diff --git a/graphql/codegen/src/__tests__/codegen/__snapshots__/cli-generator.test.ts.snap b/graphql/codegen/src/__tests__/codegen/__snapshots__/cli-generator.test.ts.snap
index afd0d060a..343ff2312 100644
--- a/graphql/codegen/src/__tests__/codegen/__snapshots__/cli-generator.test.ts.snap
+++ b/graphql/codegen/src/__tests__/codegen/__snapshots__/cli-generator.test.ts.snap
@@ -65,6 +65,28 @@ OUTPUT: JSON
   logout:    { context, status: "logged out" }
 \`\`\`
 
+### TOOL: config
+
+Manage per-context key-value configuration variables.
+
+\`\`\`
+SUBCOMMANDS:
+  myapp config get <key>             Get a config value
+  myapp config set <key> <value>     Set a config value
+  myapp config list                  List all config values
+  myapp config delete <key>          Delete a config value
+
+INPUT:
+  key:   string (required for get/set/delete) - Variable name
+  value: string (required for set) - Variable value
+
+OUTPUT: JSON
+  get:    { key, value }
+  set:    { key, value }
+  list:   { vars: { key: value, ... } }
+  delete: { deleted: key }
+\`\`\`
+
 ### TOOL: car
 
 CRUD operations for Car records.
@@ -239,6 +261,7 @@ myapp auth set-token <your-token>
 |---------|-------------|
 | \`context\` | Manage API contexts (endpoints) |
 | \`auth\` | Manage authentication tokens |
+| \`config\` | Manage config key-value store (per-context) |
 | \`car\` | car CRUD operations |
 | \`driver\` | driver CRUD operations |
 | \`current-user\` | Get the currently authenticated user |
@@ -270,6 +293,19 @@ Manage authentication tokens per context.
 | \`status\` | Show auth status across all contexts |
 | \`logout\` | Remove credentials for current context |
 
+### \`config\`
+
+Manage per-context key-value configuration variables.
+
+| Subcommand | Description |
+|------------|-------------|
+| \`get <key>\` | Get a config value |
+| \`set <key> <value>\` | Set a config value |
+| \`list\` | List all config values |
+| \`delete <key>\` | Delete a config value |
+
+Variables are scoped to the active context and stored at \`~/.myapp/config/\`.
+
 ## Table Commands
 
 ### \`car\`
@@ -435,6 +471,39 @@ myapp auth status
 `;
 
 exports[`cli docs generator generates CLI skill files 3`] = `
+"# Config Variables
+
+<!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
+
+Manage per-context key-value configuration variables for myapp
+
+## Usage
+
+\`\`\`bash
+myapp config get <key>
+myapp config set <key> <value>
+myapp config list
+myapp config delete <key>
+\`\`\`
+
+## Examples
+
+### Store and retrieve a config variable
+
+\`\`\`bash
+myapp config set orgId abc-123
+myapp config get orgId
+\`\`\`
+
+### List all config variables
+
+\`\`\`bash
+myapp config list
+\`\`\`
+"
+`;
+
+exports[`cli docs generator generates CLI skill files 4`] = `
 "# car
 
 <!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
@@ -473,7 +542,7 @@ myapp car get --id <value>
 "
 `;
 
-exports[`cli docs generator generates CLI skill files 4`] = `
+exports[`cli docs generator generates CLI skill files 5`] = `
 "# driver
 
 <!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
@@ -512,7 +581,7 @@ myapp driver get --id <value>
 "
 `;
 
-exports[`cli docs generator generates CLI skill files 5`] = `
+exports[`cli docs generator generates CLI skill files 6`] = `
 "# currentUser
 
 <!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
@@ -535,7 +604,7 @@ myapp current-user
 "
 `;
 
-exports[`cli docs generator generates CLI skill files 6`] = `
+exports[`cli docs generator generates CLI skill files 7`] = `
 "# login
 
 <!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
@@ -558,7 +627,7 @@ myapp login --email <value> --password <value>
 "
 `;
 
-exports[`cli docs generator generates CLI skill files 7`] = `
+exports[`cli docs generator generates CLI skill files 8`] = `
 "---
 name: cli-default
 description: CLI tool (myapp) for the default API — provides CRUD commands for 2 tables and 2 custom operations
@@ -580,6 +649,10 @@ myapp context use <name>
 # Authentication
 myapp auth set-token <token>
 
