yjUdZddlZddlZddlZddlZddlZddlmZmZm Z m Z m Z ddl m Z mZmZmZmZmZddlmZmZddlmZddlmZddlmZmZejeZej d Z!d d d gd iZ"ee#ee#effe$d <de#fdZ%de#fdZ&de#fdZ'de#fdZ(dBde#de)de)fdZ*dddde#de)de#de#fdZ+dCde e,dee#e,ffdZ-de#d e,de)fd!Z.de#de)fd"Z/d#ee#e,fde e)e e#ffd$Z0de#de#fd%Z1d&e#de#fd'Z2de#dee#e#ffd(Z3de#d&e#dee#e#ffd)Z4d*e e e#dee#e#ffd+Z5de#d,e e#d-e e#d.e e#d/e e#d ee#efde6e e#e e#e e#e)ffd0Z7de,de,fd1Z8 dCdd2de#de,d3e e9d4e e,de e e#e#ff d5Z:de#de)fd6Z;d7ed9Z?d:Z@dCd;ZAd<ZBde#d e,de)fd=ZCd>ZDd?ZEd@ZFdAZGdS)Du@ MCP Server Management CLI — ``hermes mcp`` subcommand. Implements ``hermes mcp add/remove/list/test/configure`` for interactive MCP server lifecycle management (issue #690 Phase 2). Relies on tools/mcp_tool.py for connection/discovery and keeps configuration in ~/.hermes/config.yaml under the ``mcp_servers`` key. N)AnyDictListOptionalTuple)cfg_get load_config save_config get_env_valuesave_env_valueget_hermes_home)Colorscolor)display_hermes_home)validate_mcp_server_entry)_ENV_VAR_PATTERN _env_ref_namez^[A-Za-z_][A-Za-z0-9_]*$codexz mcp-server)commandargs _MCP_PRESETStextcZttd|tjdS)N )printrrDIMrs ;/home/ragecks/.hermes/hermes-agent/hermes_cli/mcp_config.py_infor.s( % T VZ ( ()))))cZttd|tjdS)Nu ✓ )rrrGREENrs r_successr#1s( % . ./////r cZttd|tjdS)Nu ⚠ )rrrYELLOWrs r_warningr&4s( % / /00000r cZttd|tjdS)Nu ✗ )rrrREDrs r_errorr)7s( % , ,-----r Tquestiondefaultreturnc |rdnd} ttd|d|dtj}n'#t tf$rt|cYSwxYw|s|S|dvS)NzY/nzy/Nrz [z]: >yyes) inputrrr%striplowerKeyboardInterruptEOFErrorr)r*r+ default_strvals r_confirmr7;s"-%%KE;x;;;;;;V]KKLLRRTTZZ\\ x (   , sAA!A?>A?F)passwordr+r9c*ddlm}||||S)Nr)prompt)r+r9)hermes_cli.cli_outputr;)r*r9r+_shared_prompts r_promptr>Gs+>>>>>> >(Gh G G GGr configc|t}|d}|rt|tsiS|S)z;Return the ``mcp_servers`` dict from config, or empty dict.N mcp_servers)r get isinstancedict)r?serverss r_get_mcp_serversrFNsD ~jj''G *Wd33 Nr name server_configct||}|r)|D]}t|td|ddSt}||di|<t |dS)aAdd or update a server entry in config.yaml. Returns False when a high-signal exfiltration-shaped stdio command is rejected. MCP stdio servers are user-chosen local commands, so this blocks shell+egress payloads rather than whitelisting command families. Server '0' was NOT saved due to suspicious configuration.FrAT)rr&r setdefaultr )rGrHissuesissuer?s r_save_mcp_serverrOXs't] ; ;F   E UOOOORDRRRSSSu ]]F1>FmR((. 4r ct}|di}||vrdS||=|s|ddt|dS)z>Remove a server from config.yaml. Returns True if it existed.rAFNT)r rBpopr )rGr?rEs r_remove_mcp_serverrRksd ]]Fjj++G 7u ( =$''' 4r rEcg}|D]W\}}t|ts|d|d4|t ||X|rd|fSt }|rt||d<n|ddt|dgfS)uReplace the WHOLE ``mcp_servers`` map in config.yaml. Unlike ``_save_mcp_server`` (per-key upsert), this sets the entire map so the GUI's mcp.json editor can delete servers, drop an ``enabled: false`` flag (re-enable), or remove nested fields and have those *removals* land on disk. A plain ``/api/config`` deep-merge can only