sherlock/docs/configuration.md

Configuration

Sherlock reads deployment values from one TOML file. Missing files, sections, or required fields are hard errors.

Default source: config.example.toml.

Setup and update compare an existing config against the shipped example. Missing provider/service sections are appended as marked templates; existing sections and values are not rewritten.

Location

Resolved in order:

1. $SHERLOCK_CONFIG
2. $XDG_CONFIG_HOME/sherlock/config.toml
3. $HOME/.config/sherlock/config.toml

Shape

[oauth] is optional. Set browser = "<executable>" to open OAuth login URLs with a specific browser, for example browser = "firefox". Leave it unset to use the OS default browser.

[providers.<name>] defines a reusable OAuth/OIDC identity: issuer, client_id, optional client_secret.

[services.<name>] defines one MCP target. The service name is also the wallet key used by sherlock status and sherlock logout <name>. Each service requires base_url plus either:

• provider = "<name>", resolved from [providers.<name>], or
• inline issuer, client_id, and optional client_secret.

Mixing provider with inline identity fields is rejected.

Not configured here

Tokens live in the OS keyring. OAuth scopes live in MCP code. Agent profiles and the built-in MCP registry live in Go code.

To add a service, add its config entry and wire or install the matching MCP binary.