Skip to main content
The ConfigPlugin supports loading configuration from YAML files via the loadYaml option. This enables structured, hierarchical configuration alongside environment variables.

Overview

When loadYaml is enabled, the loadConfig function:
  1. Loads and parses YAML config files using js-yaml (v4.1.1+)
  2. Merges YAML config with environment variables (env vars take precedence)
  3. Validates the merged config against your Zod schema

Quick Start

1. Enable YAML loading

2. Create a YAML config file

3. Define your schema

Using loadConfig Directly

For programmatic configuration loading outside of plugins:

Configuration Options

loadYaml

When false (default), only environment variables and .env files are loaded. Set to true to also load YAML configuration.

configPath

Accepted File Extensions

The loader automatically tries these extensions in order:
  • .yml
  • .yaml
  • No extension (if configPath includes the extension)

Priority and Merging

Configuration sources are merged with this priority (highest to lowest):
  1. Environment variables (process.env)
  2. .env.local file
  3. .env file
  4. YAML config file (when loadYaml: true)
  5. Schema defaults (from Zod .default())
Environment variables always override YAML values. This allows you to commit safe defaults in YAML while overriding sensitive values via environment variables in production.

Example: Override YAML with Env Vars

The final database.url will be postgres://prod-server:5432/prod_db.

Error Handling

File Not Found

If the YAML file doesn’t exist, loading continues silently (no error). Schema defaults will be used.

Parse Errors

If the YAML file contains invalid syntax, loadConfig throws a standard YAML parse error from js-yaml.

Validation Errors

If the merged configuration fails schema validation, a ConfigValidationError is thrown:

Dependency

YAML loading depends on js-yaml version ^4.1.1 or higher. This dependency is included in @frontmcp/sdk and requires no additional installation.
Version 4.1.1+ is required to address CVE-2025-64718. Earlier versions should not be used.

Complete Example