add/override keys, never delete them — which is why edits appeared to succeed but the old entry survived (see MCP tab persistence bug). Every entry is validated up front; on any suspicious command/args the whole save is rejected (returns ``(False, issues)``) so a bad paste can't be partially applied. An empty map removes the key entirely. rJz': expected an objectFrANT) itemsrCrDappendextendrr rQr )rErMrGcfgr?s r_replace_mcp_serversrXxsF]]__<< c#t$$  MM@T@@@ A A A  /c::;;;; f} ]]F( $W } =$''' 8Or ctjdd|d}d|dS)zDConvert server name to an env-var key like ``MCP_MYSERVER_API_KEY``.z [^A-Za-z0-9_]_MCP__API_KEY)resubupperr1)rGsuffixs r_env_key_for_serverras= V$c4::<< 8 8 > >s C CF "& " " ""r tokenct|ts|S|}|dddkr|ddS|S)u#Strip a leading ``Bearer `` from a pasted token. The header template stores ``Authorization: Bearer ${MCP_X_API_KEY}``, so if a user pastes a token that already includes the ``Bearer `` prefix the server receives ``Bearer Bearer `` → 401. Normalize on save. (#37792) Nzbearer )rCstrr1r2)rbstrippeds r_strip_bearer_prefixrgsf eS ! ! {{}}H|y((|!!### Or c0t|}dd|diS)aBuild the persisted Authorization header for a named MCP server. The secret itself lives in the active profile's ``.env`` file. Keeping this template construction beside ``_env_key_for_server`` ensures the CLI and Dashboard produce byte-equivalent MCP configuration. Authorizationz Bearer ${})ra)rGenv_keys r_bearer_auth_headersrls("$''G 5'555 66r ct|}|r|dkrtdtt ||t |S)zPersist a Bearer token in the active profile and return safe headers. ``token`` is a one-time provisioning value. It is normalized and written only to ``.env``; callers persist the returned interpolation template in ``config.yaml``. bearerzBearer token is required)rgr2 ValueErrorr rarl)rGrb normalizeds r_save_bearer_auth_tokenrqse&e,,J 5))++x773444&t,,j999  % %%r raw_envczi}|pgD]}t|pd}|s(d|vrtd|d|dd\}}|}|std|dt|std|d|||<|S) z;Parse ``KEY=VALUE`` strings from CLI args into an env dict.r8=zInvalid --env value 'z' (expected KEY=VALUE)z' (missing variable name)zInvalid --env variable name '')rer1rosplit_ENV_VAR_NAME_REmatch)rrparseditemrkeyvalues r_parse_env_assignmentsr~sF 2  4:2$$&&   d??QTQQQRR RZZQ'' Uiikk VTTTTTUU U%%c** ECSCCCDD Ds Mr preset_nameurlrcmd_argscT|s|||dfSt|}|std||s|r|||dfS|d}|d}t|dpg}|r||d<|r||d<|r||d<|||dfS)z=Apply a known MCP preset when transport details were omitted.FzUnknown MCP preset: rrrT)rrBrolist)rGrrrrrHpresets r_apply_mcp_presetrs -GXu,,   k * *F ?= ==>>> -g-GXu,, **U  Cjj##GFJJv&&,"--H #" e+#* i ) ( f 4 ''r cddlm}ddlm}|" ddlm}|n#t $rYnwxYw||S)u,Resolve ``${ENV}`` placeholders in a server config before connecting. Mirrors ``_load_mcp_config()`` in ``tools/mcp_tool.py``: load ``~/.hermes/.env`` into ``os.environ`` and recursively interpolate any ``${VAR}`` placeholders. The CLI builds header templates like ``Authorization: Bearer ${MCP_X_API_KEY}`` but the probe path never resolved