# Hermes

> Point Hermes at Graft with one mcp_servers entry and a token in .env, and know what its approval card means; the thin skill is optional.

Source: https://docs.getgraft.ai/graft/harnesses/hermes

Hermes is the first harness Graft targets, because everything the design leans on is confirmed there: it re-fetches the tool list on `tools/list_changed`, it raises MCP elicitations, and it carries a bearer header to a remote server.

## Configuration

Put the agent's token in `~/.hermes/.env`, so the config file holds no secret:

```dotenv
# ~/.hermes/.env
GRAFT_TOKEN=grft_…
```

Then add Graft under `mcp_servers` in `~/.hermes/config.yaml`:

```yaml
mcp_servers:
  graft:
    url: "https://app.getgraft.ai/mcp"
    headers:
      Authorization: "Bearer ${GRAFT_TOKEN}"
```

For self-hosted Graft the URL is your deployment's origin plus `/mcp`, `http://localhost:3000/mcp` by default. Hermes resolves `${GRAFT_TOKEN}` from `~/.hermes/.env` or the environment at connect time.

Reload with `/reload-mcp` in a session, or restart Hermes. Graft's tools appear beside Hermes's own, registered under the server name `graft`.

## The skill (optional)

The MCP handshake carries Graft's playbook — the order of operations, the handoff and secrets rules, what `acquire_status` means while a job runs — in the server's `instructions` and the tool descriptions, so a Hermes with nothing installed follows the same order of operations. The thin skill, `skills/hermes-graft` in Graft's repository, adds what a handshake cannot carry: the OAuth guide for a vendor that issues no API key, and what each of Hermes's approval buttons records. While the repository is private the skill cannot be fetched from a public URL, so it is not a setup step; if you have a copy, install it into `~/.hermes/skills/hermes-graft/` and Hermes reads the `SKILL.md` inside. See [Any MCP client](https://docs.getgraft.ai/graft/harnesses/any-mcp-client.md).

## Approvals

Hermes advertises form-mode elicitation, so Graft asks in place. Each ask is rendered as Hermes's own approval card with four buttons: **Allow Once**, **Allow Session**, **Always Allow** and **Deny**. Graft's message on the card names your agent, the tool or connection, the vendor and its hosts, and quotes the tool's description as the agent's model's own words.

What each button means to Graft:

- **Any allow button is a standing yes.** Hermes answers all three with the same `accept`, so Graft cannot tell them apart and does not guess. The yes holds for this agent by Graft's rule, on a destructive tool as on a write, even when the button said once. No button turns **Ask every time for this tool** on or off; that switch is in the console, and the card's text says so.
- **Deny is a no.** For a write tool the no is recorded and holds: later calls are refused until you withdraw the answer on the agent's page. For a build ask nothing is recorded, and the next `acquire` asks again.
- **No answer records nothing.** Dismissing the card is not an answer; the ask falls back to a link, which the agent relays, and you answer on the small page it opens (the one ask, which closes itself); **Pending actions** in the console keeps the record.

Hermes keeps no memory on its elicitation path, so the card comes back on every ask Graft makes. A tool you allowed asks again only when you set it to ask every time; when the card returns for one, it is Graft honouring your setting, not Hermes forgetting.

> **Note**
>
> Secrets never come through the card. A vendor's key, an OAuth client secret, a rotated token: for those the agent relays a link that opens a small Graft page with the form, which closes itself once it is stored. If Hermes ever asks you for a key in chat, decline and open the link instead.

## Tool names

Authored tools arrive as `<vendor>__<name>` with their own schema and annotations, `github__list-issues` say. A read-only tool runs with no ask, a write brings up the card once, and Hermes re-reads the list whenever Graft promotes or demotes.

## Try it

```text
Get me a fresh UUID from httpbin.org.
```

```text
Read the subject lines of my ten most recent emails.
```

```text
Why did the approval card come back? I already allowed this tool.
```