set <key> <value> [--force]
Set a config value. Dotted paths go to config.yaml; every UPPER_SNAKE name (OPENROUTER_API_KEY, DISCORD_HOME_CHANNEL, TELEGRAM_GROUP_ALLOWED_USERS, HERMES_TIMEZONE, …) is an environment variable and goes to .env — the same file the platform setup flows and /sethome write, and the one every runtime reader resolves against. config set never writes an UPPER_SNAKE key into config.yaml, --force included; names on the env writer's denylist (HERMES_YOLO_MODE, PATH, …) are refused outright; any other UPPER_SNAKE name is saved to .env as-is (plugins, skills and external tools read it from the process environment). A known key written under the wrong prefix (gateway.discord.foo, where discord.foo is itself a known key) is refused with a did-you-mean and nothing is written; any other unknown path under a known section (agent.max_turnz, or a runtime-read key that has no seeded default) is written with a did-you-mean notice, and an unknown lowercase top-level key is written with a notice (top-level scalars are bridged into the environment for skills). --force writes the refused wrong-prefix path too. Values are type-checked against the schema: a key that must hold a list or a mapping (custom_providers, model.aliases, display.platforms, plugins.enabled/plugins.disabled, model_catalog.excluded_providers, any key already holding one) refuses a plain string or a wrong-shaped literal, and a value that looks like a list/mapping but is not valid YAML/JSON is refused instead of being stored as a string — nothing is written and the error names the expected type. Pass a YAML/JSON literal (hermes config set custom_providers '[{name: x, base_url: https://...}]'); to store a string that merely starts with [ or {, quote it in YAML ("'[text'"). --force still replaces a whole mapping section; a non-list in a list slot has no override, except that a bare name for a list of names read leniently (agent.disabled_toolsets, skills.disabled) is stored as a one-item list.
From the official Hermes Agent CLI reference.