them, so the discovery probe sent the literal placeholder and auth-requiring servers (e.g. n8n) returned 401 — while runtime tool loading worked because it interpolates. (#37792) r)_interpolate_env_vars)current_secret_scopeN)load_hermes_dotenv)tools.mcp_toolragent.secret_scoperhermes_cli.env_loaderr Exception)r?rrrs r_resolve_mcp_server_configrs544444777777%  @ @ @ @ @ @       D   ( ((s ) 66)detailsconnect_timeoutrc2 t}|r"td|ddlm}m}m m}m tN dd} tdt|n#ttf$rdYnwxYw|g  fd } || d z n"#t$r} t| dd} ~ wwxYw |n#|wxYw S) uaTemporarily connect to one MCP server, list its tools, disconnect. Returns list of ``(tool_name, description)`` tuples. Raises on connection failure. ``details``: optional dict the probe fills with extra capability counts (``prompts``, ``resources``) — an out-param so the return shape stays stable for existing CLI callers. z; r)_ensure_mcp_loop_run_on_mcp_loop_connect_server_stop_mcp_loop_if_idle_parse_boolishNrg?g>@cKtj   d{V} |jD]Q}t|ddpd}t |dkr |dddz}|j|fR 5 dpi} |dd } |d d }tt|d dd ddtdtffd }|rS|drH |j d{V}t |j  d<n#t$rYnwxYw|rS|d rH |j d{V}t |j d <n#t$rYnwxYw|d{VdS#|d{VwxYw)Ntimeout descriptionr8PM...toolspromptsTr+ resourcesinitialize_result capabilitiescap_attrr,c2dSt|dduS)NT)getattr)radvertised_capss r _advertisesz9_probe_single_server.._probe.._advertises[s''.#t"?HdCC4OOr )asynciowait_for_toolsrlenrUrGrBreboolsession list_promptsrrlist_resourcesrshutdown)servertdesc tools_filterprompts_enabledresources_enabledrresultrrrr?rrrG tools_founds @r_probez$_probe_single_server.._probe9s' OD& ) )?         4 $] 3 3q-44:t99r>>9u,D""AFD>2222" &zz'228b "0. $$Y//###%3N $$[114%%%!#*F$7>>"## P#P$PPPPPP#{{9'='='-~'B'B'D'D!D!D!D!D!D!D-0-@-@ **$$[)A)A'-~'D'D'F'F!F!F!F!F!F!F/263C/D/D ,,$//## # # # # # # # # #&//## # # # # # # # #sTC4G!6EG E%"G$E%%G66F-,G- F:7G9F::GG5 r)rrojoinrrrrrrrrBmaxfloat TypeError BaseException_unwrap_exception_group)rGr?rrrMrrr raw_timeoutrexcrrrs```` @@@r_probe_single_serverrs'tV 4 4F ,6**+++( / /Fjj!2B77  #!#u['9'9::OO:& # # #"OOO #)+K8$8$8$8$8$8$8$8$8$8$8$t!?R+?@@@@@ 555%c**45 A         s<2BB&%B&CD C9$C44C99D Dc ddlm}||S#t$r'}td||Yd}~dSd}~wwxYw)aReturn True if an OAuth token file exists on disk for ``name``. Used after ``hermes mcp login`` to distinguish a genuine authentication from a probe that succeeded only because the server allowed initialize/tools-list without auth (so no token was ever acquired). r)HermesTokenStoragez)Could not check OAuth tokens for '%s': %sNT)tools.mcp_oauthrhas_cached_tokensrloggerdebug)rGrrs r_oauth_tokens_presentr}sy666666!!