Free recipes / Tools, MCP and Automation

Limit Which Tools an MCP Server Exposes in Hermes

A file snippet for config.yaml that allowlists only the MCP tools you need with tools.include, so Hermes sees fewer tools, spends fewer tokens and cannot reach the risky ones.

An MCP server offers twenty tools and you use three, or some of its tools can delete, send or publish and you do not want Hermes to have them at all. Saves about 20 minutes

The recipe

# Step 1: see everything the server offers before you choose # hermes mcp test [SERVER_NAME] # Note the exact tool names. Ask yourself of each one: does it read, or does it # change, send, publish or delete something? # Step 2: ~/.hermes/config.yaml (Hermes Agent v0.21.x) # include is an allowlist. Every tool not listed is hidden from Hermes. mcp_servers: [SERVER_NAME]: url: "[SERVER_URL]" auth: oauth tools: include: - [FIRST_TOOL] - [SECOND_TOOL] # Step 3: sign in once, then reload # hermes mcp login [SERVER_NAME] # /reload-mcp or /new (in a running session or chat) # Step 4: check what Hermes can see now. Send: # List every tool you can use from the [SERVER_NAME] server, with one line on # what each does. Do not call any of them. # The other way round: keep everything except the risky tools. # tools: # exclude: # - "delete_*" # - "*_send_*" # Entries can be globs. Quote them, because a bare leading * breaks YAML. # If a server has both lists, include wins. # Why it is worth ten minutes # - Visible tools can add to the fixed prompt that every call carries. Run # hermes prompt-size before and after to see the difference. # - Hermes cannot misuse a tool it cannot see, even if a web page or document # tries to talk it into it. # - Start with read-only tools. Add a write tool later, one at a time, when you # know you need it.

Fill in these brackets

`[SERVER_NAME]`	e.g. notion; the name you gave the server under mcp_servers
`[SERVER_URL]`	e.g. https://mcp.example.com/mcp; the address from the provider's docs
`[FIRST_TOOL]`	e.g. search; copy the exact tool name from hermes mcp test
`[SECOND_TOOL]`	e.g. fetch; another read-only tool you actually use

Pro tip

Keep a comment above each include list saying when you last checked the server's tools. Servers add tools in updates, and with include those new tools stay hidden until you choose to add them, which is exactly what you want.

Variation

For a local stdio server that needs a token, put the token in ~/.hermes/.env and keep the include list just as short. Chapter 10 shows how to keep that value out of config.yaml.

Written for Hermes Agent v0.21.x. Check commands against your version with hermes --version. This site is independent and not affiliated with Nous Research.