Environment variables

Every environment variable Mira reads, what it does, and which deployments need it.

Environment variables are how you wire Mira's secrets into your infrastructure: GitHub App credentials, OpenRouter key, database URL, admin password.

Non-secret review behaviour (model defaults, filter thresholds, walkthrough toggles, etc.) now lives in the deployment-wide mira.yaml. The env vars below are mostly for things you don't want in a checked-in YAML file. MIRA_MODEL and DATABASE_URL are kept as fallbacks for backwards compatibility, but mira.yaml is the recommended place for them.

Required at minimum

Credentials for at least one platform — GitHub, GitLab, or Forgejo — are required. LLM credentials depend on the backend: an OpenRouter/API key for the default OpenAI-compatible provider, the AWS credential chain for Bedrock, or a Codex login for codex-cli. mira serve won't start without one platform configured.

Variable	Description
`OPENROUTER_API_KEY`	Your OpenRouter key when using the default provider. Mira also accepts `OPENAI_API_KEY` as a fallback name. Not required for Bedrock, Codex CLI, or a custom unauthenticated endpoint.
`MIRA_GITHUB_APP_ID`	GitHub: numeric ID from your GitHub App settings page.
`MIRA_GITHUB_PRIVATE_KEY`	GitHub: contents of the `.pem` file generated when you created the GitHub App. The CLI also accepts `@/path/to/key.pem` syntax.
`MIRA_WEBHOOK_SECRET`	GitHub: random 32+ byte string. Must match the value you set in the GitHub App's webhook settings.
`MIRA_GITLAB_TOKEN`	GitLab: a group or project access token with the `api` scope. See the GitLab setup guide.
`MIRA_GITLAB_WEBHOOK_SECRET`	GitLab: secret token, matching the one set on the project/group webhook.
`MIRA_FORGEJO_TOKEN`	Forgejo: an access token with repository read/write. See the Forgejo setup guide.
`MIRA_FORGEJO_WEBHOOK_SECRET`	Forgejo: webhook secret, matching the one set on the repo/org webhook.

GitHub App

Variable	Default	Description
`MIRA_GITHUB_APP_ID`	—	Required. App ID.
`MIRA_GITHUB_PRIVATE_KEY`	—	Required. PEM contents (or `@/path/to/key.pem` via CLI).
`MIRA_WEBHOOK_SECRET`	—	Required. HMAC-SHA256 secret to validate webhooks.
`MIRA_BOT_NAME`	auto-detected from the App's slug	Override the bot `@mention` handle. Leave unset and Mira reads its own slug from `GET /app` at startup; falls back to `miracodeai` only if that call fails.
`MIRA_GITHUB_API_URL`	`https://api.github.com`	Override for GitHub Enterprise Server.
`MIRA_GITHUB_GRAPHQL_URL`	`https://api.github.com/graphql`	Override for GitHub Enterprise Server.

GitLab

Configure these to review GitLab merge requests. GitHub App variables become optional when GitLab is set. Full walkthrough: Set up GitLab.

Variable	Default	Description
`MIRA_GITLAB_TOKEN`	—	Required for GitLab. Group or project access token (`api` scope). The token's user is who Mira comments as.
`MIRA_GITLAB_WEBHOOK_SECRET`	—	Required for GitLab. Secret token compared against each webhook's `X-Gitlab-Token`.
`MIRA_GITLAB_API_URL`	`https://gitlab.com/api/v4`	API base for self-managed instances, e.g. `https://gitlab.acme.com/api/v4`.
`MIRA_BOT_NAME`	auto-detected from the token user	Shared with GitHub. Override the bot `@mention` handle; otherwise Mira reads the token user's username at startup.

Forgejo

Configure these to review Forgejo (or Codeberg) pull requests. GitHub and GitLab variables become optional when Forgejo is set. Full walkthrough: Set up Forgejo.

Variable	Default	Description
`MIRA_FORGEJO_TOKEN`	—	Required for Forgejo. Access token with repository read/write. The token's user is who Mira comments as.
`MIRA_FORGEJO_WEBHOOK_SECRET`	—	Required for Forgejo. HMAC-SHA256 secret compared against each webhook's `X-Forgejo-Signature`.
`MIRA_FORGEJO_API_URL`	`https://codeberg.org/api/v1`	API base for self-hosted instances, e.g. `https://git.acme.com/api/v1`.

