Skip to content
Vispero CORADocs

Environment variables

The variables cora and cora-mcp read, in the order cora info reports them, each that is set on a line of its own and the names of the others on one line, each with its kind. An empty variable counts as unset, unless its entry says an empty value counts as set. The variables that only tell a CI provider or a coding agent are left out: cora info reports what it detects.

  • CORA_BASE_URL (setting): Sets baseUrl.
  • CORA_POLICY_FAIL_ON (setting): Sets policy.failOn.
  • CORA_BROWSER_STORAGE_STATE (setting): Sets browser.storageState.
  • CORA_BROWSER_SETUP_TIMEOUT (setting): Sets browser.setupTimeout.
  • CORA_PAGE_TIMEOUT (setting): Sets page.timeout.
  • CORA_PAGE_RETRIES (setting): Sets page.retries.
  • CORA_SOURCE_STAMPS (setting): Sets sourceStamps.
  • CORA_SERVER_COMMAND (setting): Sets server.command.
  • CORA_SERVER_URL (setting): Sets server.url.
  • CORA_SERVER_TIMEOUT (setting): Sets server.timeout.
  • CORA_SERVER_REUSE_EXISTING_SERVER (setting): Sets server.reuseExistingServer.
  • CORA_LOG_LEVEL (setting): Sets log.level.
  • CORA_LOG_FILE (setting): Sets log.file.
  • CORA_LOG_FORMAT (setting): Sets log.format.
  • CORA_LOG_FILES_KEPT (setting): Sets log.filesKept.
  • CORA_SCREEN_READER (setting): Sets screenReader.
  • CORA_STATE_DIRECTORY (setting): Sets stateDirectory.
  • CORA_MCP_HEADLESS (setting): Sets mcp.headless.
  • CORA_MCP_CALL_TIMEOUT (setting): Sets mcp.callTimeout.
  • CORA_MCP_ACTION_TIMEOUT (setting): Sets mcp.actionTimeout.
  • CORA_MCP_NAVIGATION_TIMEOUT (setting): Sets mcp.navigationTimeout.
  • CORA_SERVICE_REQUEST_TIMEOUT (setting): Sets service.requestTimeout.
  • CORA_BROWSER_HEADED (setting): Sets browser.headed.
  • CORA_NO_DEFER (own): 1 runs the invoked cora rather than the project’s.
  • CORA_TOKEN (own): An account token, which CORA uses over the credentials file.
  • CI (machine): A CI run, which writes the report directory and keeps stderr plain and static unless color is forced; false turns detection off.
  • RUNNER_DEBUG (diagnostics): GitHub Actions debug logging, which logs at debug.
  • GITHUB_STEP_SUMMARY (machine): Under GitHub Actions, the step’s summary file, which the CLI appends to.
  • SYSTEM_DEBUG (diagnostics): Azure Pipelines diagnostics, which log at debug.
  • XDG_CACHE_HOME (machine): On Linux, the base of Playwright’s download directory.
  • LOCALAPPDATA (machine): On Windows, the base of Playwright’s download directory, and a Chrome location.
  • XDG_CONFIG_HOME (machine): On Linux, the base of the per-user config directory.
  • APPDATA (machine): On Windows, the base of the per-user config directory.
  • PROGRAMFILES (machine): On Windows, a Chrome location.
  • PROGRAMFILES(X86) (machine): On Windows, a Chrome location.
  • NO_COLOR (machine): Turns color off on stderr, in help and in the reports for people on stdout, such as cora status’s. Node.js before 24.4 takes an empty one as set too, where Node.js 24.4 and later ignore it. cora --color or cora --no-color, and color in the user config, outrank it.
  • FORCE_COLOR (machine): Turns color on for stderr, help and the reports for people on stdout, in CI and under a coding agent too, when it is empty, 1, true, 2 or 3, and off when it is anything else, such as 0 or false. An empty value counts as set. cora --color or cora --no-color, and color in the user config, outrank it.
  • NODE_DISABLE_COLORS (machine): Node.js’s own form of NO_COLOR, which it reads as it reads NO_COLOR. cora --color or cora --no-color, and color in the user config, outrank it.
  • TERM (machine): The terminal’s type, which decides whether CORA’s output for people at a terminal draws Unicode glyphs, such as ✓: outside Windows, every terminal draws them but the Linux console, of type linux; on Windows, those of type xterm-256color, alacritty, rxvt-unicode and rxvt-unicode-256color do.
  • TERM_PROGRAM (machine): The terminal’s program, where, on Windows, vscode and Terminus-Sublime draw CORA’s Unicode glyphs.
  • WT_SESSION (machine): On Windows, Windows Terminal’s session, which draws CORA’s Unicode glyphs.
  • TERMINUS_SUBLIME (machine): On Windows, Terminus before 0.2.27, which draws CORA’s Unicode glyphs.
  • ConEmuTask (machine): On Windows, ConEmu’s task, where {cmd::Cmder}, ConEmu and cmder’s, draws CORA’s Unicode glyphs.
