Skip to content

🧩 docs: Update the Core librechat.yaml Reference - #862

Merged
berry-13 merged 2 commits into
mainfrom
berry-13/docs-yaml-core-audit
Oct 23, 2026
Merged

berry-13 merged 2 commits into
mainfrom
berry-13/docs-yaml-core-audit

Conversation

@berry-13

Copy link
Copy Markdown
Collaborator

Summary

Checks the core librechat.yaml reference pages (top level, interface, file config, registration, balance, memory, message filters, speech, MCP servers and settings, skill sync, web search, OCR, plus the overview and full example) against the LibreChat config schemas. It fixes wrong keys and defaults, documents the keys that were missing, and adds a page for the deployment-owned mcpAppSandbox block, listed in every locale sidebar.

The overview now says that an unknown top-level key fails validation and stops the server, which is what the strict loader does.

Stacked on #861; review only this PR's diff.

Change Type

  • Documentation update

Testing

  • Each changed key, type and default traced to packages/data-provider/src on LibreChat dev, then rechecked by a second independent pass
  • pnpm check:locale-meta and pnpm check:config-version pass; every sidebar slug resolves
  • Internal links and anchors: no new broken links
  • New page rendered in light and dark mode

Checklist

  • No dash punctuation added
  • OptionTable cells are plain text

@vercel

vercel Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
librechat-ai Ready Ready Preview Oct 23, 2026 8:25pm UTC

Request Review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-23T20:18:28.585112Z 31658b6 New commits
🔒 Security Review ✅ Completed 2026-10-23T15:19:45.452344Z 2fa47c0 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@berry-13
berry-13 added this pull request to stack #869 October 23, 2026 16:25
@berry-13
berry-13 force-pushed the berry-13/docs-yaml-core-audit branch 2 times, most recently from d5662a6 to e867e21 Compare October 23, 2026 19:37
Base automatically changed from berry-13/docs-dotenv-audit to main October 23, 2026 19:39
Check the top-level, interface, file, registration, balance, memory,
message filter, speech, MCP and skill sync reference pages against the
LibreChat config schemas, fix wrong keys and defaults, document the keys
that were missing, and add a page for the deployment-owned mcpAppSandbox
block.
@berry-13
berry-13 force-pushed the berry-13/docs-yaml-core-audit branch from e867e21 to 578571e Compare October 23, 2026 19:39

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e867e2105e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +34 to +35
'Origin that serves the sandbox frame. Must use http:// or https://, and must differ from the origin LibreChat is served from. If omitted, the VITE_MCP_SANDBOX_URL build-time value is used when set; without a sandbox URL, Apps are not rendered.',
'url: "https://sandbox.example.com/"',

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Document the sandbox's required embedding configuration

For a deployment enabling MCP Apps for the first time, setting mcpSettings.apps: true and this sandbox URL is insufficient: content/docs/configuration/dotenv.mdx documents that an unset MCP_SANDBOX_FRAME_ANCESTORS denies all embedding with frame-ancestors none. The new reference never mentions that prerequisite, so readers following it will still have their App frames blocked. Include the required environment setting with the LibreChat origin, and explain that the dedicated sandbox origin must route to /api/mcp/sandbox, as specified in content/changelog/config_v1.3.18.mdx.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 31658b6. Checked against LibreChat dev: the client uses url verbatim as the frame src (client/src/utils/mcpApps.ts:81-104) and the page is served at GET /api/mcp/sandbox (api/server/routes/mcp.js:1413), so the example and the url row now point at that route on a dedicated origin. A new "Hosting the sandbox" section says to set MCP_SANDBOX_FRAME_ANCESTORS to the LibreChat origin, since an unset value sends frame-ancestors 'none' (packages/api/src/mcp/sandbox.ts:113).

@github-actions

Copy link
Copy Markdown
Contributor

📦 Next.js Bundle Analysis for librechat.ai

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

The sandbox url is the frame source itself, so it has to name the
/api/mcp/sandbox route on the dedicated origin, and the page is only
embeddable once MCP_SANDBOX_FRAME_ANCESTORS lists the LibreChat origin.
@github-actions

Copy link
Copy Markdown
Contributor

📦 Next.js Bundle Analysis for librechat.ai

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

@berry-13
berry-13 merged commit c49203e into main Oct 23, 2026
5 checks passed
@berry-13
berry-13 deleted the berry-13/docs-yaml-core-audit branch October 23, 2026 20:34

This branch was successfully deployed

1 active deployment
Preview — 31658b6a Deployed Oct 23, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant