Skip to Content
Frameworks & clientsHermes

Hermes

Hermes is a full MCP client, so it talks to AgentValet the way it already talks to any MCP server. What makes this integration different from most is how it authenticates: Hermes connects over OAuth, so the agent is issued its own identity rather than being handed a credential to keep.

This integration is in beta. The connect flow is proven end to end.

Connect it

In the dashboard, on the Agents page, Add to Hermes builds your connection snippet. There is nothing secret to copy: the snippet is derived entirely from your owner id.

Add this to ~/.hermes/config.yaml:

mcp_servers:
  agentvalet:
    url: https://api.agentvalet.ai/mcp/v1/<your-owner-id>
    auth: oauth
    timeout: 60

Steps:

  1. Sign in at app.agentvalet.ai and open the Agents page.
  2. Click Add to Hermes. Paste the config.yaml block, or run the hermes mcp add command it gives you. Both are built from your owner id.
  3. Start Hermes. On first use it opens an OAuth consent in your browser and you approve a fresh agent there.
  4. Grant platforms in the dashboard. What you grant is what the agent can call.

Your owner id is not a secret. It identifies which tenant the consent flow belongs to; it does not authorise anything on its own, which is why the snippet is safe to paste into a config file you might later share or commit.

Why OAuth changes the risk

Most MCP wiring asks you to put a long-lived bearer token in a config file. That file gets backed up, synced, and occasionally pasted into a support thread. The token is the whole authority, and it does not expire.

Hermes does not get one. The consent flow provisions the agent its own signing identity, and access tokens are short: 15 minutes, with a refresh token that is rotated on every use. Present an already-rotated refresh token and AgentValet treats it as a compromise signal and revokes the entire chain for that client, which is the OAuth 2.1 reuse-detection behaviour.

So the worst case for a leaked config file is that someone learns your tenant id. The worst case for a leaked refresh token is a rotation that gets detected and kills the chain.

Attribution in the audit log

Agents provisioned through this flow are stamped with the hermes agent type. Every row they write to the audit log carries it, so “which of my agents did this” has an answer that does not depend on you naming things carefully.

That matters more than it sounds. Once you are running several agents against the same platforms, an audit trail that cannot distinguish them is an audit trail you cannot act on.

What you still control

Connecting over OAuth changes how the agent authenticates. It does not change what the agent may do:

  • Deny-by-default. A freshly consented Hermes agent can reach nothing until you grant it a platform and a scope.
  • Approval on risk. Scopes you mark as needing a human pause the call until you approve from the dashboard, an email, or your phone.
  • Kill switch. Suspending or revoking the agent cuts it off immediately, and cascading revocation takes its children with it.

Troubleshooting

The browser consent never appears. Hermes only starts the OAuth flow on the first call that needs it. Ask the agent to do something that touches a granted platform.

The agent says it has no tools. It consented but has no grants yet. Open the Agents page and grant it a platform. The tool list is computed from your grants, so an agent with none correctly sees nothing.

Calls fail after a while. Check the agent is still active on the Agents page. Repeated authentication or upstream failures trip the circuit breaker and auto-suspend the agent, which is deliberate.

Next steps

Last updated on
CrewAISecurity