Summary

MCP (Model Context Protocol) servers are configured by editing ~/.hermes/config.yaml directly under the mcp_servers key. There is no way to add, remove, or inspect MCP servers from the Web UI. Users who want to connect a new MCP server have to edit YAML manually and restart.

Current config structure

Two transport types are supported:

Stdio (local process):

mcp_servers:
  filesystem:
    command: "npx"
    args: ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
    env: {}
    timeout: 120
    connect_timeout: 60

HTTP/StreamableHTTP (remote):

mcp_servers:
  my_api:
    url: "https://my-mcp-server.example.com/mcp"
    headers:
      Authorization: "Bearer sk-..."
    timeout: 180

Both are discovered at session start via discover_mcp_tools() in api/streaming.py. The tools they expose are registered into the agent's tool registry and available immediately.

Proposed UI

A new MCP Servers section in the Settings panel (or a dedicated tab in the right panel alongside Tasks/Memory/Skills). It shows a list of configured servers with:

• Server name
• Transport type badge (stdio / http)
• Command or URL (truncated, no auth values shown)
• Status indicator: connected / disconnected / error
• Edit and Remove buttons

An Add Server form with two modes toggled by transport type:

• Stdio: name, command, args (comma-separated or JSON array), env vars (key/value pairs), timeout
• HTTP: name, URL, headers (key/value pairs — header values masked if key contains "auth", "token", "key", "secret"), timeout

On save, the WebUI writes the new entry to config.yaml under mcp_servers and triggers a tool rediscovery (calls discover_mcp_tools() again without a full server restart).

Security notes

• Auth headers and env vars containing credentials must be masked in the UI (show •••••• with a reveal toggle)
• The existing api/config.py write path should be used — not raw file writes — so the same validation applies
• Stdio command field should warn if the command is an absolute path outside common safe directories

Files involved

• api/routes.py — new endpoints: GET /api/mcp/servers, POST /api/mcp/servers, DELETE /api/mcp/servers/<name>, POST /api/mcp/rediscover
• api/config.py — read/write mcp_servers key
• static/panels.js — MCP servers section rendering, add/edit form
• static/style.css — form and list styles
• api/streaming.py — expose discover_mcp_tools() for on-demand rediscovery