+# Config variables
+myapp config set <key> <value>
+myapp config get <key>
+
 # CRUD for any table (e.g. car)
 myapp car list
 myapp car get --id <value>
@@ -612,6 +685,7 @@ See the \`references/\` directory for detailed per-entity API documentation:
 
 - [context](references/context.md)
 - [auth](references/auth.md)
+- [config](references/config.md)
 - [car](references/car.md)
 - [driver](references/driver.md)
 - [current-user](references/current-user.md)
@@ -2027,6 +2101,7 @@ COMMAND FORMAT:
   myapp <target>:<command> <subcommand> [flags]    Target-specific commands
   myapp context <subcommand> [flags]              Context management
   myapp credentials <subcommand> [flags]                 Authentication
+  myapp config <subcommand> [flags]               Config key-value store
 
 ## PREREQUISITES
 
@@ -2091,6 +2166,49 @@ OUTPUT: JSON
   logout:    { context, status: "logged out" }
 \`\`\`
 
+### TOOL: config
+
+Manage per-context key-value configuration variables.
+
+\`\`\`
+SUBCOMMANDS:
+  myapp config get <key>             Get a config value
+  myapp config set <key> <value>     Set a config value
+  myapp config list                  List all config values
+  myapp config delete <key>          Delete a config value
+
+INPUT:
+  key:   string (required for get/set/delete) - Variable name
+  value: string (required for set) - Variable value
+
+OUTPUT: JSON
+  get:    { key, value }
+  set:    { key, value }
+  list:   { vars: { key: value, ... } }
+  delete: { deleted: key }
+\`\`\`
+
+### TOOL: helpers (SDK)
+
+Typed client factories for use in scripts and services (generated helpers.ts).
+Resolves credentials via: appstash store -> env vars -> throw.
+
+\`\`\`
+FACTORIES:
+  createAuthClient(contextName?)   Create a configured auth ORM client
+  createMembersClient(contextName?)   Create a configured members ORM client
+  createAppClient(contextName?)   Create a configured app ORM client
+
+USAGE:
+  import { createAuthClient } from './helpers';
+  const client = createAuthClient();
+
+CREDENTIAL RESOLUTION:
+  1. appstash store (~/.myapp/config/)
+  2. env vars (MYAPP_TOKEN, MYAPP_<TARGET>_ENDPOINT)
+  3. throws with actionable error message
+\`\`\`
+
 ### TOOL: auth:user
 
 CRUD operations for User records (auth target).
@@ -2374,6 +2492,67 @@ exports[`multi-target cli docs generates multi-target MCP tools 1`] = `
     },
     "name": "myapp_credentials_logout",
   },
+  {
+    "description": "Get a config variable value for the current context",
+    "inputSchema": {
+      "properties": {
+        "key": {
+          "description": "Variable name",
+          "type": "string",
+        },
+      },
+      "required": [
+        "key",
+      ],
+      "type": "object",
+    },
+    "name": "myapp_config_get",
+  },
+  {
+    "description": "Set a config variable value for the current context",
+    "inputSchema": {
+      "properties": {
+        "key": {
+          "description": "Variable name",
+          "type": "string",
+        },
+        "value": {
+          "description": "Variable value",
+          "type": "string",
+        },
+      },
+      "required": [
+        "key",
+        "value",
+      ],
+      "type": "object",
+    },
+    "name": "myapp_config_set",
+  },
+  {
+    "description": "List all config variables for the current context",
+    "inputSchema": {
+      "properties": {},
+      "type": "object",
+    },
+    "name": "myapp_config_list",
+  },
+  {
+    "description": "Delete a config variable for the current context",
+    "inputSchema": {
+      "properties": {
+        "key": {
+          "description": "Variable name to delete",
+          "type": "string",
+        },
+      },
+      "required": [
+        "key",
+      ],
+      "type": "object",
+    },
+    "name": "myapp_config_delete",
+  },
   {
     "description": "List all User records (auth target)",
     "inputSchema": {
@@ -2837,6 +3016,7 @@ myapp auth:login --email <value> --password <value> --save-token
 |---------|-------------|
 | \`context\` | Manage API contexts (per-target endpoints) |
 | \`credentials\` | Manage authentication tokens |
+| \`config\` | Manage config key-value store (per-context) |
 
