Hermes Agent MCP Catalog Guide (NEW) — Superbash Learn

Superbash Learn

Click to load the YouTube player

Key takeaways

Run `hermes update` before `hermes mcp` — catalog manifests are never auto-synced, so out-of-date snapshots will hide newly approved servers.
Stick to `hermes mcp install` for your first MCPs and only branch into hand-edited `config.yaml` files once you understand the tool-whitelist model.
Whitelist individual tools at install time and re-run `hermes mcp configure <name>` to revoke them later — never expose the full surface of an MCP server.
Treat any server outside the `optional/mcps` directory as unvetted; the catalog exists specifically because "some of them might not be safe" and users have been attacked.
For Linear, store OAuth tokens in `~/.hermes/mcp_tokens/linear.json`; for n8n, the base URL and API key go in `~/.hermes/.env` and Hermes probes the instance automatically.
Wait on the GitHub MCP until it ships — it's already listed in the manifest but disabled, and install is expected to take a personal access token scoped to your repos.
If you already run a custom MCP setup, skip the catalog — Ron calls it an update "more so for the everyday users, the casual users, the beginners."

Video summary

Companion notes

Hermes now ships a one-click MCP catalog — but only Linear and n8n are live in the current snapshot.

What the catalog actually does

Running hermes mcp launches a CLI list of Nous-approved MCP servers, and hermes mcp install <name> wires the config, prompts for credentials, and only exposes whitelisted tools. No more hunting GitHub repos, copying JSON snippets, or hand-editing config.yaml to add command args and env variables.

The four commands to remember

hermes update — pulls the latest catalog manifests.
hermes mcp — opens the approved-server list.
hermes mcp install <name> — installs from the manifest only.
hermes mcp configure <name> — reopens the tool checklist so you can add or revoke permissions later.

The creator calls this last one the only manual step, since "all you need to do now is just run uh Hermes MCP to see a list of the approved servers, and then you hit enter for the ones you want to use."

Security model

Every entry lives in the optional/mcps directory of the official repo and is gated by PR review from the Nous Research team — they read the source code and bootstrap commands before a manifest ships. Each manifest declares its source URL so you can inspect what you're about to run, and the tool checklist lets you whitelist individual tools instead of exposing the whole MCP surface. The creator frames this as the team's response to new users "experiencing like uh like an attack" from unvetted servers.

Current state and what to expect

Right now Linear and n8n are the only enabled entries; GitHub is on the list but disabled ("GitHub should have been there, but it's disabled for now. That kind of sucks"). For Linear, install is OAuth — click the link, authenticate, and tokens cache to ~/.hermes/mcp_tokens/linear.json. For n8n, Hermes prompts for your base URL and API key, writes them to ~/.hermes/.env automatically, then probes the instance to list available workflows and executions. Catalog entries "are never auto-updated," so re-run hermes update to pull new manifests as they ship.

Watch on YouTube

Prefer the native player? Open it on YouTube: https://www.youtube.com/watch?v=IMO8ooIqONM