Configuration

Revue has one decision-plane implementation with two deployments. Use browser approval for the hosted Cloudflare plane, or run the same /api/v1 service locally without an account. Most users should use the CLI rather than edit environment variables directly.

Read Local vs hosted before switching planes. Use revue connect <harness> to generate MCP configuration for the active plane.

Manager launcher

Setting	How it is set	Controls
Deployment	`revue login` or `revue service start`	Hosted Cloudflare plane or account-free loopback plane
Machine credential	Browser approval or generated local secrets	Workspace-scoped ingestion, lookup, ask, and route authority; no API key to paste during approval
Human credential	Browser approval or generated local owner secret	Human-only answer, dismissal, correction, and manager-delegation authority
Revue API	Default service, `revue login --api-url <url>`, or local service	Configured `/api/v1` endpoint
Workspace	Resolved during login or generated locally	Tenant for manager, child, Orb, and subagent state
Child effort tier	`revue child --effort <tier>`	Reasoning-effort tier for a launched child (`none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`); defaults to `medium`, priced by task ambiguity

The saved machine config lives under ~/.config/revue. Child and Orb launches receive adapter/read/route authority only; manager delegation tokens are scoped to the manager run and manager Amp thread.

Local service

revue service start
revue service status
revue service stop

start creates the local workspace and distinct machine, human, and delegation secrets, writes REVUE_SERVICE_MODE=local, and starts a detached process bound to 127.0.0.1:47838. It remains running after the terminal closes, but it does not install a launchd/systemd unit or restart after reboot. Do not expose the port to a LAN or public network.

Path	Contents
`~/.config/revue/local-service.json`	Local workspace, machine/human/delegation secrets, port, and event-log path
`~/.config/revue/local-service.pid`	Authenticated process-liveness state
`~/.local/state/revue/service.log`	Local service stdout/stderr
`~/.local/share/revue/events.jsonl`	Durable decision-plane event log

The config directory is mode 0700; credentials, pid state, logs, and the JSONL event file are owner-only mode 0600. These files are plaintext, not encrypted. Local and hosted decision memory are separate and are not synchronized. Starting the local service switches this CLI config to local mode rather than running both planes side by side.

Startup replays the local event log to rebuild projections and can take longer as history grows; start waits up to two minutes for readiness. Check ~/.local/state/revue/service.log if startup does not complete.

Amp plugin

Variable	Example	Controls
`REVUE_SERVICE_MODE`	`local`	Selects the local service config; omit for hosted mode
`REVUE_API_URL`	`https://app.revue.run/api/v1` or `http://127.0.0.1:47838/api/v1`	Configured decision-plane endpoint used by the plugin and CLI
`REVUE_API_KEY`	provisioned or generated by the CLI	Workspace-scoped machine credential for plugin ingestion, bids, and routes
`REVUE_WORKSPACE_ID`	provisioned or generated by the CLI	Workspace/tenant selected for requests
`REVUE_HUMAN_SESSION_TOKEN`	provisioned or generated by the CLI	Human-only answer, dismissal, correction, and delegation authority
`REVUE_AGENT_MODEL`	`openai/gpt-5.5`	Model for the `revue` mode; setup writes this default

revue setup writes launch settings to ~/.config/revue/local.env. Hosted login stores the complete credential record, including the human session, in owner-only ~/.config/revue/auth.json and mirrors the adapter key and workspace settings needed by Amp and MCP into owner-only local.env. Local credentials live in local-service.json. revue and revue amp resolve the effective environment automatically. Do not paste raw credential values into prompts.

MCP server

revue connect <harness> generates the supported MCP registration. Local registrations launch revue mcp so credentials stay out of harness configuration. Hosted registrations launch the installed revue-mcp entry.

Variable	Required	Controls
`REVUE_API_URL`	yes	Active decision-plane endpoint
`REVUE_API_KEY`	yes	Workspace-scoped adapter authority for lookup, asks, routes, and shared context
`REVUE_WORKSPACE_ID`	no	Pins one workspace when the credential can access several
`REVUE_THREAD_ID`	no	Pins answers to one thread/session reference
`REVUE_WORKSTREAM_ID`	no	Pins one workstream and takes precedence over `REVUE_THREAD_ID` when both are set

When neither thread nor workstream is set, revue-mcp generates one stable session reference for the lifetime of that server process. Missing required configuration stops the server at startup instead of exposing tools that cannot reach Revue.

See the revue-mcp tool reference for input and result contracts.

Stored content

Revue persists decision questions, human answers, explicitly shared context, and whitelisted route proof. Ambient Amp lifecycle telemetry is metadata-only and omits prompts, assistant text, tool inputs and outputs, shell commands, working directories, and file paths. Revue does not read historical Amp logs or backfill work from before a plugin or MCP client connected.

Secrets are redacted on event append, but intentional decision/context content may contain personal or confidential data. Hosted mode sends that content to the configured hosted plane; local mode stores it in the owner-only JSONL file above. Upgrades do not rewrite historical event logs, so logs written by older versions may retain legacy payload fields.

revue correct changes whether and where a remembered decision may be reused; it does not delete the source record. Corrections append new events, so the original question, answer, and context remain in the event log for audit and replay. Revue does not currently provide selective event deletion or automatic retention expiry. Avoid submitting unnecessary personal data, and treat the event log as sensitive retained data.

To erase all local decision history, stop the service before deleting the event log, then restart it:

revue service stop
rm ~/.local/share/revue/events.jsonl
revue service start

This is destructive and cannot remove individual events. Deleting the file while the service is running is unsafe because the process may still hold the open file and its single-writer lock.

Operational logs are separate from decision memory. Revue avoids intentionally logging prompts, answers, email addresses, and workspace names; it records operation names, timings, counts, and opaque request, workspace, user, and session identifiers for diagnosis and security auditing. Treat those identifiers as pseudonymous metadata and set an appropriate retention period at the hosting layer. Error diagnostics are secret-redacted, including credentials embedded in URLs. The local service.log remains owner-only plaintext alongside the files above.