+ jHj[bRt^RIt^RIt^RIHt^RIt^RIt^RIt^RIt^RI H t H t H t ^RI HtHtHt^RIHt^RIHt^RIHtHtHt^RIHtHtHtHt^R IHtH t H!t!H"t"H#t#H$t%H&t&]!4t']!R R 4t(]!R 4t)]!R R4t*]!RR4t+]!RR4t,]!RR4t-]P\!4t/R@t0^t1]RRl4t2RRlt3RRlt4RRlt5RRlt6]'PoR4RARRll4t8]'PsR4RAR R!ll4t:]'PwR4RAR"R#ll4t<]'P{R$4RAR%R&ll4t>]'PsR'4RAR(R)ll4t?]'PsR*4RAR+R,ll4t@]'PoR-4R.R/l4tA]'P{R-4R0R1l4tB]'PoR24RBR3R4ll4tC]'PwR54RAR6R7ll4tDR8R9ltE]'PoR:4RAR;R<ll4tF]'PsR=4RAR>R?ll4tGR#)CuMCP dashboard routes. The OAuth flow registry (``_mcp_oauth_flows``) and the worker/helpers stay in web_server — reached via the late-binding seam so tests that mutate ``web_server._mcp_oauth_flows`` or monkeypatch its helpers keep working. N)contextmanager)AnyDictOptional) APIRouter HTTPExceptionRequest) HTMLResponse)late)_mcp_oauth_flows_mcp_server_summary_normalize_mcp_server_create)MCPCatalogInstallMCPEnabledToggleMCPServerCreateMCPServersReplace)_profile_cli_args_profile_scope_spawn_hermes_actionconfig_write_scope http_failurelogscoped_to_thread_config_profile_scopezhermes_cli.web_server_profiles_require_token_run_dashboard_mcp_oauthzhermes_cli.web_server_mcp load_configzhermes_cli.config save_configsave_env_valuec:V^8dQhR\\,/#profilerstr)formats"?/home/ubuntu/.hermes/hermes-agent/hermes_cli/web_routers/mcp.py __annotate__r'+s8C=c#v"\V4;_uu_4RxRRR4R# +'giR#;i5i)aHome + secret scope for a probe-class request (#109901). ``_config_profile_scope`` now binds the secret scope itself; this stays the probe/OAuth callers' name. Home-only, NOT ``_profile_scope``: the body can block for seconds and the latter holds the process-global skills lock.N)r)r"s&r&_profile_secret_scoper**s# w ' '  ( ' ' 's9% 9 6 9c:V^8dQhR\\,/#r r#)r%s"r&r'r'4sHSMr(caaVV3RlpV#)cv<\S4;_uu_4S!4uuRRR4# +'giR#;iN)r*)fnr"sr&_run_secret_scoped.._run5s" "7 + +4, + + +s' 8 )r"r/r0sff r&_secret_scopedr34s Kr(cV^8dQhRR/#)r!returnNr2)r%s"r&r'r';s00T0r(c `\P!4\, p\;_uu_4\P!4UUu.uFwr\ VR^4V8gKVNK pppVFp\P !VR4K RRR4R#uuppi +'giR#;i) created_atN)time_MCP_DASHBOARD_OAUTH_TTL_mcp_oauth_flows_lockr itemsgetattrpop)cutofffidflowstaleflow_ids r&_gc_mcp_oauth_flowsrC;s YY[3 3F  &6&<&<&>j&>'$P\^_B`ciBi&>jG  $ /  j   s#BB #B )#BB B- c<V^8dQhR\R\R\/#)r!request server_namer5)rr$)r%s"r&r'r'Cs& a aW a3 a3 ar(c ^RIHpHpHp^RIHpHpRV!VRR7 2pV!4pV'dV V 2#V!\VP44p V!V4p V!V PV V 2RRRR74#)z7Externally reachable callback URL for a dashboard flow.)quoteurlparse urlunparse)prefix_from_requestresolve_public_urlz/api/mcp/oauth/callback/)safe)pathparamsqueryfragment) urllib.parserHrIrJ hermes_cli.dashboard_auth.prefixrKrLr$base_url_replace) rErFrHrIrJrKrLsuffix public_urlbaseprefixs && r&_mcp_oauth_callback_urlr[Cs~88X'k(C'D EF#%JfX&& C(() *D  )F dmmF8F8)s C O OxD \\$++- ( 2 2 4R 8FD66( +F  76($)?