  • TERMINAL_EMULATOR (machine): On Windows, the terminal emulator, where JetBrains-JediTerm, a JetBrains IDE’s, draws CORA’s Unicode glyphs.
  • ACCESSIBLE (machine): Turns the screen-reader preference on, as other tools’ prompts read it, when it is set to anything but 0 or false. CORA_SCREEN_READER, and screenReader in the user config, outrank it.
  • PLAYWRIGHT_BROWSERS_PATH (machine): Playwright’s download directory; 0 puts it inside playwright-core.
  • npm_config_playwright_browsers_path (machine): npm’s form of PLAYWRIGHT_BROWSERS_PATH, which Playwright reads in its place when it is unset.
  • npm_package_config_playwright_browsers_path (machine): A package’s config form of PLAYWRIGHT_BROWSERS_PATH, which Playwright reads when it and npm’s form are unset.
  • INIT_CWD (machine): Where a package manager ran a script from, which a relative PLAYWRIGHT_BROWSERS_PATH is resolved against.
  • npm_config_init_cwd (machine): npm’s form of INIT_CWD, which Playwright reads in its place when it is unset.
  • npm_package_config_init_cwd (machine): A package’s config form of INIT_CWD, which Playwright reads when it and npm’s form are unset.
  • NODE_OPTIONS (machine): Options Node.js applies to every Node.js program as it starts, CORA’s own included.
  • DEBUG (diagnostics): Playwright’s and playwright-mcp’s diagnostics on stderr, outside CORA’s redaction.
  • DEBUG_FILE (diagnostics): A file that takes DEBUG’s diagnostics in place of stderr, outside CORA’s redaction.
  • NODE_DEBUG (diagnostics): Node.js’s and its modules’ diagnostics on stderr, outside CORA’s redaction.
  • PWDEBUGIMPL (diagnostics): Playwright’s internal stack frames in its errors.
  • JITI_DEBUG (diagnostics): jiti’s diagnostics as it loads cora.config.ts, on stderr outside CORA’s redaction.
  • JITI_SOURCE_MAPS (diagnostics): Source maps in the code jiti transpiles from cora.config.ts, which stacks follow under Node.js’s --enable-source-maps.
  • AI_AGENT (machine): Names the coding agent running cora.
  • CLAUDE_CODE_CHILD_SESSION (machine): Claude Code’s mark on the commands and hooks it runs, which shows Claude Code runs cora where CLAUDECODE alone does not.
  • JUNIE_SHIM_PATH (machine): Junie’s mark on what its CLI runs, which shows Junie runs cora where JUNIE_DATA alone does not.
  • CODEX_HOME (machine): Codex’s home directory, ~/.codex by default, where cora hook looks in agents/ for CORA’s fixer agent for Codex.
  • PATH (machine): The directories cora init searches for coding agents’ CLIs.
  • PATHEXT (machine): On Windows, the extensions cora init’s search of PATH tries.
  • HTTPS_PROXY (network): The proxy for CORA’s requests to its service.
  • https_proxy (network): HTTPS_PROXY in lower case, which wins over it.
  • HTTP_PROXY (network): The proxy for those requests when neither HTTPS_PROXY nor https_proxy is set.
  • http_proxy (network): HTTP_PROXY in lower case, which wins over it.
  • NO_PROXY (network): The hosts those requests reach without a proxy.
  • no_proxy (network): NO_PROXY in lower case, which wins over it.
  • NODE_EXTRA_CA_CERTS (trust): A PEM file of root certificates those requests trust beside the others.
  • SSL_CERT_FILE (trust): On Linux, the file of the system’s root certificates those requests trust; an empty one names none. An empty value counts as set.
  • SSL_CERT_DIR (trust): On Linux, the directory of the system’s root certificates, as SSL_CERT_FILE; an empty one names none. An empty value counts as set.
  • NODE_TLS_REJECT_UNAUTHORIZED (trust): 0 turns certificate checking off for every Node.js program, CORA’s requests included, which CORA warns of as it starts.
  • DISPLAY (machine): On Linux, an X11 display, where cora auth login opens its page in the browser, and where cora-mcp’s browser and cora scan --headed show a window.
  • WAYLAND_DISPLAY (machine): A Wayland display, as DISPLAY.
  • WSL_DISTRO_NAME (machine): WSL, where cora auth login opens its page in Windows’ browser.
  • SSH_CONNECTION (machine): An SSH session, where, on macOS and Windows, cora auth login opens no browser, and neither cora scan --headed nor cora-mcp’s browser shows a window.
  • SSH_CLIENT (machine): An SSH session, as SSH_CONNECTION.
  • SSH_TTY (machine): An SSH session with a terminal, as SSH_CONNECTION.