$''99;;;  @$LLLttttts"% AAArct|tr0|jr)|jd}t|tr|j)t|tr|St t |S)aBExtract the root-cause exception from anyio TaskGroup wrappers. The MCP SDK uses anyio task groups, which wrap errors in ``BaseExceptionGroup`` / ``ExceptionGroup``. This makes error messages opaque ("unhandled errors in a TaskGroup"). We unwrap to surface the real cause (e.g. "401 Unauthorized"). r)rCBaseExceptionGroup exceptionsr RuntimeErrorre)rs rrrsw S, - - #. nQ S, - - #. #y!! C ! !!r c ~"|j}t|dd}t|dd}t|ddpg}|r|ddkr |dd}t|dd}t|d d}t|d d}t|d d}i} t|} t||||t || \}}}} n4#t $r'} t t| Yd} ~ dSd} ~ wwxYw|r| rt d dS|sO|sMt dtdtdtdtddSt} || vr&td|ddstddS|r|| d<n|| d<|r|| d<| r| | d <||| d <t|| }|r)|D]}t|td|ddS|r|dkrttd|dd} ddlm}|||| d}|rd| d<t%dd}ntd n)#t&$r} td!| Yd} ~ nd} ~ wwxYw|s2td"td#drntddSn|rttd$|td%d}|r|d&ks|st)|}t+|}|rt%|d'nGt-d(d)}|r4t/||| d*<t%d+t1d,||rt3|| d*<ttt5d-|dt6j t;|| "nu#t&$rh} t d.| td/dr:d| d0<t=|| r%t%d1|d2td3|zYd} ~ dSd} ~ wwxYw"sEtd4td5dr#t=|| rt%d1|d6dStt%d7t?"d8|d9t"D]U\}}t?|d:kr |dd:d;zn|}td|Vt tCt5d?t?"d@t6j"#$}n5#tJtLf$r!ttdYdSwxYw|dAvrtdBdS|dCvrddDl'm(}dE"D}tStUt?"}|dF|dG||}|stdHdS"fdItW|D}|| ,dJidK<t?|} t?"}!nt?"} t?"}!d| d0<t=|| rGtt%d1|dLt1dM| dN|!dO tdPdSdS)Qz9Add a new MCP server with discovery-first tool selection.rN mcp_commandrrz--ruauthrenvr)rrrrrHzJ--env is only supported for stdio MCP servers (--command or stdio presets)zBMust specify --url , --command , or --preset z Examples:z3 hermes mcp add ink --url "https://mcp.ml.ink/mcp"zP hermes mcp add github --command npx --args @modelcontextprotocol/server-githubz+ hermes mcp add myserver --preset mypresetrJz' already exists. Overwrite?Fr Cancelled.rrKoauthStarting OAuth flow for ''... get_managerz>OAuth configured (tokens will be acquired on first connection)Tu8OAuth setup failed — MCP SDK auth module not availablez OAuth error: z"This server may not support OAuth.z Continue without authentication?zConnecting to z(Does this server require authentication?headerz: already configuredzAPI key / Bearer token)r9headersz Saved to z /.env as  Connecting to 'Failed to connect: z(Save config anyway (you can test later)?enabledzSaved 'z' to config (disabled)z%Fix the issue, then: hermes mcp test z'Server connected but reported no tools.zSave config anyway?z ' to configzConnected! Found z tool(s) from 'z':<r 40s z Enable all z tools? [Y/n/select]: >nnouCancelled — server not saved.>sselectcurses_checklistc4g|]}|dd|dSru — ru.0rs r zcmd_mcp_add..Ls.888QQqT((!A$((888r Select tools for 'rvu'No tools selected — server not saved.c,g|]}|dSrr)rirs rrzcmd_mcp_add..Ys!<<<a <<rqrrlrrCYANrrOrr"r0r%r1r2r3r4hermes_cli.curses_uirsetrangesortedrL)#rrGrrr auth_typerrrraw_connect_timeoutrH explicit_env_preset_appliedrexistingrMrNoauth_okr oauth_auth needs_authrk existing_keyapi_key tool_namershortchoicerlabels pre_selectedchosen chosen_names tool_counttotalrs# @r cmd_mcp_addrs5 9D $t $ $CdM400GtVT**0bH HQK4''ABB<fd++I$$//KdE4((G!$(94@@$&M -g66 2C #(^^' 3 3 3 /Wh s3xx |[\\\ wSTTT k CDDD `aaa ;<<< !!H xE4EEEuUUU  ,    F 0" e#* i  -$,M& !  0#/M% &+> '( &t] ; ;F   E UOOOORDRRRSSS 0JyG##  4$444555 , ; ; ; ; ; ;$<<c=,,W55J U(/ f%YZZZSTTT , , , *S** + + + + + + + + ,  6 7 7 7:DIII l###  J  $s$$%%%HRVWWW  JH$$I$-d33,W55 X===>>>>%&>NNNGX3J '44 i0!!V-@-B-B!V!VW!V!VWWW J/CD/I/IM), GGG %.D... < <=== $T=99 *S**+++ > N N N F',M) $m44 F?4???