@ Mr(z/api/mcp/serversc:V^8dQhR\\,/#r r#)r%s"r&r'r'_s  HSM r(c a"^RIHoV3Rlp\P!\ W44GRjxL wr#R\ VP 44UUu.uFwrE\WEW4,4NK upp/#LEuuppi5i)_get_mcp_serversc.<S!4p^RIHpV!V4#ruserver_configs_with_sourcestui_gateway.mcp_rpc_helpersr{config_serversr{rws r&_readlist_mcp_servers.._readbs)+K*>::r(Nservers)hermes_cli.mcp_configrwasyncio to_threadr3sortedr;r )r"rrpluginsr]cfgrws& @r&list_mcp_serversr^sr6; %..~g/MNNG GMgmmoG^G^)$Dw}5G^ Os!/BA8#BA:3B:BcFV^8dQhR\R\\,/#r!bodyr")rrr$)r%s"r&r'r'os.4.4.4#.4r(c aaaaaaaa a a "^RIHo ^RIHoHoHo\ S4wo o oRTTTTTT TT 3RlloTTT TT T 3Rlp\P!T4GRjxL \S S 4# \dp\R\T4R7ThRp?ii;iL: \dh\d3p\P!R 4\R\T4R7ThRp?ii;i5i) ru)record_mcp_install)rw_save_bearer_auth_token_save_mcp_server status_codedetailNc$V^8dQhR\/#r!r5)bool)r%s"r&r'$add_mcp_server..__annotate__xs9949r(c z<\S P;'gS 4;_uu_4S!4p^RIHpV!V4wr#VP S 4;p'd\ RRS RV R2R7hS V9d\ RRS R2R7hSe S!S S4S R &S!S S 4uuRRR4# +'giR#;i) rurzServer '' is provided by plugin '' and cannot be modifiedrz' already existsNheaders)rr"r}r{getr) rr{rrpluginrwrr bearer_tokenrr]r" server_configs r&_saveadd_mcp_server.._savexs  7 7 8 8-/N O:>J G T**v*# #htf._runs DLL33G 4 4  (9(9%(@(@ugt,1yxW\tbs u5(4&8i(j 5 4s%B  B ! B  B zPOST /api/mcp/servers failed)hermes_cli.mcp_catalogrrrwrrr ValueErrorrr$rr Exception_log exceptionr ) rr"excr0rwrrrrr]rrs ff @@@@@@@@r&add_mcp_serverrns9aaG,H,N)m\99&  G%%% t] 33Q GCH=3FGD &  G 56CH=3FGscC*A3C* B"B#B' C*3 B>BBC*BC'4C'5-C""C''C*cFV^8dQhR\R\\,/#r)rrr$)r%s"r&r'r's$5 r(caaa"^RIHoVVV3Rlp\P!V4GRjxL wr4V'g\ RRP V4R7hRR/#L.5i) uReplace the entire ``mcp_servers`` map (the mcp.json editor's save) — the deep-merging ``/api/config`` can never delete a key or drop an ``enabled: false``, so removals wouldn't persist through it.)_replace_mcp_serversc \<\SP;'gS4;_uu_4^RIHpV!/4wrSPF4pVP V4;p'gKRRV RV R2.3uuuRRR4# S!SP4uuRRR4# +'giR#;i)rurzFrrrN)rr"r}r{rr)r{_serversrr]rrrr"s r&r0!replace_mcp_servers.._runs  7 7 8 8 O ;B ? H $[[..6.. XdV3LVHTl#m"nnn 9 8%( 59 8 8 8s6B$ B<B B+ Nrz; rokT)rrrrrjoin)rr"r0rissuesrsff @r&replace_mcp_serversrsO ;6((..JB DIIf4EFF $</s(AA/Az/api/mcp/servers/{name}cFV^8dQhR\R\\,/#r!r]r"r$r)r%s"r&r'r's# r(caaaa"^RIHoHoVVVV3Rlp\P!V4GRjxL 'g\ RRS R2R7hRR /#L5i) ru)rw_remove_mcp_serverc <\S4;_uu_4S!4p^RIHpV!V4wr#VPS4;p'd\ RRS RV R2R7hS!S4uuRRR4# +'giR#;i)rurzrrrrrN)rr}r{rr) rr{rrrrwrr]r"s r&r0remove_mcp_server.._runsx  ( (-/N O ;N K H T**v*# #htf up p RSPR^4RSPR^4/#EL L \dp^R IH pR R RT!T4R./uRp?