---
description: Operate Hermes Studio through its authenticated API and MCP contract
globs:
alwaysApply: false
---

# Hermes Studio

- Use the public OpenAPI https://socialmedia.janvalellam.com.br/api/ai/openapi.yaml and do not guess routes or payloads.
- Prefer the authenticated stateless MCP endpoint https://socialmedia.janvalellam.com.br/api/mcp for supported agent operations.
- Authenticate MCP with a secret Supabase session or narrowly scoped `hms_live_` personal token. Use a Supabase session for session-only access-management operations.
- Studio sessions use the member `access_level` capabilities and are never restricted by `api_access_level`; that separate setting applies only to personal tokens.
- Confirm identity/capabilities before writes. Read current state first and preserve CAS plus idempotency tokens.
- Never expose tokens, passwords, provider secrets, service-role keys, or environment files.
- Never use a generic API, SQL, SSH, or database bypass when an explicit Hermes operation exists.
- Require explicit user intent for delete, offboarding, approval, publish, permission, connection, and external-message actions.
- Keep publisher/API work in SiteupAgencia/hermes-publisher and frontend work in trismegisto639/hermes-studio.