 ### auth
 
@@ -2890,6 +3070,38 @@ Manage authentication tokens per context. One shared token is used across all ta
 | \`status\` | Show auth status across all contexts |
 | \`logout\` | Remove credentials for current context |
 
+### \`config\`
+
+Manage per-context key-value configuration variables.
+
+| Subcommand | Description |
+|------------|-------------|
+| \`get <key>\` | Get a config value |
+| \`set <key> <value>\` | Set a config value |
+| \`list\` | List all config values |
+| \`delete <key>\` | Delete a config value |
+
+Variables are scoped to the active context and stored at \`~/.myapp/config/\`.
+
+## SDK Helpers
+
+The generated \`helpers.ts\` provides typed client factories for use in scripts and services:
+
+\`\`\`typescript
+import { createAuthClient } from './helpers';
+import { createMembersClient } from './helpers';
+import { createAppClient } from './helpers';
+
+const auth = createAuthClient();
+const members = createMembersClient();
+const app = createAppClient();
+\`\`\`
+
+Credential resolution order:
+1. appstash store (\`~/.myapp/config/\`)
+2. Environment variables (\`MYAPP_TOKEN\`, \`MYAPP_<TARGET>_ENDPOINT\`)
+3. Throws with actionable error message
+
 ## auth Commands
 
 ### \`auth:user\`
@@ -3081,17 +3293,50 @@ myapp credentials status
 ",
     "fileName": "cli-common/references/auth.md",
   },
+  {
+    "content": "# Config Variables
+
+<!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
+
+Manage per-context key-value configuration variables for myapp
+
+## Usage
+
+\`\`\`bash
+myapp config get <key>
+myapp config set <key> <value>
+myapp config list
+myapp config delete <key>
+\`\`\`
+
+## Examples
+
+### Store and retrieve a config variable
+
+\`\`\`bash
+myapp config set orgId abc-123
+myapp config get orgId
+\`\`\`
+
+### List all config variables
+
+\`\`\`bash
+myapp config list
+\`\`\`
+",
+    "fileName": "cli-common/references/config.md",
+  },
   {
     "content": "---
 name: cli-common
-description: Shared CLI utilities for myapp — context management and authentication across targets: auth, members, app
+description: Shared CLI utilities for myapp — context management, authentication, and config across targets: auth, members, app
 ---
 
 # cli-common
 
 <!-- @constructive-io/graphql-codegen - DO NOT EDIT -->
 
-Shared CLI utilities for myapp — context management and authentication across targets: auth, members, app
+Shared CLI utilities for myapp — context management, authentication, and config across targets: auth, members, app
 
 ## Usage
 
@@ -3103,6 +3348,11 @@ myapp context use <name>
 # Authentication
 myapp credentials set-token <token>
 myapp credentials status
+
+# Config variables
+myapp config set <key> <value>
+myapp config get <key>
+myapp config list
 \`\`\`
 
 ## Examples
@@ -3115,12 +3365,19 @@ myapp context use local
 myapp credentials set-token <token>
 \`\`\`
 
+### Store a config variable
+
+\`\`\`bash
+myapp config set orgId abc-123
+\`\`\`
+
 ## References
 
 See the \`references/\` directory for detailed per-entity API documentation:
 