#Rp?ii;iuup p i5i)z2Connect to the server, list its tools, disconnect.)rw_oauth_tokens_present_probe_single_serverc<<S!4p^RIHpV!V4^,#ryr|r~s r&rtest_mcp_server.._reads)+K*>:1==r(NrrrrauthoauthcR<S!SSS,SR7pTS'd S!S43#R3#))detailsTr2)toolsrrrr]needs_oauth_tokenrs r&_probetest_mcp_server.._probes1$T74='J6G,T2RRTRRr()redact_mcp_probe_textrFerrorru1OAuth authentication required — no token found. schema_charsTr] descriptionprompts resources) rrwrrrrr3rrrr isinstanceint)r]r"rrr token_presentrrrtdrwrrrrrsf& @@@@@@r&test_mcp_serverrsdc> %%nW&DEEG 7htfK4PQQ G  ))&1W<SSO%,%6%6~g7V%WW eW&Y[bdfgg;;~.44"L d    q 9C.__annotate__sII3Ir(c`<\S!4P4PRR74#)F)strict)r$ expanduserresolversr&_homeauth_mcp_server.._homes(?$//1999GHHr(c<\S4;_uu_4S!4p^RIHpV!V4wr#W#S!43uuRRR4# +'giR#;i)rurzN)r*r}r{)rr{rrrwrr"s r&rauth_mcp_server.._read s? "7 + +-/N O:>J GUW, , + + +s A A Nrrrrrrrrrz2stdio servers authenticate via env keys, not OAuthrrrz/This server uses header/API-key auth, not OAuth redirect_uri)rBrFr" hermes_homerreconnect_liveiz0Too many MCP OAuth flows are already in progressc3n<"TF*qPS8H;'dVPS8HxK, R#5ir.)rFr).0f flow_homer]s& r& "auth_mcp_server...s,RT}}$CC))CCTs55TFzMCP OAuth for 'z' is already in progressz mcp-oauth-)targetargsdaemonr])timeout) rrwhermes_constantsrtools.mcp_dashboard_oauthrrrrCrrrrdictsecrets token_urlsafer[r:r values worker_donelen_MAX_PENDING_MCP_OAUTH_FLOWSany threadingThreadrstartwait_for_authorization_urlr mark_errorsnapshot)r]rEr"rr process_homerrrrrrBr@rliverrwrrrsf&f @@@@r&auth_mcp_serverrs70O7II7L-)0(9(9%(@"@Gi 7htfK4PQQT""v"htfD]^d]ee}4~ wt} C 775>>4hii wwycggfo84effCK##B'G ggg&,,"11.AkkE\]dfjEk L0  D  +224J4aMM4J t94 4C8jk k 3RTR333RTR R RC/$Og8hi i$(! 4D;t\fgkflZmnttv0--b-999 ==?C#A,K   : 0 )#.// ==?0sAL #J.$7L A L =AL L 2$L J6.J1J1 -J6:J6J61J6 8L K K K L 1J66 K L  K LL-L LL z/api/mcp/oauth/flows/{flow_id}c0V^8dQhR\R\/#r!rBrEr$r)r%s"r&r'r':swr(c"\V4\4\P!V4pVf\ RRR7hVP 4pVP VR&V#5i)NrzOAuth flow not found or expiredrr)rrCr rrrr)rBrEr@rs&& r&mcp_oauth_flow_statusr9sT7    (D |4UVV}}H HW OsAA c0V^8dQhR\R\/#rr)r%s"r&r'r'Fs = = =w =r(c"\V4\P!V4pVfRRRR/#VPRRR7RRRVP 4R,/#5i)uCancel an in-flight flow. mark_error unblocks the worker so it frees the per-server "already in progress" slot — otherwise a renderer that stops polling leaves the flow squatting until the 300s callback timeout and every retry 409s. Idempotent: a settled flow is left as-is.rTstatusexpiredzCancelled by user) cancelled)rr rrr)rBrEr@s&& r&cancel_mcp_oauth_flowrEs^ 7    (D |dHi00OO'4O8 $$--/("; <.bsG tJq   -2 CJCYCYZ[ZjZjlqCr JsAA$A AzA