Kinds

Section titled “Kinds”

A variable’s kind says what it is to CORA. A setting’s variables and CORA’s own are CORA’s to define. Each other kind is set outside CORA, by you or by the machine, about your machine, network, trust or diagnostics, and cora and cora-mcp honor it as they find it. A variable that would change what a scan finds or reports, or stop it working, is unset instead, and a value you need to vary is a setting.

  • setting: Sets a setting a config file holds, for one run or one machine.
  • own: CORA’s own, for what no config file holds, such as the account token.
  • machine: Describes the machine and how CORA was started: its directories, terminal and display, Node.js’s options, and the CI run, coding agent or session that runs CORA.
  • network: Names the proxies CORA’s requests to its service go through.
  • trust: Decides which certificates those requests trust, and whether they check them at all.
  • diagnostics: Turns on diagnostics, CORA’s own or a library’s, some of them written outside CORA’s redaction.

Variables cora unsets

Section titled “Variables cora unsets”

cora and cora-mcp unset these before anything loads Playwright, since each would change what a scan finds or reports, or stop it working, and no option of Playwright’s overrides it. Were it set, each would do this:

  • PWDEBUG: read as Playwright loads: makes every launch headed, opens the Playwright Inspector, pauses each new context and turns off Playwright’s default timeouts
  • npm_config_pwdebug: npm’s form of PWDEBUG, which Playwright reads in its place when PWDEBUG is unset
  • npm_package_config_pwdebug: a package’s config form of PWDEBUG, which Playwright reads when PWDEBUG and npm_config_pwdebug are unset
  • PWTEST_UNDER_TEST: read as Playwright loads: runs Playwright as its own test suite does, where checks a release skips throw, and the script it puts in each page and some of its defaults change
  • npm_config_pwtest_under_test: npm’s form of PWTEST_UNDER_TEST, which Playwright reads in its place when PWTEST_UNDER_TEST is unset
  • npm_package_config_pwtest_under_test: a package’s config form of PWTEST_UNDER_TEST, which Playwright reads when PWTEST_UNDER_TEST and npm_config_pwtest_under_test are unset
  • SELENIUM_REMOTE_URL: connects each Chromium launch to a Selenium Grid in place of the local Chrome
  • PLAYWRIGHT_DISABLE_SERVICE_WORKER_NETWORK: sends service workers’ requests without the context’s extra headers and HTTP credentials, which a config’s setup may sign in with
  • PLAYWRIGHT_SKIP_NAVIGATION_CHECK: makes each action skip its wait for a navigation in progress, so a config’s setup, a page’s readiness wait or an agent’s action can act on the document being replaced
  • PLAYWRIGHT_SKIP_INERT_CHECK: treats inert content, and the page outside an open modal dialog, as content a person can reach: an agent’s snapshot lists it, and a config’s setup or an agent’s action acts on it without waiting for it to stop being inert
  • PLAYWRIGHT_SKIP_DIALOG_CHECK: does what PLAYWRIGHT_SKIP_INERT_CHECK does for the page outside an open modal dialog, though not for content marked inert
  • PW_CHROMIUM_ATTACH_TO_OTHER: makes each of Chrome’s targets of the type other a page of the context, which a run kept open then waits on
  • PW_TEST_SCREENSHOT_NO_FONTS_READY: takes each screenshot without waiting for the page’s fonts to load, so text can show in a fallback font
  • PLAYWRIGHT_LEGACY_SCREENSHOT: launches Chromium without the feature Playwright takes screenshots through, so they are captured the older way