 - [context](references/context.md)
 - [auth](references/auth.md)
+- [config](references/config.md)
 ",
     "fileName": "cli-common/SKILL.md",
   },
@@ -5229,6 +5486,67 @@ exports[`target docs generator generates combined MCP config 1`] = `
         "properties": {}
       }
     },
+    {
+      "name": "myapp_config_get",
+      "description": "Get a config variable value for the current context",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string",
+            "description": "Variable name"
+          }
+        },
+        "required": [
+          "key"
+        ]
+      }
+    },
+    {
+      "name": "myapp_config_set",
+      "description": "Set a config variable value for the current context",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string",
+            "description": "Variable name"
+          },
+          "value": {
+            "type": "string",
+            "description": "Variable value"
+          }
+        },
+        "required": [
+          "key",
+          "value"
+        ]
+      }
+    },
+    {
+      "name": "myapp_config_list",
+      "description": "List all config variables for the current context",
+      "inputSchema": {
+        "type": "object",
+        "properties": {}
+      }
+    },
+    {
+      "name": "myapp_config_delete",
+      "description": "Delete a config variable for the current context",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string",
+            "description": "Variable name to delete"
+          }
+        },
+        "required": [
+          "key"
+        ]
+      }
+    },
     {
       "name": "myapp_car_list",
       "description": "List all Car records",
diff --git a/graphql/codegen/src/__tests__/codegen/cli-generator.test.ts b/graphql/codegen/src/__tests__/codegen/cli-generator.test.ts
index d434f972f..a8584ec26 100644
--- a/graphql/codegen/src/__tests__/codegen/cli-generator.test.ts
+++ b/graphql/codegen/src/__tests__/codegen/cli-generator.test.ts
@@ -699,7 +699,7 @@ describe('multi-target cli generator', () => {
 describe('multi-target cli docs', () => {
   const docsInput: MultiTargetDocsInput = {
     toolName: 'myapp',
-    builtinNames: { auth: 'credentials', context: 'context' },
+    builtinNames: { auth: 'credentials', context: 'context', config: 'config' },
     targets: [
       {
         name: 'auth',
@@ -770,7 +770,7 @@ describe('multi-target cli docs', () => {
   it('handles collision-renamed infra in docs', () => {
     const collisionInput: MultiTargetDocsInput = {
       toolName: 'myapp',
-      builtinNames: { auth: 'credentials', context: 'env' },
+      builtinNames: { auth: 'credentials', context: 'env', config: 'config' },
       targets: docsInput.targets,
     };
     const readme = generateMultiTargetReadme(collisionInput);
diff --git a/graphql/codegen/src/core/codegen/cli/docs-generator.ts b/graphql/codegen/src/core/codegen/cli/docs-generator.ts
index 64977c90f..049b32b4b 100644
--- a/graphql/codegen/src/core/codegen/cli/docs-generator.ts
+++ b/graphql/codegen/src/core/codegen/cli/docs-generator.ts
@@ -52,6 +52,7 @@ export function generateReadme(
   lines.push('|---------|-------------|');
   lines.push('| `context` | Manage API contexts (endpoints) |');
   lines.push('| `auth` | Manage authentication tokens |');
+  lines.push('| `config` | Manage config key-value store (per-context) |');
   for (const table of tables) {
     const { singularName } = getTableNames(table);
     const kebab = toKebabCase(singularName);
@@ -89,6 +90,19 @@ export function generateReadme(
   lines.push('| `status` | Show auth status across all contexts |');
   lines.push('| `logout` | Remove credentials for current context |');
   lines.push('');
+  lines.push('### `config`');
+  lines.push('');
+  lines.push('Manage per-context key-value configuration variables.');
+  lines.push('');
+  lines.push('| Subcommand | Description |');
+  lines.push('|------------|-------------|');
+  lines.push('| `get <key>` | Get a config value |');
+  lines.push('| `set <key> <value>` | Set a config value |');
+  lines.push('| `list` | List all config values |');
+  lines.push('| `delete <key>` | Delete a config value |');
+  lines.push('');
+  lines.push(`Variables are scoped to the active context and stored at \`~/.${toolName}/config/\`.`);
+  lines.push('');
 
   if (tables.length > 0) {
     lines.push('## Table Commands');
@@ -267,6 +281,29 @@ export function generateAgentsDocs(
   lines.push('```');
   lines.push('');
 
+  lines.push('### TOOL: config');
+  lines.push('');
+  lines.push('Manage per-context key-value configuration variables.');
+  lines.push('');
+  lines.push('```');
+  lines.push('SUBCOMMANDS:');
+  lines.push(`  ${toolName} config get <key>             Get a config value`);
+  lines.push(`  ${toolName} config set <key> <value>     Set a config value`);
+  lines.push(`  ${toolName} config list                  List all config values`);
+  lines.push(`  ${toolName} config delete <key>          Delete a config value`);
+  lines.push('');
+  lines.push('INPUT:');
+  lines.push('  key:   string (required for get/set/delete) - Variable name');
+  lines.push('  value: string (required for set) - Variable value');
+  lines.push('');
+  lines.push('OUTPUT: JSON');
+  lines.push('  get:    { key, value }');
+  lines.push('  set:    { key, value }');
+  lines.push('  list:   { vars: { key: value, ... } }');
+  lines.push('  delete: { deleted: key }');
+  lines.push('```');
+  lines.push('');
+
   for (const table of tables) {
     const { singularName } = getTableNames(table);
     const kebab = toKebabCase(singularName);
@@ -497,6 +534,49 @@ export function getCliMcpTools(
     inputSchema: { type: 'object', properties: {} },
   });
 
