Skip to Content
Frameworks & clientsHermes
Open in Claude Open in ChatGPT

Hermes

Hermes is a full MCP client, so it talks to AgentValet the way it already talks to any MCP server. What makes this integration different from most is how it authenticates: Hermes connects over OAuth, so the agent is issued its own identity rather than being handed a credential to keep.

This integration is in beta. The connect flow is proven end to end.

Connect it

In the dashboard, on the Agents page, Connect Claude, ChatGPT, Copilot… opens a panel whose Hermes tab builds your connection snippet. There is nothing secret to copy: the snippet is derived entirely from your owner id.

Add this to ~/.hermes/config.yaml:

mcp_servers:
  agentvalet:
    url: https://api.agentvalet.ai/mcp/v1/<your-owner-id>
    auth: oauth
    timeout: 60

Steps:

  1. Sign in at app.agentvalet.ai and open the Agents page.
  2. Click Connect Claude, ChatGPT, Copilot… and pick the Hermes tab. Paste the config.yaml block, or run the hermes mcp add command it gives you. Both are built from your owner id.
  3. Start Hermes. On first use it opens an OAuth consent in your browser and you approve a fresh agent there. Consenting again from the same Hermes client reuses that agent rather than creating another, and does not reactivate it if you suspended or revoked it.
  4. Grant platforms in the dashboard. What you grant is what the agent can call.

Your owner id is not a secret. It identifies which tenant the consent flow belongs to; it does not authorise anything on its own, which is why the snippet is safe to paste into a config file you might later share or commit.

Why OAuth changes the risk

Most MCP wiring asks you to put a long-lived bearer token in a config file. That file gets backed up, synced, and occasionally pasted into a support thread. The token is the whole authority, and it does not expire.

Hermes does not get one. The consent flow provisions the agent its own identity, with no signing key: it holds access tokens issued by AgentValet’s OAuth server, and they are short: 15 minutes, with a refresh token that is rotated on every use. Present an already-rotated refresh token and AgentValet treats it as a compromise signal and revokes the entire chain for that client, which is the OAuth 2.1 reuse-detection behaviour.

So the worst case for a leaked config file is that someone learns your tenant id. The worst case for a leaked refresh token is a rotation that gets detected and kills the chain.

Attribution in the audit log

Agents provisioned through this flow get their own agent id and are stamped with the mcp-oauth agent type, named after the client (<client name> (MCP)). Every row they write to the audit log carries that agent id, so “which of my agents did this” has an answer that does not depend on you naming things carefully.

That matters more than it sounds. Once you are running several agents against the same platforms, an audit trail that cannot distinguish them is an audit trail you cannot act on.

What you still control

Connecting over OAuth changes how the agent authenticates. It does not change what the agent may do:

  • Deny-by-default. A freshly consented Hermes agent can reach nothing until you grant it a platform and a scope.
  • Approval on risk. Scopes you mark as needing a human pause the call until you approve from the dashboard (or, on Team and above, a delegate email or your phone).
  • Kill switch. Suspending or revoking the agent cuts it off immediately, and cascading revocation takes its children with it.

Troubleshooting

The browser consent never appears. Hermes only starts the OAuth flow on the first call that needs it. Ask the agent to do something that touches a granted platform.

The agent says it has nothing it can use. It consented but has no grants yet. Open the Agents page and grant it a platform. The tools themselves are the same fixed set for every agent; list_platforms returns what this agent is granted, so an agent with no grants correctly sees no platforms.

Calls fail after a while. Check the agent is still active on the Agents page. Three failed credential refreshes or five upstream failures within ten minutes open the circuit breaker: calls are refused with circuit_breaker_open, it half-opens after a five-minute cooldown and one success closes it. You can also reset it from the agent’s page. The agent’s status is not changed.

Next steps

Last updated on
CrewAICLI reference