diff --git a/optional-mcps/algolia/manifest.yaml b/optional-mcps/algolia/manifest.yaml
new file mode 100644
index 0000000000..0eedd4aa4d
--- /dev/null
+++ b/optional-mcps/algolia/manifest.yaml
@@ -0,0 +1,32 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: algolia
+description: 'Algolia search: indices, analytics, and settings (read-only).'
+source: https://www.algolia.com/doc/guides/model-context-protocol/productivity-mcp
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.algolia.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - algolia
+  hosts:
+    - algolia.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Algolia (or run `hermes mcp login algolia`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/alltrails/manifest.yaml b/optional-mcps/alltrails/manifest.yaml
new file mode 100644
index 0000000000..19af1b8783
--- /dev/null
+++ b/optional-mcps/alltrails/manifest.yaml
@@ -0,0 +1,31 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: alltrails
+description: 'AllTrails: find hikes and trails with reviews and ratings.'
+source: https://www.alltrails.com/mcp
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). No authentication required (verified live:
+# initialize succeeds anonymously).
+
+transport:
+  type: http
+  url: https://www.alltrails.com/mcp
+
+auth:
+  type: none
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - hiking
+    - trail
+    - alltrails
+  hosts:
+    - alltrails.com
+
+post_install: |
+  No account or credentials needed — tools are available as soon as the
+  session restarts.
diff --git a/optional-mcps/amplitude/manifest.yaml b/optional-mcps/amplitude/manifest.yaml
new file mode 100644
index 0000000000..6e71ac586f
--- /dev/null
+++ b/optional-mcps/amplitude/manifest.yaml
@@ -0,0 +1,35 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: amplitude
+description: 'Amplitude analytics: charts, dashboards, experiments, flags.'
+source: https://amplitude.com/docs/amplitude-ai/amplitude-mcp
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.amplitude.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - amplitude
+  hosts:
+    - amplitude.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Amplitude (or run `hermes mcp login amplitude`). Approve access,
+  then restart the session so tools load.
+
+  EU-resident orgs: change mcp_servers.amplitude.url to
+  https://mcp.eu.amplitude.com/mcp in config.yaml.
diff --git a/optional-mcps/circleci/manifest.yaml b/optional-mcps/circleci/manifest.yaml
new file mode 100644
index 0000000000..5a8f7ba2fb
--- /dev/null
+++ b/optional-mcps/circleci/manifest.yaml
@@ -0,0 +1,32 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: circleci
+description: 'CircleCI: diagnose build failures, read logs, rerun workflows.'
+source: https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.circleci.com/v1/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - circleci
+  hosts:
+    - circleci.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  CircleCI (or run `hermes mcp login circleci`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/craft/manifest.yaml b/optional-mcps/craft/manifest.yaml
new file mode 100644
index 0000000000..6023fea005
--- /dev/null
+++ b/optional-mcps/craft/manifest.yaml
@@ -0,0 +1,32 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: craft
+description: 'Craft: structured docs, tasks, and personal knowledge base.'
+source: https://support.craft.do/hc/en-us/articles/29455875123101
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.craft.do/my/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - craft docs
+  hosts:
+    - craft.do
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Craft (or run `hermes mcp login craft`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/customer-io/manifest.yaml b/optional-mcps/customer-io/manifest.yaml
new file mode 100644
index 0000000000..333be8f3b3
--- /dev/null
+++ b/optional-mcps/customer-io/manifest.yaml
@@ -0,0 +1,35 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: customer-io
+description: 'Customer.io: segments, automations, sends, and CDP data.'
+source: https://docs.customer.io/ai/mcp/get-started/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.customer.io/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - customer.io
+  hosts:
+    - customer.io
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Customer.io (or run `hermes mcp login customer-io`). Approve access,
+  then restart the session so tools load.
+
+  EU-region workspaces: change mcp_servers.customer-io.url to
+  https://mcp-eu.customer.io/mcp in config.yaml.
diff --git a/optional-mcps/gamma/manifest.yaml b/optional-mcps/gamma/manifest.yaml
new file mode 100644
index 0000000000..23cf1820a4
--- /dev/null
+++ b/optional-mcps/gamma/manifest.yaml
@@ -0,0 +1,33 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: gamma
+description: 'Gamma: generate and edit AI presentations, docs, and sites.'