@@@=DEEE :;;; )4 8 8 8 6m44 644444555 GGG DU D DD D D DEEE GGG CC 4%(YY^^SbS E!! AU9fl33AAA%AABBBB GGG D#e**DDDfm T T  %''%%''  x (  l  /000   99999988%8885U,,-- !! ( ( ( (       ; < < < F<<< < '(:(:<< = = = .d... = = = lt , , , ,---  777777 T"""*+++++      s2C44 DDc Zt}|shttdttdtdtdtdStttdtjtjzttddd d d d d d dd ddtddd dd dd d|D]\}}d|vr+|d}t|dkr |dddz}|}nd|vr|d}| dg}t|tr/|r-|d d d|ddD}n|}t|dkr |dddz}nd}| di}t|tr| d} | d } | r(t| trt| d!} n0| r)t| trd"t| d#} nd$} nd$} | d%d&} t| tr| d'v} | rtd(tjntd)tj} td|d d |d d | dd | tdS)*z List all configured MCP servers.zNo MCP servers configured.z Add one with:z( hermes mcp add --url z8 hermes mcp add --command --args Nz MCP Servers:rNamez<16r Transportz<30Toolsz<12Statusz<10u0────────────────uZ──────────────────────────────u$────────────u──────────rrrrc34K|]}t|VdSNre)ras r zcmd_mcp_list..s(-K-Kc!ff-K-K-K-K-K-Kr ?rrexcludez selected-z excludedallrT>1r/trueu ✓ enabledu ✗ disabled)rFrrrrrBOLDrTrrBrCrrrDrer2r"r)rrErGrWr transportcmdr tools_cfgrr& tools_strrstatuss r cmd_mcp_listr1sm  G   *+++  o 8999 HIII  GGG % &+ "; < <=== GGG Jv J J JK J J Jg J J JH J J JKKK Bz B BJ B B B Bj B BCCC]]__(H(H c C<<e*C3xx"}}#2#h&II #  i.Cwwvr**H(D)) h "MMSXX-K-Khrrl-K-K-K%K%KMM  9~~""%crcNU2 IGGGR(( i & & mmI..GmmI..G ":gt44 ""7||666  "Z66 "7G 777 ! I'')T** gs # # >mmoo)==G7>e}fl333E.Z`ZdDeDe F4FFFiFFFiFFFfFFGGGG GGGGGr cj|j}t}||vr]td|dt|}|r%t dd|dS||}tttd|dtj d|vrt d |dn(| d d }t d || d d}| di}|dkrt dn|r| D]\}} t| trd|vsd |vrYt!jd| } t%| dkr| dddz| ddz} nd} td|d| nt dt'j} t+||} t'j| z dz}nG#t,$r:}t'j| z dz}td|dd|Yd}~dSd}~wwxYwt/d|dd t/d!t%| | rft| D]U\}}t%|d"kr |dd"d#zn|}tdt|tjd$d%|VtdS)&z!Test connection to an MCP server.rJr Available: rNz Testing 'rruTransport: HTTP → rr%uTransport: stdio → rr8rrzAuth: OAuth 2.1 PKCEr|cltjt|ddS)Nrur8)osgetenvrgroup)ms rzcmd_mcp_test..s+")MRSRYRYZ[R\R\D]D]_a:b:br z***rz: z Auth: noneizConnection failed (z.0fzms): z Connected (zms)zTools discovered: 7r36sr)rGrFr)rrrrrrrrrBrTrCrer2rr^rtime monotonicrrr#r")rrGrE availablerWr-rrkvresolvedmaskedstartr elapsed_msrrrrs r cmd_mcp_testrHs 9D  G 76$666777((  8 6 ) 4 466 7 7 7 $-C GGG %(d(((&+ 6 6777 || 1SZ112222ggi%% +c++,,,##Iggi$$GG $%%%%  MMOO , ,DAq!S!! ,u '9'9Vqwwyy=P=P+/0b0bdeffx==1$$%bqb\E1HRSSMAFF"F*Q**&**+++ , l N  E$T3//n&&.$6 n&&.$6 ?Z???#??@@@  .: . . . ./// .#e** . ./// G $ G GOIt),TRD"I%%TE Ey&,77EEEeEE F F F F GGGGGs)I J /JJc|d}|std|ddS|ddkr:td|d|ddtd dS d d lm}||n)#t $r}td |Yd }~nd }~wwxYwttd|d d dl m }|d} t|}n#ttf$rd}YnwxYwt|d}|5t|||}d d d n #1swxYwYt!