vibeTeX

Configuration

All environment variables for vibeTeX — Overleaf auth, projects, compile, ops/production, and the remote OAuth server.

vibeTeX is configured entirely via environment variables. None are required to compile locally; add the Overleaf git token and a project id to unlock the git bridge. The authoritative source is src/config.ts.

Overleaf & projects

VariableDefaultPurpose
OVERLEAF_GIT_TOKENOverleaf git authentication token (tier 1). Premium feature — project Menu → Git.
OVERLEAF_PROJECT_IDDefault project id (24-hex).
OVERLEAF_PROJECTSalias=projectId comma list for multiple projects (e.g. thesis=abc…,paper=def…).
OVERLEAF_BASE_URLhttps://www.overleaf.comOverleaf web base URL (dashboard / "Open in Overleaf" links).
OVERLEAF_GIT_BASE_URLhttps://git.overleaf.comGit-bridge base URL. Server Pro is <site>/git.
OVERLEAF_SESSION_COOKIEYour overleaf_session2 cookie — only used by the experimental session tier.
VIBETEX_EXPERIMENTAL_SESSIONfalseEnable the unofficial, best-effort session-cookie tier.

Compile

VariableDefaultPurpose
VIBETEX_COMPILE_ENGINEautoauto | latexmk | tectonic | pdflatex | xelatex | lualatex. auto picks the best available binary.
VIBETEX_CLSI_URLSelf-hosted CLSI base URL for remote compile (tier 3 remote).
VIBETEX_LATEX_TIMEOUT_SEC120Hard cap (seconds) on a single local compile run.

Ops / production

VariableDefaultPurpose
VIBETEX_DATA_DIROS data dirWorking-copies + caches location.
VIBETEX_CONTACT_EMAILPolite-pool contact for external lookups (e.g. DOI resolution).
VIBETEX_ALLOW_DELETEfalseMust be true to expose file deletion (second gate alongside the tool's confirm).
VIBETEX_READ_ONLYfalseExpose only non-mutating tools. Recommended for public/remote endpoints.
VIBETEX_LOG_LEVELinfodebug | info | warn | error (stderr only — stdout carries JSON-RPC).
VIBETEX_LOG_FORMATtexttext or json.
VIBETEX_ALLOW_INSECURE_HTTPfalseOverride the guard that forbids binding a non-loopback host without OAuth. Trusted networks only.
VIBETEX_METRICS_ENABLEDfalseExpose a metrics endpoint.
VIBETEX_MCP_RATE_LIMIT_WINDOW_SEC60Rate-limit window for the HTTP MCP endpoint.
VIBETEX_MCP_RATE_LIMIT_MAX120Max requests per window.

Remote OAuth (claude.ai connector)

Turn the Streamable HTTP /mcp endpoint into an OAuth 2.1 + PKCE protected resource so it can be added as a claude.ai custom connector. See Remote hosting for the full walkthrough.

VariableDefaultPurpose
VIBETEX_OAUTH_ENABLEDfalseEnable the built-in OAuth 2.1 authorization server + bearer auth on /mcp.
VIBETEX_PUBLIC_URLPublic HTTPS origin claude.ai reaches (OAuth issuer). Required when enabled; must be HTTPS in production.
VIBETEX_OAUTH_PASSCODEOperator passcode gating consent (≥ 12 chars; openssl rand -base64 24). Required when enabled.
VIBETEX_OAUTH_ACCESS_TTL3600Access-token lifetime (seconds).
VIBETEX_OAUTH_REFRESH_TTL2592000Refresh-token lifetime (seconds).
VIBETEX_ALLOWED_HOSTSComma-separated extra Host values for DNS-rebinding protection (merged with the public host).
VIBETEX_OAUTH_MODEpasscodeCurrently passcode (single operator key).
VIBETEX_OAUTH_STOREmemorymemory or file (persist clients/tokens under the data dir, encrypted at rest).
VIBETEX_OAUTH_TOKEN_SECRETAES-256-GCM key material encrypting stored tokens at rest. Required when store=file (openssl rand -base64 32).

When OAuth is enabled, the HTTP transport binds 0.0.0.0 with DNS-rebinding protection. Put TLS (Caddy / cloudflared / Fly / Vercel) in front; the proxy must forward the public Host header verbatim.

Multiple projects

Pin a default with OVERLEAF_PROJECT_ID, or register aliases:

OVERLEAF_PROJECTS="thesis=5f9a…,paper=60b2…" \
OVERLEAF_GIT_TOKEN=your_token \
npx -y @oscardvs/vibetex

Every tool that operates on a project takes an optional project argument (an alias or a 24-hex id). Omit it to use the default.

On this page