+source: https://developers.gamma.app/docs/gamma-mcp-server
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.gamma.app/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - gamma
+    - presentation
+  hosts:
+    - gamma.app
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Gamma (or run `hermes mcp login gamma`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/gitlab/manifest.yaml b/optional-mcps/gitlab/manifest.yaml
new file mode 100644
index 0000000000..2c52505018
--- /dev/null
+++ b/optional-mcps/gitlab/manifest.yaml
@@ -0,0 +1,36 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: gitlab
+description: 'GitLab: issues, merge requests, pipelines, and repo context.'
+source: https://docs.gitlab.com/user/model_context_protocol/mcp_server/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://gitlab.com/api/v4/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - gitlab
+    - merge request
+  hosts:
+    - gitlab.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  GitLab (or run `hermes mcp login gitlab`). Approve access,
+  then restart the session so tools load.
+
+  Covers gitlab.com. Self-managed GitLab (18.6+): point
+  mcp_servers.gitlab.url at https://<your-host>/api/v4/mcp.
diff --git a/optional-mcps/kiwi/manifest.yaml b/optional-mcps/kiwi/manifest.yaml
new file mode 100644
index 0000000000..b4d3a020e2
--- /dev/null
+++ b/optional-mcps/kiwi/manifest.yaml
@@ -0,0 +1,33 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: kiwi
+description: 'Kiwi.com flight search: itineraries with direct booking links.'
+source: https://www.kiwi.com/stories/kiwi-mcp-connector/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). No authentication required (verified live:
+# initialize succeeds anonymously).
+
+transport:
+  type: http
+  url: https://mcp.kiwi.com
+
+auth:
+  type: none
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - flight search
+    - kiwi.com
+  hosts:
+    - kiwi.com
+
+post_install: |
+  No account or credentials needed — tools are available as soon as the
+  session restarts.
+
+  Search only — booking and payment happen on kiwi.com via the returned
+  links, never in-conversation.
diff --git a/optional-mcps/klaviyo/manifest.yaml b/optional-mcps/klaviyo/manifest.yaml
new file mode 100644
index 0000000000..9bccffc31b
--- /dev/null
+++ b/optional-mcps/klaviyo/manifest.yaml
@@ -0,0 +1,36 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: klaviyo
+description: 'Klaviyo marketing: campaigns, flows, segments, and reporting.'
+source: https://developers.klaviyo.com/en/docs/klaviyo_mcp_server
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.klaviyo.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - klaviyo
+  hosts:
+    - klaviyo.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Klaviyo (or run `hermes mcp login klaviyo`). Approve access,
+  then restart the session so tools load.
+
+  Requires an Owner/Admin/Manager Klaviyo role. Large tool surface;
+  append ?core-tools-only=true to mcp_servers.klaviyo.url in config.yaml
+  for the trimmed ~40-tool core set.
diff --git a/optional-mcps/mixpanel/manifest.yaml b/optional-mcps/mixpanel/manifest.yaml
new file mode 100644
index 0000000000..6dbfa4bc0e
--- /dev/null
+++ b/optional-mcps/mixpanel/manifest.yaml
@@ -0,0 +1,32 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: mixpanel
+description: 'Mixpanel analytics: events, funnels, retention, dashboards.'
+source: https://docs.mixpanel.com/docs/mcp
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.mixpanel.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - mixpanel
+  hosts:
+    - mixpanel.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Mixpanel (or run `hermes mcp login mixpanel`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/motherduck/manifest.yaml b/optional-mcps/motherduck/manifest.yaml
new file mode 100644
index 0000000000..5baed20bdf
--- /dev/null
+++ b/optional-mcps/motherduck/manifest.yaml
@@ -0,0 +1,33 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: motherduck
+description: 'MotherDuck: query DuckDB cloud warehouses with SQL.'
+source: https://motherduck.com/docs/key-tasks/ai-and-motherduck/mcp-setup/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://api.motherduck.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - motherduck
+    - duckdb
+  hosts:
+    - motherduck.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  MotherDuck (or run `hermes mcp login motherduck`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/omnisend/manifest.yaml b/optional-mcps/omnisend/manifest.yaml
new file mode 100644
index 0000000000..62ce1f2164
--- /dev/null
+++ b/optional-mcps/omnisend/manifest.yaml
@@ -0,0 +1,32 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: omnisend
+description: 'Omnisend: ecommerce email/SMS campaigns, flows, and segments.'
