Skip to main content
This page is the SDK helper. For the full schema, merge semantics, and JSON-only sandbox rationale, see MCP / Project Config.

defineConfig(config)

Creates a typed TheoProjectConfig for use in theo.config.ts. The MCP server reads this automatically.

TheoProjectConfig

File Formats

The MCP server prefers JSON config by default:
  1. theo.config.json — always loaded when present (safe: parsed with JSON.parse).
  2. theo.config.js / theo.config.tsignored by default. Loading them executes arbitrary code from the current working directory, which is unsafe when an IDE launches the MCP server in a project you don’t fully trust.
To opt back into JS/TS config loading, set an environment variable before launching the MCP server:
With that flag set, the server loads theo.config.js first, then theo.config.ts, falling back to theo.config.json. If a JS/TS config is found without the flag, the MCP server logs a warning and skips it.
Only enable THEO_ALLOW_JS_CONFIG=1 in directories you authored or trust. Any repo with a malicious theo.config.js can run arbitrary code in your shell session when the MCP server launches.

How It’s Used

When the @hitheo/mcp server starts, it:
  1. Reads THEO_API_KEY from the environment
  2. Loads theo.config.json (or JS/TS if opted in)
  3. Injects persona, skills, and tools into every MCP tool call
  4. Uses defaultMode as the fallback mode