|swtdttdttt#dt$jtt#d|dt$jtt#d|t$jtt#dt$jtt#dt$jtt#dt$jtt#dt$jttd|zd zdS|r!t)d!t+|d"nt)d#d$S#t $rG} d d%l m}||||&} n#t $rd } YnwxYwtd'| p|Yd }~dSd }~wwxYw)(ajForce a fresh OAuth flow for one server. Returns True on success. Wipes cached OAuth state (disk + in-process MCPOAuthManager cache), re-probes to trigger the browser flow, and verifies a token actually landed before reporting success. Shared by ``hermes mcp login`` and ``hermes mcp reauth`` so both behave identically for a single server. rrJu,' has no URL — not an OAuth-capable serverFrrz$' is not configured for OAuth (auth=)z?Use `hermes mcp remove` + `hermes mcp add` to reconfigure auth.rrz&Could not clear existing OAuth state: Nrr)force_interactive_oauthrggs@)ruVServer responded, but no OAuth token was obtained — authentication did not complete.zSome providers (e.g. Google Drive, Atlassian) do not support automatic client registration. For those you must create an OAuth client yourself and add its credentials to config.yaml:z mcp_servers:z :z url: z auth: oauthz oauth:z- client_id: ""z5 client_secret: ""zThen re-run `hermes mcp login z`.uAuthenticated — z tool(s) availablez(Authenticated (server reported no tools)T)!humanize_oauth_registration_error) server_urlzAuthentication failed: )rBr)rrrrrr&rrrKrrrorrrrrrr#rrM) rGrHrrrrK_login_connect_timeoutrrM humanizeds r_reauth_oauth_serverrQst   E " "C L$LLLMMMu  G++`$``MDUDUV\D]D]```aaa OPPPuA777777 T"""" AAA?#??@@@@@@@@A GGG 0d 0 0 0111:;;;;;;!.!2!23D!E!E )%*+A%B%B " ":& ) ) )%( " " " )!$%;U!C!C $ $ & &  (m5KE               %T**  3    GGG P    GGG %*FJ77 8 8 8 %((((&*55 6 6 6 %---vz:: ; ; ; %-vz:: ; ; ; %(&*55 6 6 6 %I6:VV W W W %QSYS]^^ _ _ _ GGG 2T9D@ A A A5  A H#e**HHH I I I I ? @ @ @t      I I I I I I99ccII   III ;)9c;;<<<uuuuu s#B%% C /CC 0L4 DL4D2/L41D22L4E." L4.E22L45E26FL42L44 N?MN M# N"M##NNc|j}t}||vr < '(:(:<< = = =wt}-----r cHt}t|dd}t|dd}|rd|D}|stddSt tdt |dd }|D]`\}}t t t d |d tjtj zt||r|d z }at td |dt |ddS|s tdtddS||vr`` re-auths a single server (same as ``login``). ``hermes mcp reauth --all`` discovers every ``auth: oauth`` server in config and re-auths them ONE AT A TIME. Serial-by-design: a human can only complete one browser OAuth flow at a time, so re-authing all servers concurrently would open N tabs at once and N-1 would time out. This is the self-service fix for the recurring stale-client ritual in GH#36767 (and avoids the startup popup storm when several servers go stale at once). r(FrGNcxg|]7\}}|ddk|d3||f8S)rrr)rB)rrcs rrz"cmd_mcp_reauth..sN   q!uuV}}''AEE%LL'F'''r z+No OAuth-based MCP servers found in config.zRe-authenticating z! OAuth server(s) one at a time...ru ── u ──ruzRe-authenticated rz server(s)zBSpecify a server name, or use --all to re-auth every OAuth server.z=Usage: hermes mcp reauth | hermes mcp reauth --allrJrrr)rFrrTrrrrrrr+rQr#r)r)rrEdo_allrG oauth_servers succeededrrVs rcmd_mcp_reauthrZs  G T5% ( (F 4 & &D   &}}     ? @ @ @ F  X3}#5#5XXXYYY !  DAq GGG %.A... fk0IJJ K K K#Aq)) Q  OYOO]1C1COOOPPP STTT MNNN 76$666777  > < '(:(:<< = = =wt}-----r c ddl}|js+td|j|d|j}t}||vr]td|dt| }|r%tdd |dS||}tttd |d tj t!||}n*#t"$r}td |Yd}~dSd}~wwxYw|st%d dS|di}t)|t*r+|d} |d} nd} d} d|D ddlmn#t0$rdYnwxYw| r>t)| tr)d| Dfdt3D} ni| r>t)| tr)d| Dfdt3D} n)t5t7t9|} t9| } t9|} td| d| d|dtddlm}d|D}|d|d|| }|| krtd dSt?