configure-server

Configure Server — Runtime & Transport Setup

Decides how the MCP Task Orchestrator container is launched and reached: transport, REST API mode, port publishing, config mount, and config-sync. This is a runtime/deployment concern, distinct from quick-start (first-time onboarding narrative) and manage-schemas (workflow gates/traits/ resources:/actor_authentication content inside .taskorchestrator/config.yaml). If the user wants schema or gate changes — including resource-lease declarations — redirect to /manage-schemas instead of proceeding here.

One operator escape hatch worth knowing when launching the container: RESOURCE_LEASES_ENFORCED=false (env, default true) disables resource-lease gate enforcement server-wide — a kill switch for lease contention incidents, same gate-policy category as DEGRADED_MODE_POLICY. Configuring which resources exist and which traits declare them stays in /manage-schemas; this skill only knows the switch.

The full fragment catalog (exact env tuples, loopback caveat, Windows/MSYS caveat, .mcp.json shapes) lives in references/runtime-config.md — this skill's job is the decision flow and rendering, not re-deriving that catalog. Read it before rendering any command.

---

Step 1 — Offer the recommended default first

Before walking the full decision tree, offer the one-tap recommended path via AskUserQuestion:

AskUserQuestion(questions: [{
  question: "How do you want to run the server?",
  header: "Server setup",
  multiSelect: false,
  options: [
    { label: "Recommended default", description: "HTTP + REST API enabled, unauthenticated, loopback-bound (127.0.0.1). Enables config-sync out of the box. Best for a single developer working across multiple projects." },
    { label: "Customize", description: "Walk through transport, REST mode, config mount, and debug logging one at a time." }
  ]
}])

Recommended default → skip straight to Step 5 (Render — HTTP) with: REST = unauthenticated, config mount = none, debug = off. Customize → Step 2.