Hermes is the first harness Graft targets, because everything the design leans on is confirmed there: it re-fetches the tool list on tools/list_changed, it raises MCP elicitations, and it carries a bearer header to a remote server.

​
Configuration

Put the agent’s token in ~/.hermes/.env, so the config file holds no secret:
Then add Graft under mcp_servers in ~/.hermes/config.yaml:
For self-hosted Graft the URL is your deployment’s origin plus /mcp, http://localhost:3000/mcp by default. Hermes resolves ${GRAFT_TOKEN} from ~/.hermes/.env or the environment at connect time. Reload with /reload-mcp in a session, or restart Hermes. Graft’s tools appear beside Hermes’s own, registered under the server name graft.

​
The skill (optional)

The MCP handshake carries Graft’s playbook — the order of operations, the handoff and secrets rules, what acquire_status means while a job runs — in the server’s instructions and the tool descriptions, so a Hermes with nothing installed follows the same order of operations. The thin skill, skills/hermes-graft in Graft’s repository, adds what a handshake cannot carry: the OAuth guide for a vendor that issues no API key, and what each of Hermes’s approval buttons records. While the repository is private the skill cannot be fetched from a public URL, so it is not a setup step; if you have a copy, install it into ~/.hermes/skills/hermes-graft/ and Hermes reads the SKILL.md inside. See Any MCP client.

​
Approvals

Hermes advertises form-mode elicitation, so Graft asks in place. Each ask is rendered as Hermes’s own approval card with four buttons: Allow Once, Allow Session, Always Allow and Deny. Graft’s message on the card names your agent, the tool or connection, the vendor and its hosts, and quotes the tool’s description as the agent’s model’s own words. What each button means to Graft:
  • Any allow button is a standing yes. Hermes answers all three with the same accept, so Graft cannot tell them apart and does not guess. The yes holds for this agent by Graft’s rule, on a destructive tool as on a write, even when the button said once. No button turns Ask every time for this tool on or off; that switch is in the console, and the card’s text says so.
  • Deny is a no. For a write tool the no is recorded and holds: later calls are refused until you withdraw the answer on the agent’s page. For a build ask nothing is recorded, and the next acquire asks again.
  • No answer records nothing. Dismissing the card is not an answer; the ask falls back to a link, which the agent relays, and you answer on the small page it opens (the one ask, which closes itself); Pending actions in the console keeps the record.
Hermes keeps no memory on its elicitation path, so the card comes back on every ask Graft makes. A tool you allowed asks again only when you set it to ask every time; when the card returns for one, it is Graft honouring your setting, not Hermes forgetting.
Secrets never come through the card. A vendor’s key, an OAuth client secret, a rotated token: for those the agent relays a link that opens a small Graft page with the form, which closes itself once it is stored. If Hermes ever asks you for a key in chat, decline and open the link instead.

​
Tool names

Authored tools arrive as <vendor>__<name> with their own schema and annotations, github__list-issues say. A read-only tool runs with no ask, a write brings up the card once, and Hermes re-reads the list whenever Graft promotes or demotes.

​
Try it