Hermes Hostinger — verified mcp-remote path (2026-07-13)

Date: 2026-07-13
Context: Born Free co-founder (Hostinger Managed Hermes + Telegram “BF CoFounder”) → Knowtation vault under projects/born-free/**
Hermes: upgraded 0.16.0 → 0.18.2 (pip install --upgrade hermes-agent, /opt/venv/bin/hermes, HOME=/data)
Verdict: Connection verified via desktop mcp-remote OAuth + token-folder copy + Hermes stdio. Native hermes mcp login on Hostinger still unreliable (hang after paste). Phase B device authorization is the product end-state.

Related: Spec docs/DURABLE-AGENT-AUTH-SPEC.md · Roadmap docs/DURABLE-AGENT-AUTH-ROADMAP.md · Prior spike hermes-oauth-spike-2026-07-12.md

Simple summary

Pasting the Hub “Copy token” JWT into Hermes .env fails when it expires. Running OAuth login on Hostinger itself hung after the browser paste-back. What worked: complete OAuth on a normal Mac with mcp-remote, securely copy the token folder to the Hermes host, and run Knowtation MCP through npx mcp-remote. After Restart, Telegram saw 23 Knowtation tools.

Technical summary

• Paste path (btn-copy-hub-api-env) is session access JWT only — no refresh.
• Public MCP: https://mcp.knowtation.store/mcp (not api.knowtation.store/mcp, not Netlify /mcp).
• Hostinger curls to health/discover/token were ~0.3s; hang is in Hermes completing-flow, not network.
• Working shape: Hermes mcp_servers.knowtation = stdio npx -y mcp-remote https://mcp.knowtation.store/mcp with tokens under /data/.mcp-auth/.

Failed approaches (do NOT recommend)

1. Copy Hub JWT into /data/.env as KNOWTATION_HUB_TOKEN — Hub health OK; vault REST/MCP 401; access JWT expires; no refresh on paste path.
2. Wrong MCP URL: https://api.knowtation.store/mcp + Bearer / X-Vault-Id in config.yaml — must be https://mcp.knowtation.store/mcp.
3. hermes mcp login knowtation with auth: oauth on Hostinger — paste-back of callback/?code=&state= accepted (“completing flow”), then hang ~120–325s; no tokens under ~/.hermes/mcp-tokens/. Upstream OAuth probe timeout history: NousResearch/hermes-agent#24097 (improved in recent Hermes; Hostinger still hung on completing-flow in this incident).
4. lshell limits on Hostinger web CLI (nano +540, multi-line heredocs) — use agent Allow Once / python edits.
5. No File Manager in Managed Hermes hPanel — upload via Open App / Telegram paperclip.
6. Dual Hermes CLI tabs → “Another CLI session is already active”.

Verified working recipe (interim until Phase B is live for the agent)

1. Upgrade Hermes: pip install --upgrade hermes-agent → ≥ 0.18.2.

2. On a desktop Mac (loopback works):

   npx -y mcp-remote https://mcp.knowtation.store/mcp
   

   Complete browser OAuth. Tokens land in ~/.mcp-auth/mcp-remote-0.1.37/ (version may differ), e.g. {hash}_tokens.json, _client_info.json, _code_verifier.txt, _lock.json.

3. Pack (no secrets in chat):

   tar czf ~/mcp-auth-knowtation.tgz -C ~ .mcp-auth/mcp-remote-0.1.37
   

4. Upload tarball to Hostinger /data/ via Open App / Telegram paperclip. Agent: save as /data/mcp-auth-knowtation.tgz, tar xzf under /data, ls filenames only — never print token contents.

5. Hermes /data/config.yaml knowtation block (final working shape):

   mcp_servers:
     knowtation:
       command: npx
       args:
         - -y
         - mcp-remote
         - https://mcp.knowtation.store/mcp
       timeout: 120
       connect_timeout: 60
       enabled: true
   

   Remove url, auth: oauth, and Bearer headers for knowtation. Leave unrelated servers alone.

6. Hostinger dashboard → Restart Hermes.

7. Telegram: “List Knowtation MCP tools…” → 23 tools connected (search, relate, backlinks, extract_tasks, cluster, tag_suggest, get_note, get_note_outline, get_document_tree, get_metadata_facets, get_section_source, list_notes, write, hub_create_proposal, capture, transcribe, index, vault_sync, import, import_url, export, summarize, enrich).

Note: One search of projects/born-free returned no paths — may be vault id / empty folder / indexing. Connection itself verified.

Loopback vs Hostinger callback (UX clarification)

Browser “Authorization successful” on http://localhost:<port>/oauth/callback is served by the machine running the browser’s loopback listener. Starting the flow from Hostinger CLI does not mean Hostinger received the callback unless paste-back/tunnel delivers the code to that process. Mac success can coexist with Hostinger still waiting.

After Mac mcp-remote shows “Proxy established / Press Ctrl+C to exit”, Ctrl+C is fine once tokens are on disk; the proxy need not keep running for the copy-tokens approach.

Secrets policy

This note contains no JWTs, refresh tokens, Hostinger credentials, or token-file contents. Treat ~/.mcp-auth/ / /data/.mcp-auth/ as secrets (mode 0600); copy via secure tarball/upload — never paste JSON into Telegram.

Product follow-through