Add MCP Servers to Hermes Safely

---
name: add-mcp-servers-to-hermes-safely
description: Add an MCP server to Hermes Agent with least-privilege credentials and a clear test plan.
---

# Add MCP Servers to Hermes Safely

Use this skill when connecting Hermes Agent to a local or remote MCP server.

## Inputs
- `server_name`: short name for the MCP server
- `transport`: stdio command or HTTP URL
- `purpose`: what the server lets the agent do
- `credentials_needed`: none, API token, OAuth, or local filesystem access
- `risk_level`: read-only, write-capable, destructive, or sensitive

## Procedure
1. Confirm the MCP server is necessary for the task.
2. Prefer read-only or narrow scopes first.
3. For stdio servers, pass only required environment variables.
4. For HTTP servers, use bearer tokens or scoped auth headers; do not hardcode secrets into public files.
5. Add the server configuration.
6. Restart Hermes or reload MCP according to the local workflow.
7. Run a non-destructive tool call first.
8. Document what the server can access and how to revoke credentials.

## Output format
### MCP server purpose
### Minimal configuration
### Security notes
### Verification test
### Rollback / revoke steps

## Pitfalls
- Do not pass the full shell environment to untrusted MCP servers.
- Do not grant write/delete permissions until read operations are verified.
- Do not confuse public MCP access with private authenticated MCP access.