OAuth flow expired

Return to Hermes and try again.

r)r)rr rr!zP

OAuth callback rejected

The callback was invalid or already used.

zalready receivedrrzA

Authorization failed

Return to Hermes for details.

zR

Authorization received

You can close this tab and return to Hermes.

) rCr:r rrFrnextr deliver_callbackrr$)rFrr rr!r@ candidatesrs&&f&& r&mcp_oauth_callbackr,Ss  -446 6T;. 37;;BZ3Z D6     tJ t  D  |_mpqq  4uEK  _mpqq l mm)      ^1SX=3   soDCC  C C %C'/DC#+D3D C C D# D.D D DDDz/api/mcp/servers/{name}/enabledcRV^8dQhR\R\R\\,/#)r!r]rr")r$rr)r%s"r&r'r'us'))s)2B)XVY])r(c`aaa"VVV3Rlp\P!V4GRjxL #L5i)zToggle ``enabled`` (takes effect on next session/gateway); disabled servers stay in config so they can be re-enabled without re-entry.c <\SP;'gS4;_uu_4\4p^RIHpT!VP R4;'g/4wr#VP S4;p'd\ RRS RV R2R7hVP R4p\V\4'dSV9d\ RRS R 2R7h\VS,\4'g\ R R R7h\SP4VS,R &\V4R R R 4RRRSR \SP4/# +'giL+;i)rurz mcp_serversrrrrrrrrzMalformed server configenabledNrTr]) rr"rr}r{rrrrrr1r) rr{rrrrrr]r"s r&r0$set_mcp_server_enabled.._runxs   7 7 8 8-C O ;CGGM5I  !%=" > ,?" @ Y7C" " s/Iz/api/mcp/catalogc:V^8dQhR\\,/#r r#)r%s"r&r'r's< .pS P4U U U u.uFwrp RT R T R T /NK pp p p R TR T/# +'giL;iL \dh\d\P!R4Lxi;iuup p p i \dLai;i5i)zBrowse the Nous-approved MCP catalog (optional-mcps/ manifests), each entry annotated with installed/enabled state for ``profile``.zmcp_catalog import failedzCatalog unavailable mcp_catalogNc H<\S4;_uu_4\SP44pVUu/uFCqPSP VP4SP VP43bKE ppRRR4W3#uupi +'giXX3#;ir.)rrP list_catalogr] is_installed is_enabled)catalogrRr rXr"s r&rlist_mcp_catalog.._reads(({779:mtumthi+":":166"BKDZDZ[\[a[aDb!ccmtu)> !v)(E> !sBA B <B B B! zlist_mcp_catalog failedr]kindmessageentries diagnostics)FF)r hermes_clirXrrrr]appendrSrrrrcatalog_diagnostics) r"rarcatalog_entriesinstalled_stater5r6r1rbnkmrXs f @r&list_mcp_catalogrks 138M N N* OG2 " 291B1B51I+I($E!0!4!4UZZ!P I NN.uI J%K