+  tools.push({
+    name: `${toolName}_config_get`,
+    description: 'Get a config variable value for the current context',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        key: { type: 'string', description: 'Variable name' },
+      },
+      required: ['key'],
+    },
+  });
+
+  tools.push({
+    name: `${toolName}_config_set`,
+    description: 'Set a config variable value for the current context',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        key: { type: 'string', description: 'Variable name' },
+        value: { type: 'string', description: 'Variable value' },
+      },
+      required: ['key', 'value'],
+    },
+  });
+
+  tools.push({
+    name: `${toolName}_config_list`,
+    description: 'List all config variables for the current context',
+    inputSchema: { type: 'object', properties: {} },
+  });
+
+  tools.push({
+    name: `${toolName}_config_delete`,
+    description: 'Delete a config variable for the current context',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        key: { type: 'string', description: 'Variable name to delete' },
+      },
+      required: ['key'],
+    },
+  });
+
   for (const table of tables) {
     const { singularName } = getTableNames(table);
     const kebab = toKebabCase(singularName);
@@ -694,6 +774,35 @@ export function generateSkills(
     }),
   });
 
+  // Config reference
+  referenceNames.push('config');
+  files.push({
+    fileName: `${skillName}/references/config.md`,
+    content: buildSkillReference({
+      title: 'Config Variables',
+      description: `Manage per-context key-value configuration variables for ${toolName}`,
+      usage: [
+        `${toolName} config get <key>`,
+        `${toolName} config set <key> <value>`,
+        `${toolName} config list`,
+        `${toolName} config delete <key>`,
+      ],
+      examples: [
+        {
+          description: 'Store and retrieve a config variable',
+          code: [
+            `${toolName} config set orgId abc-123`,
+            `${toolName} config get orgId`,
+          ],
+        },
+        {
+          description: 'List all config variables',
+          code: [`${toolName} config list`],
+        },
+      ],
+    }),
+  });
+
   // Table references
   for (const table of tables) {
     const { singularName } = getTableNames(table);
@@ -783,6 +892,10 @@ export function generateSkills(
           `# Authentication`,
           `${toolName} auth set-token <token>`,
           '',
+          `# Config variables`,
+          `${toolName} config set <key> <value>`,
+          `${toolName} config get <key>`,
+          '',
           `# CRUD for any table (e.g. ${tableKebabs[0] || 'model'})`,
           `${toolName} ${tableKebabs[0] || 'model'} list`,
           `${toolName} ${tableKebabs[0] || 'model'} get --id <value>`,
@@ -818,7 +931,7 @@ export function generateSkills(
 
 export interface MultiTargetDocsInput {
   toolName: string;
-  builtinNames: { auth: string; context: string };
+  builtinNames: { auth: string; context: string; config: string };
   registry?: TypeRegistry;
   targets: Array<{
     name: string;
@@ -904,6 +1017,7 @@ export function generateMultiTargetReadme(
   lines.push('|---------|-------------|');
   lines.push(`| \`${builtinNames.context}\` | Manage API contexts (per-target endpoints) |`);
   lines.push(`| \`${builtinNames.auth}\` | Manage authentication tokens |`);
+  lines.push(`| \`${builtinNames.config}\` | Manage config key-value store (per-context) |`);
   lines.push('');
 
   for (const tgt of targets) {
@@ -957,6 +1071,42 @@ export function generateMultiTargetReadme(
   lines.push('| `logout` | Remove credentials for current context |');
   lines.push('');
 
