<!-- Generated by scripts/generate-ai-docs.mjs. Do not edit by hand. -->
# Hermes MCP setup

Release: 1.3.0 (2026-08-22)

The Hermes MCP endpoint is `https://socialmedia.janvalellam.com.br/api/mcp`. It uses MCP Streamable HTTP, is stateless, accepts JSON requests, and accepts either an active Supabase session or an `hms_live_` personal bearer token. A session receives capabilities from the Studio `access_level` role alone; a PAT receives the intersection of token scopes, `api_access_level`, and the current Studio-role ceiling.

## Client configuration

Keep the access token in the client's secret store or environment. Never commit the expanded value. A personal token is shown only once when created, lasts 1–90 days, and must be revoked when no longer needed.

```json
{
  "mcpServers": {
    "hermes": {
      "url": "https://socialmedia.janvalellam.com.br/api/mcp",
      "headers": {
        "Authorization": "Bearer ${HERMES_ACCESS_TOKEN}"
      }
    }
  }
}
```

Use `Content-Type: application/json` and `Accept: application/json, text/event-stream` when configuring a lower-level client. A stateless client must not depend on an `Mcp-Session-Id` from a previous request.

## Safe operation

1. Authenticate as the person authorizing the work and confirm `GET /api/me`.
2. Call `tools/list`; the server exposes an explicit allowlist, not a generic HTTP or SQL tool. Besides the hand-written tools, every contract operation that accepts a personal token has its own tool named `hermes_<operationId in snake_case>` (for example `getLaunchDecision` becomes `hermes_get_launch_decision`), with path and query parameters as arguments and the JSON request body under `body`. Session-only operations, documentation files and multipart uploads have no tool. A tool is listed only when your capabilities allow it.
3. Read the target immediately before a write. Preserve CAS tokens and idempotency keys exactly as documented.
4. Get explicit user confirmation before publishing, deleting, changing permissions, offboarding, or causing an external side effect.
5. Treat `401` as an expired/invalid credential and `403` as a missing active membership, session requirement, or capability. Do not bypass either with SSH, direct database access, or a service-role key.
6. Use a Supabase session—not a personal token—for `/api/access/*` management, member administration, and OAuth start/disconnect operations.

Contract: https://socialmedia.janvalellam.com.br/api/ai/openapi.yaml
Full reference: https://socialmedia.janvalellam.com.br/api/ai/llms-full.txt