MXMlMlMnoMn q61i;Mn o w { ;;3 O N,J  2 012 p    sD)C  D) C C ACD)D,DDD) C D)CD4D D) DD)D D&#D)%D&&D)z/api/mcp/catalog/installcFV^8dQhR\R\\,/#r)rrr$)r%s"r&r'r's#B;B;*;B;hsmB;r(c aa a a "^RIHo ^RIHpSP;'gRP 4pS P V4o S f\RRV R2R7hS PP;'g.Uu0uFqDPkK pp\\SP4V, 4pV'd#\R R V R R PV4 2R7hSPF pV!V4K SP;'gTo SP'd'TT T 3R lp \ P"!T 4GRjxL S P$e6\'T4p \)\+S 4RRT.,T 4RRRTRRRT /#\/S TT T 3Rl4GRjxL RRRTRR/#uupi \dp\R \T4R7ThRp?ii;iL \dh\,dp\RRT 2R7hRp?ii;iLk \dh\,d2p\0P2!R4\R \T4R7hRp?ii;i5i)zInstall a catalog MCP into config.yaml (declared env vars go to .env first; git-bootstrap entries run via the background CLI action path).rW)validate_env_var_name_for_writerMNrzNo catalog entry ''rrzCatalog entry 'z,' does not declare environment variable(s): z, c|<\S4;_uu_4SPP;'g.FfpSP;'g/PVP4pVP 'gKFV'gKP\ VPV4Kh RRR4R# +'giR#;ir.)rrr?rr]secretr)specvaluereffective_profiler5s r& _write_env-install_mcp_catalog_entry.._write_envst 122!JJNN00b0D!XX^^00;E{{{uu&tyy%813222s6B* +B*<B*B** B; mcprOrVzInstall failed: rTr] backgroundrqch<SPSSPSP;'gRR7#)N)enable preloaded_env) install_entryrzr?)rr5rXsr&+install_mcp_catalog_entry..s+K--eDKKW[W_W_WgWgcg-hr(z install_mcp_catalog_entry failedF)rcrXhermes_cli.configrnr]ri get_entryrrr?rsetrrr$r"rrrOrrrrrrrr)rr"rnr]rr declared_envundeclared_envkeyrrurqrtr5rXsf& @@@r&install_mcp_catalog_entryrsK'A IIOO " " $D  ! !$ 'E }6Ha4PQQ,1::>>+?+?R+?A+?$II+?LACML89N$TF*VW[W`W`aoWpVqr  G88C +C 0  // xxx 9 +++ }} )$/ R !23D!EPY[_H`!`bh i dFD,hOO >  h    $lE ::kB GCH=3FG ,   RC:J3%8PQ Q R   > 9:CH==>sA3I:I?F4AI%F9II(!I G# I(G% IH'H(H, I9 G GG  I%H:H;H  HIHI*I+,IIIir.)NNNN)H__doc__rrj contextlibrrfrr r8typingrrrfastapirrrfastapi.responsesr hermes_cli.web_depsr hermes_cli.web_server_mcpr r r hermes_cli.web_modelsrrrrhermes_cli.web_routers._commonrrrrrrrrrouterrrrrrrLockr:r9rr*r3rCr[rrrrpostrputrdeleterrrrrr,r3rSrkrr2r(r&rs`%  &&55*$iiii 46VW&' : '(B;)B;r(