBOOKS_PASSWORD`	—	Auth-service login, when no token is set
`MICROBOOKS_API_URL`	`https://api.microbooks.io`	Books API base URL
`MICROBOOKS_AUTH_URL`	value of `MICROBOOKS_API_URL`	Auth service base URL, if different
`MICROBOOKS_TIMEOUT`	`30`	HTTP timeout in seconds
`MICROBOOKS_REFRESH_MINUTES`	`50`	Proactive re-login interval (email/password mode only)
`MICROBOOKS_CONFIRM_POST`	off	When truthy, `post_transaction` asks you to confirm interactively (via MCP elicitation) before committing

Secrets stay in the env block. The server never logs credential values, and startup errors name only the missing variable. Keep the config file itself out of version control.