+source: https://api-docs.omnisend.com/v2026-preview/reference/mcp-server-v2
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.omnisend.com/v2/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - omnisend
+  hosts:
+    - omnisend.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Omnisend (or run `hermes mcp login omnisend`). Approve access,
+  then restart the session so tools load.
diff --git a/optional-mcps/robinhood/manifest.yaml b/optional-mcps/robinhood/manifest.yaml
new file mode 100644
index 0000000000..1c67c1f479
--- /dev/null
+++ b/optional-mcps/robinhood/manifest.yaml
@@ -0,0 +1,37 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: robinhood
+description: 'Robinhood agentic trading: portfolio, balances, and orders.'
+source: https://robinhood.com/us/en/support/articles/agentic-trading-overview/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://agent.robinhood.com/mcp/trading
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - robinhood
+    - stock trade
+  hosts:
+    - robinhood.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Robinhood (or run `hermes mcp login robinhood`). Approve access,
+  then restart the session so tools load.
+
+  CAUTION: this server can place REAL trades (equities, options, crypto)
+  in a dedicated Robinhood agentic account. Hermes's normal tool-approval
+  flow applies, but review orders carefully before approving.
diff --git a/optional-mcps/strava/manifest.yaml b/optional-mcps/strava/manifest.yaml
new file mode 100644
index 0000000000..5831c309b0
--- /dev/null
+++ b/optional-mcps/strava/manifest.yaml
@@ -0,0 +1,36 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: strava
+description: 'Strava: activities, fitness trends, training load (read-only).'
+source: https://support.strava.com/en-us/articles/15401531-strava-mcp-connector
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://mcp.strava.com/mcp
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - strava
+    - running
+    - cycling
+  hosts:
+    - strava.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  Strava (or run `hermes mcp login strava`). Approve access,
+  then restart the session so tools load.
+
+  Requires a Strava subscription.
diff --git a/optional-mcps/trivago/manifest.yaml b/optional-mcps/trivago/manifest.yaml
new file mode 100644
index 0000000000..26dceda6f6
--- /dev/null
+++ b/optional-mcps/trivago/manifest.yaml
@@ -0,0 +1,33 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: trivago
+description: 'trivago hotel search: compare prices by city and dates.'
+source: https://mcp.trivago.com/mcp
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). No authentication required (verified live:
+# initialize succeeds anonymously).
+
+transport:
+  type: http
+  url: https://mcp.trivago.com/mcp
+
+auth:
+  type: none
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - hotel search
+    - trivago
+  hosts:
+    - trivago.com
+
+post_install: |
+  No account or credentials needed — tools are available as soon as the
+  session restarts.
+
+  Search only — booking happens on the linked booking sites, never
+  in-conversation.
diff --git a/optional-mcps/twilio-docs/manifest.yaml b/optional-mcps/twilio-docs/manifest.yaml
new file mode 100644
index 0000000000..648034d410
--- /dev/null
+++ b/optional-mcps/twilio-docs/manifest.yaml
@@ -0,0 +1,29 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: twilio-docs
+description: 'Twilio developer docs search (public beta, read-only).'
+source: https://www.twilio.com/docs/ai/mcp
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). No authentication required (verified live:
+# initialize succeeds anonymously).
+
+transport:
+  type: http
+  url: https://mcp.twilio.com/docs
+
+auth:
+  type: none
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - twilio docs
+  hosts:
+    - twilio.com
+
+post_install: |
+  No account or credentials needed — tools are available as soon as the
+  session restarts.
diff --git a/optional-mcps/wordpress-com/manifest.yaml b/optional-mcps/wordpress-com/manifest.yaml
new file mode 100644
index 0000000000..a2789503c7
--- /dev/null
+++ b/optional-mcps/wordpress-com/manifest.yaml
@@ -0,0 +1,32 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: wordpress-com
+description: 'WordPress.com: posts, pages, drafts, stats, and comments.'
+source: https://developer.wordpress.com/docs/mcp/
+
+# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
+# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
+# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
+# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
+# discovery, PKCE, token exchange, and refresh.
+
+transport:
+  type: http
+  url: https://public-api.wordpress.com/wpcom/v2/mcp/v1
+
+auth:
+  type: oauth
+
+# Composer-suggestion triggers (desktop brand pills).
+suggest:
+  keywords:
+    - wordpress
+  hosts:
+    - wordpress.com
+
+post_install: |
+  On first connection Hermes opens a browser to authorize with
+  WordPress.com (or run `hermes mcp login wordpress-com`). Approve access,
+  then restart the session so tools load.