charter.yaml is Charter’s repo-root configuration file. It is optional — Charter still runs with built-in defaults when the file is absent. In v1 it exposes two configuration surfaces: policy for score gating and mcp.trustedRemotes for reviewed remote MCP hosts.
File location: repo root. Auto-discovered by all Charter commands.
Full example
charter init adds it for you.
Fields
string
Named threshold preset. Accepted values:
Default:
standardinteger
Explicit numeric threshold. Accepted range:
0–100.Overrides the default threshold for the selected policy.profile. Use this when you want an exact gate that doesn’t map cleanly to the named profiles (for example, 85).string[]
List of remote MCP server hostnames to add to the trusted allowlist for
AE-MCP-002.Entries are hostnames, not full URLs. This repo-level list is combined with Charter’s built-in catalog of known vendor-operated hosts. Local origins (localhost, 127.0.0.1) are always exempt and do not need to be listed.Threshold precedence
When multiple threshold sources are present, Charter applies them in this order:If you set both
profile and threshold, the threshold value wins. The profile label becomes documentation only.charter.yaml says, without modifying the file.
Validation
Charter fails fast on invalid configuration:- Unknown
policy.profilevalues → error at startup policy.thresholdoutside0..100→ error at startup- Malformed YAML → error at startup
Schema
Next steps
Policy Profiles
The named threshold presets and how precedence resolves.
GitHub Action
How the action reads
charter.yaml policy in CI.Investigate MCP Findings
Resolve the rules that
mcp.trustedRemotes governs.MCP Safety Model
Why the allowlist exists and what it protects against.