Configuration

Active clients read the published revision from GET /api/v1/config/:appId. Config chooses labels and which affordances to show. It never overrides the host's permission check.

{
  "appId": "cma_demo",
  "name": "Comments",
  "revision": 1,
  "emptyState": "No discussions yet. Start one.",
  "mentionsEnabled": true,
  "resolveEnabled": true,
  "requireAuthorToken": false,
  "bodyMax": 10000,
  "allowedOrigins": ["*"],
  "branding": { "title": "Acme", "primaryColor": "#c8ef00" }
}
  • emptyState max 200. Default No discussions yet. Start one.
  • mentionsEnabled and resolveEnabled hide the composer affordance. Turning one off does not delete history.
  • requireAuthorToken forces a token on test. Live always requires a token.
  • bodyMax is an integer from 1 through 10000. The default is 10000. A lower published value is enforced.
  • allowedOrigins is CORS. ["*"] is the default. It is not content authorization. At most 20 origins, each at most 200 characters.
  • branding.primaryColor sets --bsw-cm-accent. logoUrl must be http or https.

MCP update_comment_draft accepts those config keys. It rejects body, mentions, resource titles, and file bytes. Draft versus publish: revisions.

Related: Origins · API overview · AGENTS.md