Configuration

Verboo Code uses JSON files for configuration. There are three scopes:

File	Scope	Committed?
`~/.verboo/settings.json`	Global (all projects)	N/A
`.verboo/settings.json`	Project	Yes (recommended)
`.verboo/settings.local.json`	Local project	No (gitignored)

Configuration is merged in that order — local settings override project, which override global.

Full schema

json

{
  "permissions": {
    "defaultMode": "ask",
    "allow": [],
    "deny": []
  },
  "env": {},
  "model": "",
  "mcpServers": {},
  "hooks": {},
  "plugins": [],
  "autoCompact": true,
  "cleanupPeriodDays": 30
}

Permissions

`permissions.defaultMode`

Default behavior for tools without an explicit rule:

Value	Behavior
`"ask"`	Asks the user (default)
`"auto"`	Automatic approval of safe operations
`"bypassPermissions"`	Ignores all permissions (only for controlled environments)

`permissions.allow`

List of always-approved tools. Syntax:

json

{
  "permissions": {
    "allow": [
      "Bash",
      "Bash(npm run *)",
      "Bash(git *)",
      "Edit",
      "Read",
      "WebFetch(domain:github.com)",
      "WebFetch(domain:raw.githubusercontent.com)",
      "Glob",
      "Grep"
    ]
  }
}

Supported patterns:

Pattern	Means
`"Bash"`	Any bash command
`"Bash(npm *)"`	Bash with `npm` prefix
`"WebFetch(domain:example.com)"`	WebFetch only for that domain
`"Edit"`	Any file edit
`"Write(path:/tmp/*)"`	Write only in /tmp

`permissions.deny`

List of always-blocked tools (takes priority over allow):

json

{
  "permissions": {
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "WebFetch(domain:internal.company.com)"
    ]
  }
}

Environment variables

The env block injects environment variables into the agent session:

json

{
  "env": {
    "NODE_ENV": "development",
    "DATABASE_URL": "postgres://localhost:5432/dev",
    "DEBUG": "app:*"
  }
}

Never put secrets in settings.json (committed). Use settings.local.json for sensitive variables.

Model

Override the model for the session:

json

{
  "model": "claude-sonnet-4-6"
}

Can be any model supported by the configured provider.

MCP Servers

MCP server configuration (see MCP for detailed examples):

json

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    },
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "./"],
      "disabled": false
    }
  }
}

Hooks

Lifecycle hook configuration (see Hooks for examples):

json

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "prettier --write '{{tool_input.file_path}}' 2>/dev/null || true",
            "async": true
          }
        ]
      }
    ],
    "Stop": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "osascript -e 'display notification \"Verboo Code finished\" with title \"Verboo\"'",
            "async": true
          }
        ]
      }
    ]
  }
}

Auto-compaction

json

{
  "autoCompact": true
}

When true, Verboo Code automatically compacts context when approaching the context window limit. Disable if you prefer manual control via /compact.

Session cleanup

json

{
  "cleanupPeriodDays": 30
}

Sessions older than this number of days are automatically removed.

Plugins

json

{
  "plugins": [
    {
      "name": "my-plugin",
      "source": "https://marketplace.verboo.ai/plugins/my-plugin"
    }
  ]
}

SSH configuration (remote sessions)

json

{
  "sshConfig": {
    "host": "my-server.com",
    "user": "ubuntu",
    "identityFile": "~/.ssh/id_rsa",
    "port": 22
  }
}

Attribution customization

json

{
  "attribution": {
    "coAuthoredBy": false
  }
}

Disables automatic addition of Co-Authored-By: Verboo Code in commits.

Complete example

Typical settings.json for a project:

json

{
  "permissions": {
    "defaultMode": "ask",
    "allow": [
      "Bash(npm run *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Read",
      "Edit",
      "Glob",
      "Grep",
      "WebFetch(domain:docs.npmjs.com)",
      "WebFetch(domain:developer.mozilla.org)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)"
    ]
  },
  "env": {
    "NODE_ENV": "development"
  },
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "npx prettier --write '{{tool_input.file_path}}' 2>/dev/null || true",
            "async": true
          }
        ]
      }
    ]
  }
}

And settings.local.json (gitignored) with secrets:

json

{
  "env": {
    "DATABASE_URL": "postgres://user:password@localhost:5432/dev",
    "OPENAI_API_KEY": "sk-..."
  }
}