Restricted MCP bridge for durable Hermes Kanban tasks
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"hermes-kanban-mcp-vn","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Hermes Kanban MCP (`hermes-kanban-mcp-vn`) Restricted stdio MCP bridge that submits durable work to an existing Hermes Kanban board. It does not create another task database and does not expose arbitrary shell, workspace, profile, model, parent dependency, or runtime selection. ## Architecture and security ```text MCP Hub --stdio/uvx--> this MCP --HTTPS bearer--> restricted backend --fixed argv--> Hermes Kanban ``` Hermes v0.21.0 has authenticated dashboard plugin routes, but its dashboard credential grants a broader surface than this integration needs. This package therefore includes a companion backend that exposes only four operations and invokes the installed Hermes CLI with an argv list and `shell=False`. It always creates a `scratch` workspace, records `created-by=external-mcp`, and force-loads `kanban-team-workflow`. Both MCP client and backend enforce board and assignee allowlists. The backend defaults to loopback. Put TLS and source-IP/network policy at the reverse proxy or use a private VPN path; never expose the Hermes dashboard or this backend directly to the public Internet. Plain HTTP is rejected by the MCP client except for loopback tests. Keep bearer tokens only in the service/MCP Hub secret store, never in args, source, logs, or committed config. `ready` is conservative: a profile must both exist on disk according to `hermes kanban assignees` and be explicitly listed in `HERMES_KANBAN_READY_ASSIGNEES` after Linus verifies its gateway, provider, and runtime. A created task remains asynchronous. Creating one does not authorize production deployment, deletion, external communication, or spending; normal task approval gates still apply. ## MCP tools - `list_agents`: list only allowlisted profiles and their conservative readiness. - `create_task`: create a durable asynchronous task and return its real `t_........` ID. Callers must reuse a stable `idempotency_key` for retries; Hermes stores the key durably. - `get_task`: return task status, c…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.