# Configuration

Sherlock reads deployment values from one TOML file. Missing files, sections, or
required fields are hard errors.

Default source: [`config.example.toml`](../config.example.toml).

Setup and update compare an existing config against the shipped example. Missing
provider/service sections are appended as marked templates; existing sections
and values are not rewritten.

## Location

Resolved in order:

1. `$SHERLOCK_CONFIG`
2. `$XDG_CONFIG_HOME/sherlock/config.toml`
3. `$HOME/.config/sherlock/config.toml`

## Shape

`[oauth]` is optional. Set `browser = "<executable>"` to open OAuth login URLs
with a specific browser, for example `browser = "firefox"`. Leave it unset to
use the OS default browser.

`[providers.<name>]` defines a reusable OAuth/OIDC identity: `issuer`,
`client_id`, optional `client_secret`.

`[services.<name>]` defines one MCP target. The service name is also the wallet
key used by `sherlock status` and `sherlock logout <name>`. Each service
requires `base_url` plus either:

- `provider = "<name>"`, resolved from `[providers.<name>]`, or
- inline `issuer`, `client_id`, and optional `client_secret`.

Mixing `provider` with inline identity fields is rejected.

## Not configured here

Tokens live in the OS keyring. OAuth scopes live in MCP code. Agent profiles and
the built-in MCP registry live in Go code.

To add a service, add its config entry and wire or install the matching MCP
binary.