LLM

Variable	Default	Description
`OPENROUTER_API_KEY`	—	Required for the default OpenRouter setup. Not used by Bedrock or Codex CLI.
`OPENAI_API_KEY`	—	Accepted as a fallback for `OPENROUTER_API_KEY`. Don't set both.
`MIRA_MODEL`	`anthropic/claude-sonnet-4-6`	Deployment-wide default model. Per-repo `.mira.yaml` overrides this. See Choosing a model.
`MIRA_MODELS_JSON_PATH`	unset (bundled registry)	Path to your own `models.json` to add custom models or override bundled pricing/labels/recommendations — entries merge over the bundled list by id. See Custom pricing and recommendations.
`CODEX_HOME`	Codex CLI default	Directory containing `auth.json` from `codex login` when `llm.provider: codex-cli`. Can instead be set with deployment-only `llm.codex_home`. Mount it read-only in containers.

Database & storage

Variable	Default	Description
`DATABASE_URL`	unset (SQLite)	`postgresql://…` for Postgres. Leave unset to use SQLite at `MIRA_INDEX_DIR`. Always set `?sslmode=require` in production.
`MIRA_INDEX_DIR`	`/data/indexes` (Docker), `./data/indexes` (local)	Where SQLite + per-repo index files live. Persist this directory across container restarts.

Dashboard

Variable	Default	Description
`ADMIN_PASSWORD`	unset	Initial admin password. Leave unset and Mira generates a random one on first start and writes it to `<MIRA_INDEX_DIR>/initial_admin_password` (mode `0600`) — log in, change it, then delete the file. There is no built-in default account.
`MIRA_DASHBOARD_URL`	unset	Public URL of the dashboard, used in PR comment links so reviewers can jump to context pages.
`MIRA_UI_DIST`	`/app/ui_dist` (Docker)	Path to the built React UI. Don't change unless you're hacking on the UI.

Outbound notifications

Variable	Default	Description
`MIRA_WEBHOOK_ALLOWED_HOSTS`	unset	Comma-separated hostnames that outbound notification webhooks may target even though they resolve to a private/internal address. By default any URL resolving to a private, loopback, link-local, reserved, or metadata address is blocked (SSRF guard); list a self-hosted Slack/Mattermost/etc. host here to allow it.

Server

Variable	Default	Description
`PORT`	`8000`	Bind port. Most deploy targets set this for you (Railway, Render).

Tuning the learning loop

These are advanced tuning knobs; defaults are fine for almost everyone. They control when Mira synthesizes a new rule from feedback signals.

Variable	Default	Description
`MIRA_FEEDBACK_MIN_DIR`	`3`	Minimum reject events in a directory before Mira will synthesize a directory-scoped rule.
`MIRA_FEEDBACK_MIN_CAT`	`5`	Minimum reject events in a category before synthesizing a category rule.
`MIRA_FEEDBACK_ACCEPT_MIN`	`5`	Minimum events in a category before accept-rate is considered statistically meaningful.
`MIRA_FEEDBACK_ACCEPT_RATE`	`0.8`	Accept-rate threshold above which a category is treated as "trusted".
`MIRA_HUMAN_SYNTH_MAX`	`50`	Max human review comments fed into rule synthesis per merged PR.
`MIRA_HUMAN_SYNTH_MAX_RULES`	`5`	Max rules Mira will synthesize from a single merged PR.

Tuning the vulnerability poller

Variable	Default	Description
`MIRA_VULN_POLL_INTERVAL`	`3600`	Seconds between OSV.dev polls. Lower = fresher CVE data, more API calls.

A complete `.env`

# GitHub App (or use GitLab/Forgejo below — at least one platform required)
export MIRA_GITHUB_APP_ID=123456
export MIRA_GITHUB_PRIVATE_KEY="$(cat ./private-key.pem)"
export MIRA_WEBHOOK_SECRET=replace-with-32-bytes-of-random

# GitLab (alternative or in addition to GitHub)
# export MIRA_GITLAB_TOKEN=glpat-your-access-token
# export MIRA_GITLAB_WEBHOOK_SECRET=replace-with-32-bytes-of-random

# Forgejo / Codeberg (alternative or in addition to the above)
# export MIRA_FORGEJO_TOKEN=your-access-token
# export MIRA_FORGEJO_WEBHOOK_SECRET=replace-with-32-bytes-of-random

# LLM
export OPENROUTER_API_KEY=sk-or-v1-your-key-here
export MIRA_MODEL=anthropic/claude-sonnet-4-6

# Database (Postgres recommended for production; omit for SQLite)
export DATABASE_URL=postgresql://mira:mira@db.internal:5432/mira?sslmode=require

# Dashboard — omit ADMIN_PASSWORD to get a generated one written to
# <MIRA_INDEX_DIR>/initial_admin_password on first start
export ADMIN_PASSWORD=replace-me
export MIRA_DASHBOARD_URL=https://mira.your-org.com

Never commit .env or private-key.pem. Use your platform's secret manager (Fly secrets, Railway variables, Render env groups, AWS Secrets Manager, Doppler, etc.). See the security hardening checklist.

Environment variables

On this page