}tA|d!|i"}t9|| kr|!ddnXfd#tE|D}|#di||dd<|d!dd||#d!i|<tI|t9|}tKd$|d| d%td&dS)'z?Reconfigure which tools are enabled for an existing MCP server.rNz?Error: 'hermes mcp configure' requires an interactive terminal.)filerurJrr3rrz' to discover tools...rzServer reports no tools.rrr&cg|] }|d Srrrs rrz%cmd_mcp_configure..s***1!A$***r )matches_name_filterc ||vSr r)rpatternss rr^z.cmd_mcp_configure..matches_name_filters ( (r c,h|]}t|Srr!rps r z$cmd_mcp_configure..///!s1vv///r c2h|]\}}||Srr)rrtn include_setr^s rrdz$cmd_mcp_configure..s@   !R""2{33    r c,h|]}t|Srr!rbs rrdz$cmd_mcp_configure..rer c2h|]\}}||Srr)rrrg exclude_setr^s rrdz$cmd_mcp_configure..s@   !R&&r;77    r z Currently rz tools enabled for 'z'.rc4g|]}|dd|dSrrrs rrz%cmd_mcp_configure..s. 8 8 81$$ad$$ 8 8 8r rrvzNo changes made.rArc g|] }| Srr)rr tool_namess rrz%cmd_mcp_configure.."s>>>! 1 >>>r zUpdated config: z tools enabledz/Start a new session for changes to take effect.)&sysstdinisattyrstderrexitrGrFr)rrrrrrrrrr&rBrCrDrr^ ImportError enumeraterrrrrr rrQrrLr r#)r_sysrGrErArW all_toolsrr.rr&r  currentlyrrr r r? server_entryr  new_countrkrhr^rns @@@@rcmd_mcp_configurer{s :     OVZVabbbb ! 9D  G 76$666777((  8 6 ) 4 466 7 7 7 $-C GGG %@D@@@&+ N NOOO(s33 *S**+++ +,,,$$I)T""-- **-- **** ***J)6666666 ))) ) ) ) ) )) 2:gt,, 2//w///      $Z00    2Z..2//w///      $Z00   5Y0011 L!!I  NNE Fy F F5 F Fd F F FGGG GGG655555 8 8i 8 8 8F  $T$$$F   !!!]]F6=$CCCL 6{{e$''''>>>>vf~~>>> ,,,+7 Wi(W!!)T2221=FmR((.F I A A AE A A ABBB ;<<<< Install a catalog MCPz?hermes mcp serve Run as MCP serverzEhermes mcp add --url Add a custom MCP serverz@hermes mcp add --command Add a stdio serverzEhermes mcp add --preset Add from a known presetz=hermes mcp remove Remove a serverzEhermes mcp list List configured serversz=hermes mcp test Test connectionz:hermes mcp configure Toggle toolszChermes mcp login Re-authenticate OAuthzNhermes mcp reauth | --all Re-auth one or all OAuth servers)r mcp_serverhermes_cli.mcp_pickerrrrrorsrrr1rHr{rSrZrBrrrrr) ractionrrrrrvrchandlershandlers rrr1sv T< . .F ,,,,,,wtY>>????444444  666666  999999 _WT<<<B C C   IIbMMM &#   Hll6""G  544444  eM6;//000 _``` UVVV STTT OPPP UVVV PQQQ UVVV MNNN UVVV MNNN JKKK STTT ^___ r )Tr )H__doc__rloggingr5r]r?typingrrrrrhermes_cli.configrr r r r r hermes_cli.colorsrrhermes_constantsrhermes_cli.mcp_securityrrrr getLogger__name__rcompilerxrre__annotations__rr#r&r)rr7r>rDrFrOrRrXrargrlrqr~tuplerrrrrrrrrrr1rHrQrSrZr{rrr rrs 33333333333333,+++++++000000======::::::::  8 $ $2:9:: + d3S#X&'*****030000131111.....  s T T    05RHHHcHHsHCHHHHXd^tCI3t& S T    $sDy/eD$s)O6LB#c#c####      7s7tCH~7777 &# &c &d38n & & & &HT#Y$7DcN&( (#( # ( c] ( 3i (S>( 8C=(3-cD 89((((H)t)))))2AEdcgddd dd.6uodRZ[_R`d %S/ddddN       " "9 " " " "$J9J9J9^   @@ @ @ @ J; ; ; @asa4aDaaaaH...2/././.hh=h=h=Z>>>>>r