diff --git a/deploy/k8s/README.md b/deploy/k8s/README.md
index 140aeca..1ff1f48 100644
--- a/deploy/k8s/README.md
+++ b/deploy/k8s/README.md
@@ -246,6 +246,8 @@ manifests, others stubbed as commented-out examples):
 | `TPK_DB_BACKEND` | `timeplusd` (Enterprise, mutable streams) or `proton` |
 | `TIMEPLUS_DATABASE` | database all tpk streams live under (default `tpk`; app-only: user needs CREATE DATABASE) |
 | `TPK_DB_WAIT_SECONDS` | how long the app waits for the DB on boot |
+| `TPK_ANONYMOUS_ACCESS` / `TPK_ANONYMOUS_DAILY_TOKEN_LIMIT` | unauthenticated chat over the `public` corpus entries (off by default) and its shared daily token budget |
+| `TPK_MCP_HTTP_ENABLED` / `TPK_MCP_ALLOWED_HOSTS` | the remote MCP endpoint (`/mcp`, on by default) and its optional `Host` allow-list |
 
 ### Custom corpus (`repos.toml`) via ConfigMap
 
diff --git a/docker-compose.allinone.yml b/docker-compose.allinone.yml
index c5f1f7e..fcde1a9 100644
--- a/docker-compose.allinone.yml
+++ b/docker-compose.allinone.yml
@@ -49,6 +49,10 @@ services:
       # Global fallback daily token budget for non-admin chat (0 = unlimited);
       # a role's own daily_token_limit (Users -> Roles) overrides it.
       TPK_DAILY_TOKEN_LIMIT: ${TPK_DAILY_TOKEN_LIMIT:-}
+      TPK_ANONYMOUS_ACCESS: ${TPK_ANONYMOUS_ACCESS:-}
+      TPK_ANONYMOUS_DAILY_TOKEN_LIMIT: ${TPK_ANONYMOUS_DAILY_TOKEN_LIMIT:-}
+      TPK_MCP_HTTP_ENABLED: ${TPK_MCP_HTTP_ENABLED:-}
+      TPK_MCP_ALLOWED_HOSTS: ${TPK_MCP_ALLOWED_HOSTS:-}
       # Semantic-extraction (graphify) backend. `auto` is ambiguous when both
       # API keys are set (picks claude), so set this to openai|claude to choose.
       # The model comes from OPENAI_MODEL / ANTHROPIC_MODEL (graphify reads them).
diff --git a/docker-compose.yml b/docker-compose.yml
index 17cc9cb..ace35ac 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -94,6 +94,10 @@ services:
       # Global fallback daily token budget for non-admin chat (0 = unlimited);
       # a role's own daily_token_limit (Users -> Roles) overrides it.
       TPK_DAILY_TOKEN_LIMIT: ${TPK_DAILY_TOKEN_LIMIT:-}
+      TPK_ANONYMOUS_ACCESS: ${TPK_ANONYMOUS_ACCESS:-}
+      TPK_ANONYMOUS_DAILY_TOKEN_LIMIT: ${TPK_ANONYMOUS_DAILY_TOKEN_LIMIT:-}
+      TPK_MCP_HTTP_ENABLED: ${TPK_MCP_HTTP_ENABLED:-}
+      TPK_MCP_ALLOWED_HOSTS: ${TPK_MCP_ALLOWED_HOSTS:-}
       # Semantic-extraction (graphify) backend: openai|claude|auto. `auto` is
       # ambiguous when both API keys are set; model comes from OPENAI_MODEL /
       # ANTHROPIC_MODEL.