Brain configuration

Every MERV_* name also accepts the legacy RESEARCH_PLUGIN_* spelling as a fallback (non-empty MERV_* wins; a legacy-sourced value logs one deprecation line). SUPABASE_* names are read as-is. Booleans: anything not in 0/false/no/off is true, except MERV_ALLOW_OPEN_CONTROL, which is strict and fails the boot on any other value.

Brain: mode, bind, secrets

Variable	Default	Notes
`MERV_MODE`	`local`	`merv-control` forces `control`
`MERV_HTTP_HOST` / `MERV_HTTP_PORT`	`127.0.0.1` / `8787`
`MERV_LOCAL_STATE_DIR`	local staging dir	Local mode’s SQLite and blobs
`MERV_ADMIN_TOKEN`	unset	Required in hosted mode — unset denies every `/api/admin/*` caller. Sent as `X-Admin-Token`
`MERV_WAIT_SECRET`	unset	Required in control mode; ≥ 32 bytes or the boot fails. Signs `wait_url`s
`MERV_WAIT_MAX_STREAMS`	`64`	Concurrent `wait_url` streams
`MERV_TOOL_CALL_RETENTION_DAYS`	`30`
`MERV_RUNS_OBSERVER_CONCURRENCY`	`4`
`MERV_ACTIVITY_STDERR`	`false`

Database

Variable	Default	Notes
`MERV_DB_URL`	unset → SQLite	`postgres://` or `postgresql://` selects the Postgres store; any other scheme fails. Required in control mode. Pooler rules: Deploy the brain

Auth

Variable	Default	Notes
`SUPABASE_URL`, `SUPABASE_JWT_SECRET`	unset	Together build the verifier; both required when auth is on
`SUPABASE_SERVICE_KEY`	unset	Enables `rr_sk_` key lookups and add-member-by-email
`SUPABASE_ANON_KEY`	unset	Published via `/api/meta` for UI sign-in
`MERV_REQUIRE_AUTH`	`false` (`1` in the reference stack)
`MERV_ALLOW_OPEN_CONTROL`	`false`	Must be `1` alongside `MERV_REQUIRE_AUTH=0` to run an open brain; strict parse
`MERV_OAUTH_RESOURCE_URI`	unset	Protected-resource URI advertised to clients
`MERV_OAUTH_CLIENT_TTL_DAYS` / `MERV_OAUTH_MAX_CLIENTS`	`30` / `500`	Dynamic-client registrations
`MERV_ALLOWED_ORIGINS`	empty	Comma-separated CORS origins (no paths)
`MERV_CONTROL_RESTRICT_CORS`	`true`
`MERV_UI_BASE_URL`	unset	Where the UI lives (may include a path)

Blobs and object storage

Variable	Default	Notes
`MERV_BLOB_BUCKET`	unset → local dir	Submitted-byte blob store; required in control mode with the `AWS_*` credentials
`MERV_BLOB_DIR`	default root	Local blob directory
`MERV_STORAGE_PROVIDER`	unset (off)	Heavy object storage; only `s3` accepted
`MERV_STORAGE_BUCKET`	—	Required when provider is `s3`
`MERV_STORAGE_ENDPOINT_URL`, `MERV_STORAGE_REGION`	unset
`MERV_STORAGE_ACCESS_KEY_ID`, `MERV_STORAGE_SECRET_ACCESS_KEY`	fall back to `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`
`MERV_STORAGE_MAX_UPLOAD_BYTES`	50 GiB	Deployment ceiling; projects can lower it
`MERV_MGMT_KEY_PATH`	—	Required in control mode: brain management private key
`MERV_MGMT_PUBLIC_KEY`	adjacent `.pub`

Sandboxes

Variable	Default	Notes
`MERV_EXECUTION_BACKEND`	`lambda_labs`	One provider
`MERV_EXECUTION_BACKENDS`	unset	Comma-separated fleet; overrides the single selection
`MERV_REQUIRE_SANDBOX_BACKEND`	`false`	Refuse to start if the provider is unhealthy
`MERV_PLATFORM_PROVIDERS`	per-provider default (only Lambda on)	Which providers the platform itself offers
`MERV_SANDBOX_REAPER` / `MERV_SANDBOX_REAPER_INTERVAL`	`true` / `30` s	Expiry reaper
`MERV_SANDBOX_IDLE_SECONDS`	`3600`	Blank disables idle reaping
`MERV_SANDBOX_STALE_PROVISION_DEADLINE`	`600` s
`MERV_SANDBOX_REQUEST_WAIT` / `MERV_SANDBOX_STALE`	`45` s / `900` s
`MERV_SANDBOX_ACTIVITY_SAMPLING`	`true`
`MERV_BUDGET_GRACE_SECONDS`	`3600`
`HF_TOKEN`	unset	Pushed to sandboxes post-boot (also as `HUGGING_FACE_HUB_TOKEN`)
Provider credentials	—	See Sandbox providers. Modal reads `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET` directly

Inside a sandbox the bootstrap sets MERV_EXPERIMENT_DIR, RP_EXPERIMENT_DIR, RP_DATASET_DIR, RP_WORKDIR, RP_SESSION_DIR, RP_EXPERIMENT_ID, RP_SANDBOX_ID.

MLflow (off by default)

MERV_MLFLOW_MODE (managed | external), MERV_MLFLOW_TRACKING_URI, MERV_MLFLOW_SERVER_URI, MERV_MLFLOW_DASHBOARD_URL, MERV_MLFLOW_AGENT_KEY, MERV_MLFLOW_SUSPENDED (global kill switch). Agents receive MLFLOW_TRACKING_URI, MLFLOW_TRACKING_USERNAME=rp-agent, MLFLOW_TRACKING_PASSWORD, MLFLOW_EXPERIMENT_NAME (merv/<project_id>/<experiment_id>).

Client, runner, UI

Variable	Default	Notes
`MERV_CONTROL_URL`	machine config → `https://experiments.rapidreview.io`	Which brain a machine targets
`MERV_CLIENT_CONFIG`	`~/.merv/client.json`	Machine config path
`MERV_MCP_KEY`	unset	Static key for headless clients and scripted runners only
`MERV_AGENT_SESSION_KEY`	set by the runner	Short-lived per-child credential
`MERV_RUNNER_BIN_DIR`, `MERV_RUNNER_HOME`, `MERV_RUNNER_PYTHON`, `MERV_RUNNER_BASE_URL`	`~/.merv/bin`, `~/.merv/runner`, newest `python3.x`, `https://rapidreview.io/merv/runner`	Installer knobs
`VITE_API_BASE`, `VITE_API_TOKEN`, `RSUI_API`, `PORT`	same-origin, none, `http://127.0.0.1:8787`, `5173`	UI dev server
`MERV_PYTHON`, `CLAUDE_PLUGIN_DATA`	unset	Which interpreter the `bin/` launchers use

Start

Concepts

Guides

Clients

Reference

Self-host

Brain: mode, bind, secrets

Database

Auth

Blobs and object storage

Sandboxes

MLflow (off by default)

Client, runner, UI

​Brain: mode, bind, secrets

​Database

​Auth

​Blobs and object storage

​Sandboxes

​MLflow (off by default)

​Client, runner, UI

Brain: mode, bind, secrets

Database

Auth

Blobs and object storage

Sandboxes

MLflow (off by default)

Client, runner, UI