+  lines.push(`### \`${builtinNames.config}\``);
+  lines.push('');
+  lines.push('Manage per-context key-value configuration variables.');
+  lines.push('');
+  lines.push('| Subcommand | Description |');
+  lines.push('|------------|-------------|');
+  lines.push('| `get <key>` | Get a config value |');
+  lines.push('| `set <key> <value>` | Set a config value |');
+  lines.push('| `list` | List all config values |');
+  lines.push('| `delete <key>` | Delete a config value |');
+  lines.push('');
+  lines.push(`Variables are scoped to the active context and stored at \`~/.${toolName}/config/\`.`);
+  lines.push('');
+
+  lines.push('## SDK Helpers');
+  lines.push('');
+  lines.push('The generated `helpers.ts` provides typed client factories for use in scripts and services:');
+  lines.push('');
+  lines.push('```typescript');
+  for (const tgt of targets) {
+    const pascalName = tgt.name.charAt(0).toUpperCase() + tgt.name.slice(1);
+    lines.push(`import { create${pascalName}Client } from './helpers';`);
+  }
+  lines.push('');
+  for (const tgt of targets) {
+    const pascalName = tgt.name.charAt(0).toUpperCase() + tgt.name.slice(1);
+    lines.push(`const ${tgt.name} = create${pascalName}Client();`);
+  }
+  lines.push('```');
+  lines.push('');
+  lines.push('Credential resolution order:');
+  lines.push(`1. appstash store (\`~/.${toolName}/config/\`)`);
+  lines.push(`2. Environment variables (\`${toolName.toUpperCase().replace(/-/g, '_')}_TOKEN\`, \`${toolName.toUpperCase().replace(/-/g, '_')}_<TARGET>_ENDPOINT\`)`);
+  lines.push('3. Throws with actionable error message');
+  lines.push('');
+
   for (const tgt of targets) {
     if (tgt.tables.length === 0 && tgt.customOperations.length === 0) continue;
     lines.push(`## ${tgt.name} Commands`);
@@ -1092,6 +1242,7 @@ export function generateMultiTargetAgentsDocs(
   lines.push(`  ${toolName} <target>:<command> <subcommand> [flags]    Target-specific commands`);
   lines.push(`  ${toolName} ${builtinNames.context} <subcommand> [flags]              Context management`);
   lines.push(`  ${toolName} ${builtinNames.auth} <subcommand> [flags]                 Authentication`);
+  lines.push(`  ${toolName} ${builtinNames.config} <subcommand> [flags]               Config key-value store`);
   lines.push('');
 
   lines.push('## PREREQUISITES');
@@ -1161,6 +1312,53 @@ export function generateMultiTargetAgentsDocs(
   lines.push('```');
   lines.push('');
 
+  lines.push(`### TOOL: ${builtinNames.config}`);
+  lines.push('');
+  lines.push('Manage per-context key-value configuration variables.');
+  lines.push('');
+  lines.push('```');
+  lines.push('SUBCOMMANDS:');
+  lines.push(`  ${toolName} ${builtinNames.config} get <key>             Get a config value`);
+  lines.push(`  ${toolName} ${builtinNames.config} set <key> <value>     Set a config value`);
+  lines.push(`  ${toolName} ${builtinNames.config} list                  List all config values`);
+  lines.push(`  ${toolName} ${builtinNames.config} delete <key>          Delete a config value`);
+  lines.push('');
+  lines.push('INPUT:');
+  lines.push('  key:   string (required for get/set/delete) - Variable name');
+  lines.push('  value: string (required for set) - Variable value');
+  lines.push('');
+  lines.push('OUTPUT: JSON');
+  lines.push('  get:    { key, value }');
+  lines.push('  set:    { key, value }');
+  lines.push('  list:   { vars: { key: value, ... } }');
+  lines.push('  delete: { deleted: key }');
+  lines.push('```');
+  lines.push('');
+
+  lines.push('### TOOL: helpers (SDK)');
+  lines.push('');
+  lines.push('Typed client factories for use in scripts and services (generated helpers.ts).');
+  lines.push('Resolves credentials via: appstash store -> env vars -> throw.');
+  lines.push('');
+  lines.push('```');
+  lines.push('FACTORIES:');
+  for (const tgt of targets) {
+    const pascalName = tgt.name.charAt(0).toUpperCase() + tgt.name.slice(1);
+    lines.push(`  create${pascalName}Client(contextName?)   Create a configured ${tgt.name} ORM client`);
+  }
+  lines.push('');
+  lines.push('USAGE:');
+  lines.push(`  import { create${targets[0] ? targets[0].name.charAt(0).toUpperCase() + targets[0].name.slice(1) : 'Target'}Client } from './helpers';`);
+  lines.push(`  const client = create${targets[0] ? targets[0].name.charAt(0).toUpperCase() + targets[0].name.slice(1) : 'Target'}Client();`);
+  lines.push('');
+  lines.push('CREDENTIAL RESOLUTION:');
+  lines.push(`  1. appstash store (~/.${toolName}/config/)`);
+  const envPrefix = toolName.toUpperCase().replace(/-/g, '_');
+  lines.push(`  2. env vars (${envPrefix}_TOKEN, ${envPrefix}_<TARGET>_ENDPOINT)`);
+  lines.push('  3. throws with actionable error message');
+  lines.push('```');
+  lines.push('');
+
   for (const tgt of targets) {
     for (const table of tgt.tables) {
       const { singularName } = getTableNames(table);
@@ -1407,6 +1605,49 @@ export function getMultiTargetCliMcpTools(
     inputSchema: { type: 'object', properties: {} },
   });
 
