Summary
The CLI reference has no environment variables section. The CLI reads several env vars for auto-detection and credential management.
Missing environment variables
Auto-detection variables
| Variable |
Purpose |
GITHUB_SERVER_URL |
Auto-detects GHEC tenants (*.ghe.com) to add to domain allowlist |
GITHUB_API_URL |
Auto-detects GHEC API domains for allowlist |
ENGINE_API_TARGET |
Auto-detects GHES domains (e.g., api.github.mycompany.com) |
API target overrides (also settable via CLI flags)
| Variable |
Default |
Purpose |
COPILOT_API_TARGET |
api.githubcopilot.com |
Copilot API endpoint override |
OPENAI_API_TARGET |
api.openai.com |
OpenAI API endpoint override |
OPENAI_API_BASE_PATH |
- |
OpenAI API base path (e.g., /serving-endpoints) |
ANTHROPIC_API_TARGET |
api.anthropic.com |
Anthropic API endpoint override |
ANTHROPIC_API_BASE_PATH |
- |
Anthropic API base path |
Audit
| Variable |
Purpose |
AWF_AUDIT_DIR |
Fallback audit directory when --audit-dir not specified |
Credential variables (used by API proxy sidecar)
| Variable |
Purpose |
OPENAI_API_KEY |
OpenAI API key — held securely in api-proxy sidecar |
ANTHROPIC_API_KEY |
Anthropic API key — held securely in api-proxy sidecar |
COPILOT_GITHUB_TOKEN |
GitHub Copilot token — held securely in api-proxy sidecar |
These credentials are never exposed to the agent container when --enable-api-proxy is active.
Summary
The CLI reference has no environment variables section. The CLI reads several env vars for auto-detection and credential management.
Missing environment variables
Auto-detection variables
GITHUB_SERVER_URL*.ghe.com) to add to domain allowlistGITHUB_API_URLENGINE_API_TARGETapi.github.mycompany.com)API target overrides (also settable via CLI flags)
COPILOT_API_TARGETapi.githubcopilot.comOPENAI_API_TARGETapi.openai.comOPENAI_API_BASE_PATH/serving-endpoints)ANTHROPIC_API_TARGETapi.anthropic.comANTHROPIC_API_BASE_PATHAudit
AWF_AUDIT_DIR--audit-dirnot specifiedCredential variables (used by API proxy sidecar)
OPENAI_API_KEYANTHROPIC_API_KEYCOPILOT_GITHUB_TOKENThese credentials are never exposed to the agent container when
--enable-api-proxyis active.