Every setting is an environment variable with the ARROWHEAD_ prefix; a local .env file is honored for development. The prose here mirrors the annotated .env.example in the repository, and the defaults shown are the values the server uses when a variable is unset.
Which tool families this deployment exposes: core, docs, coding, or full. A tool outside the active profile is never registered, so it costs no context and a call to it is unknown. The exec family is gated a second time behind ARROWHEAD_EXEC_ENABLED even under coding or full.
JSON policy applied on top of scopes. Empty uses a safe default: any authenticated caller may search, read, and scan the corpus, but write only within its own “<subject>/” namespace. Ignored when auth is off. Example:
Comma-separated hostnames the fetch and retrieve tools may reach, enforced on every redirect hop. Empty allows any public host; the SSRF guard blocks private ranges regardless. Set this to restrict outbound requests to approved destinations.
Variable
Default
ARROWHEAD_EGRESS_ALLOWED_HOSTS
(empty)
Extra ports permitted beyond 80 and 443 (comma-separated). Empty allows only the two web ports, so a public host cannot be used to reach an internal service on a non-web port.
The read tool runs a single vetted read-only statement against this database. The DSN is a SQLAlchemy async URL. Empty leaves the connector unconfigured and the tool refuses to run. A read-only database role is the recommended credential; the connector also runs each query in a read-only transaction under a server-side statement timeout where supported.
Only these collections (comma-separated table names) may be searched, and the tenant filter is the authenticated caller, never an argument. Empty leaves the search tool unconfigured. The column names default to a common convention and are overridable per deployment.
Variable
Default
ARROWHEAD_PGVECTOR_COLLECTIONS
(empty)
ARROWHEAD_PGVECTOR_TENANT_COLUMN
tenant
ARROWHEAD_PGVECTOR_ID_COLUMN
id
ARROWHEAD_PGVECTOR_CONTENT_COLUMN
content
ARROWHEAD_PGVECTOR_EMBEDDING_COLUMN
embedding
Provenance columns written by doc_index and returned by vector_query so a retrieved chunk carries its source document and position as a citation.
Variable
Default
ARROWHEAD_PGVECTOR_SOURCE_COLUMN
source
ARROWHEAD_PGVECTOR_CHUNK_INDEX_COLUMN
chunk_index
content_hash powers diff-aware re-indexing; content_tsv powers the full-text branch of hybrid_query. Both are added by deploy/pgvector_schema.sql.
“deterministic” is a stdlib, offline, non-semantic provider for tests and local development. “http” posts to an OpenAI-compatible endpoint through the SSRF guard; the endpoint host must be on the egress allowlist and the key is supplied here, never forwarded to any other host.
Writing chunks needs a write-capable credential, kept separate from the read-only SQL DSN so the read tools stay least privilege; ingestion refuses to run until it is set. The caps bound how much one call may index.
Variable
Default
ARROWHEAD_VECTOR_WRITE_DSN
(empty)
ARROWHEAD_VECTOR_INDEX_MAX_FILES
500
ARROWHEAD_VECTOR_INDEX_MAX_CHUNKS
5000
ARROWHEAD_VECTOR_INDEX_CHUNK_MAX_CHARS
1500
ARROWHEAD_VECTOR_INDEX_CHUNK_OVERLAP
200
ARROWHEAD_VECTOR_INDEX_TIMEOUT_SECONDS
30.0
Source files chunk along their structure with this wider window. A re-index re-embeds only chunks whose content hash changed; set reuse false to restore the wholesale delete-and-insert on a schema without the content_hash column.
Fuses vector similarity with Postgres full-text rank by reciprocal rank fusion. The candidate multiplier sizes each branch’s pool as a multiple of k. The text search configuration must name an installed Postgres regconfig.
The code tools read a jailed source tree, separate from the document corpus: read-only, with version-control and dependency directories pruned, binary files refused, and per-file and per-walk caps.
“none” keeps the assist tools refusing. “anthropic” posts to the Anthropic Messages API; “openai” posts to any OpenAI-compatible chat-completions URL, which covers Ollama, vLLM, and LM Studio. The key is supplied here and never appears in an error. A local endpoint must be named in ARROWHEAD_LLM_INTERNAL_HOSTS (exact host:port pairs) to be reachable.
Off by default and, even when enabled, denied by the default policy: a deployment opts in twice, by this flag and by granting the execute action. The subprocess runner bounds resources and scrubs the environment but does not block network or filesystem reads; use the container runner for that.
Variable
Default
ARROWHEAD_EXEC_ENABLED
false
ARROWHEAD_EXEC_RUNNER
subprocess
ARROWHEAD_EXEC_CONTAINER_IMAGE
(empty)
ARROWHEAD_EXEC_WORKDIR
exec-scratch
ARROWHEAD_EXEC_CPU_SECONDS
10
ARROWHEAD_EXEC_WALL_SECONDS
30.0
ARROWHEAD_EXEC_TEST_WALL_SECONDS
120.0
ARROWHEAD_EXEC_MEMORY_BYTES
512000000
ARROWHEAD_EXEC_MAX_OUTPUT_BYTES
200000
ARROWHEAD_EXEC_MAX_CODE_BYTES
100000
ARROWHEAD_EXEC_MAX_COPY_BYTES
50000000
ARROWHEAD_EXEC_COPY_MAX_FILES
500
The argv run_tests executes inside the scratch copy, shell-split; empty refuses run_tests.
A working set is a named, owner-scoped collection of pinned references; the packer assembles a token-budgeted, secret-scanned bundle from it plus retrieval. Bounds keep one caller from growing state without limit.
Owner-scoped memories in namespaces plus an exact-key kv store. The backend is a jailed file tree under the memory root by default; setting a Postgres DSN (write-capable, separate from the read-only SQL DSN) moves storage there, with semantic recall once the http embedding provider is configured. Apply deploy/memory_schema.sql first.
Comma-separated absolute http(s) URL prefixes. Empty leaves the notify family unregistered; even an allowlisted target is still SSRF-guarded, and the notify action must additionally be granted in the authz policy.
Set the OTLP/HTTP collector base endpoint to export traces and metrics; leave empty and both stay no-op at no cost. Headers are comma-separated key=value pairs (e.g. a collector API key). Audit logs are always emitted as JSON on stdout for the platform’s log drain regardless of this.