+  tools.push({
+    name: `${toolName}_${builtinNames.config}_get`,
+    description: 'Get a config variable value for the current context',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        key: { type: 'string', description: 'Variable name' },
+      },
+      required: ['key'],
+    },
+  });
+
+  tools.push({
+    name: `${toolName}_${builtinNames.config}_set`,
+    description: 'Set a config variable value for the current context',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        key: { type: 'string', description: 'Variable name' },
+        value: { type: 'string', description: 'Variable value' },
+      },
+      required: ['key', 'value'],
+    },
+  });
+
+  tools.push({
+    name: `${toolName}_${builtinNames.config}_list`,
+    description: 'List all config variables for the current context',
+    inputSchema: { type: 'object', properties: {} },
+  });
+
+  tools.push({
+    name: `${toolName}_${builtinNames.config}_delete`,
+    description: 'Delete a config variable for the current context',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        key: { type: 'string', description: 'Variable name to delete' },
+      },
+      required: ['key'],
+    },
+  });
+
   for (const tgt of targets) {
     for (const table of tgt.tables) {
       const { singularName } = getTableNames(table);
@@ -1620,13 +1861,42 @@ export function generateMultiTargetSkills(
     }),
   });
 
+  // Config reference
+  commonReferenceNames.push('config');
+  files.push({
+    fileName: `${commonSkillName}/references/config.md`,
+    content: buildSkillReference({
+      title: 'Config Variables',
+      description: `Manage per-context key-value configuration variables for ${toolName}`,
+      usage: [
+        `${toolName} ${builtinNames.config} get <key>`,
+        `${toolName} ${builtinNames.config} set <key> <value>`,
+        `${toolName} ${builtinNames.config} list`,
+        `${toolName} ${builtinNames.config} delete <key>`,
+      ],
+      examples: [
+        {
+          description: 'Store and retrieve a config variable',
+          code: [
+            `${toolName} ${builtinNames.config} set orgId abc-123`,
+            `${toolName} ${builtinNames.config} get orgId`,
+          ],
+        },
+        {
+          description: 'List all config variables',
+          code: [`${toolName} ${builtinNames.config} list`],
+        },
+      ],
+    }),
+  });
+
   // Common SKILL.md
   files.push({
     fileName: `${commonSkillName}/SKILL.md`,
     content: buildSkillFile(
       {
         name: commonSkillName,
-        description: `Shared CLI utilities for ${toolName} — context management and authentication across targets: ${targets.map((t) => t.name).join(', ')}`,
+        description: `Shared CLI utilities for ${toolName} — context management, authentication, and config across targets: ${targets.map((t) => t.name).join(', ')}`,
         usage: [
           `# Context management`,
           `${toolName} ${builtinNames.context} create <name>`,
@@ -1635,6 +1905,11 @@ export function generateMultiTargetSkills(
           `# Authentication`,
           `${toolName} ${builtinNames.auth} set-token <token>`,
           `${toolName} ${builtinNames.auth} status`,
+          '',
+          `# Config variables`,
+          `${toolName} ${builtinNames.config} set <key> <value>`,
+          `${toolName} ${builtinNames.config} get <key>`,
+          `${toolName} ${builtinNames.config} list`,
         ],
         examples: [
           {
@@ -1645,6 +1920,12 @@ export function generateMultiTargetSkills(
               `${toolName} ${builtinNames.auth} set-token <token>`,
             ],
           },
+          {
+            description: 'Store a config variable',
+            code: [
+              `${toolName} ${builtinNames.config} set orgId abc-123`,
+            ],
+          },
         ],
       },
       commonReferenceNames,