Skip to content

feat: add a remote MCP endpoint package - #12

Closed
Musyg wants to merge 1 commit into
feat/hermes-agent-providerfrom
feat/remote-mcp
Closed

Musyg wants to merge 1 commit into
feat/hermes-agent-providerfrom
feat/remote-mcp

Conversation

@Musyg

@Musyg Musyg commented Nov 14, 2026

Copy link
Copy Markdown
Owner

Stacked on #11 (base feat/hermes-agent-provider); GitHub retargets it to main once #11 is merged.

Adds packages/remote-mcp: hermes-memory-mcp 0.1.0a1, the provenance store served over MCP's Streamable HTTP transport, Python standard library only.

What it does

  • POST /mcp with one JSON-RPC message, JSON responses; sessions through Mcp-Session-Id; DELETE ends a session; GET answers 405 (no server stream).
  • Handshake-era versions 2025-11-25, 2025-06-18, 2025-03-26. A server/discover probe gets "method not found", so modern clients fall back to initialize.
  • Bearer token required off loopback, read from an owner-only file; browser Origin refused unless allowed; bounded bodies and sessions.
  • Four tools with annotations; --read-only and --no-withdraw.
  • Shares the store and exposure ledger of the Hermes Agent provider from feat: add a Hermes Agent memory provider package #11: a withdrawal over MCP warns Hermes Agent sessions that were shown the source, and an MCP session gets a withdrawn_notice in its next tool result, once per source.

Checks

  • scripts/check_distributions.py now builds four distributions and expects eight passing suites. In a python:3.12 container on one Linux host: core 166 + 166, registry 49 + 49, Hermes Agent provider 15 + 15, MCP endpoint 14 + 14, no failures, errors or skips, test sources identical in each sdist.
  • Falsification: eleven mutations (origin check, token check, unknown session, initialized gate, repeated notice, no exposure record, read-only bypass, network bind without token, discover probe, token file permissions, unknown arguments) each turn at least one test red.
  • Interoperability, observed once: the official MCP Python SDK 2.3.0 client in auto mode fell back to the handshake at 2025-11-25, listed the tools, stored, searched and got a tool error for an unknown source. Hermes Agent d93e9ba4, configured with the URL and a bearer header, discovered the four tools and answered from the store with its source_id values (local Qwen3.5-9B).

Limits

Bearer tokens only: clients that require OAuth (web connectors) cannot connect yet. Sessions are in memory. No server-initiated messages. Lexical search. Not yet released.

packages/remote-mcp ships hermes-memory-mcp 0.1.0a1: the provenance store
served over MCP's Streamable HTTP transport, Python standard library only.

- POST /mcp, one JSON-RPC message per request, JSON responses; sessions
  through Mcp-Session-Id; DELETE ends a session; GET answers 405.
- Handshake-era versions 2025-11-25, 2025-06-18 and 2025-03-26. A
  server/discover probe gets "method not found" so modern clients fall back.
- Bearer token required off loopback, read from an owner-only file; browser
  Origin headers refused unless allowed; bounded bodies and sessions.
- Four tools with annotations (search and explain read-only, remember,
  withdraw destructive); --read-only and --no-withdraw.
- Shares the store and exposure ledger of the Hermes Agent provider: a
  withdrawal over MCP warns Hermes Agent sessions that were shown the source,
  and the next tool result of an MCP session carries a withdrawn_notice once
  per source.

check_distributions.py builds a fourth distribution, installs the locally
built core and provider wheels next to it and expects eight passing suites.
@Musyg

Musyg commented Nov 15, 2026

Copy link
Copy Markdown
Owner Author

Superseded by #15 (merged): the Hermes Agent provider and the HTTP transport now run on the shared operations surface, with the full memory (derive, correct, withdraw with cascade, lessons). Branch kept.

@Musyg Musyg closed this Nov 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant