At a glance
- Where
- A bot’s chat menu › Capabilities, or More › Capabilities on the home screen
- Tabs
- Skills, MCP, Plugins and Tools
- Scope
- One bot, which is one Hermes profile, at a time
- Keys and tokens
- Stored in that profile’s
.envon your computer - Connection
- Bots on your primary connection
The four tabs
| Tab | What you can do |
|---|---|
| Skills | See installed skills and how often they are used, search the hub, install, and uninstall hub skills |
| MCP | Add servers from the catalogue or a custom URL or command, test them, authorise them, set keys, remove them |
| Plugins | Switch plugins on and off, and install one from Git |
| Tools | Enable or disable toolsets for the bot’s open chat |
MCP servers and OAuth
Add a server from the catalogue, or with Add custom server: an HTTP URL with an optional bearer token, or a local command that Hermes runs over stdio. Test connection checks it and reports how many tools it offers. Herald won’t send a token to a public address over plain http.
Many hosted servers sign in with OAuth. Hermes normally waits for the sign-in callback on a port of its own computer, which a phone can’t reach, so Herald starts Hermes’s web sign-in flow instead and opens the provider’s page in your phone’s browser. Herald only opens sign-in pages that use https. On an older Hermes, sign-in can only finish in a browser on the Hermes computer, and Herald tells you to run hermes update.
Over a plain-http Wi-Fi connection, the redirect carrying the sign-in code reaches Hermes unencrypted. Tailscale Serve or another https address keeps that step encrypted.
Plugins and toolsets
Hermes plugins are opt-in: Hermes finds them, but nothing loads until a plugin is enabled. Herald shows each one with a switch. Some changes only apply after hermes serve restarts, and Herald says so; if Hermes didn’t apply a change, a note with Retry appears under the plugin instead of the switch quietly flipping back. To install, give a Git URL or a hermes plugins install name; the plugin is enabled right after.
Toolsets are switched against the bot’s live session, so open its chat first. The change is saved to the bot’s config and applies to the open chat at once.
Add an MCP server from your phone
- Open Capabilities › MCP
From the bot’s chat menu.
- Add from the catalogue or by hand
Tap Add on an entry under Catalog, or tap Add custom server and enter a name with a URL or a command.
- Enter a key if asked
Herald asks next. The value goes to the profile’s
.envon your computer and never stays on the phone. - Authorise it if it uses OAuth
Tap the server under Connected servers and choose Authorize (OAuth), then sign in on the page that opens.
- Test it
Choose Test connection to confirm the server connects and see its tools.
When a bot asks for a server
If a bot needs an MCP server in the middle of a task, the chat shows an MCP setup card saying what it wants, with Install & enable, Authorize, Open MCP or Decline. When Herald is in the background, a banner says the bot wants an MCP server.
Limits
- Menus offer Capabilities for bots on your primary connection.
- Some connections can’t manage capabilities, and Herald says “This connection can’t manage this bot’s capabilities”.
- Plugin changes may need
hermes serverestarted. - Plugins and MCP servers run code or reach services on your behalf. Only add ones you trust.
Questions
Where are my MCP keys stored?
In the bot’s Hermes profile, in its .env file on your computer. Herald passes the value to Hermes once and doesn’t keep it.
Why does MCP sign-in tell me to update Hermes?
Your Hermes is too old to finish OAuth on another device, so only the older flow works, which completes in a browser on the Hermes computer. Run hermes update there and try again.
Why didn’t my plugin turn on?
Either it needs hermes serve restarted, or Hermes refused the change. Herald shows which under the plugin, with Retry.
Do installed skills fill up the context?
Only lightly. The bot’s context holds an index of installed skills; a skill’s full text loads only when it is used.
