88 lines
5.3 KiB
YAML
88 lines
5.3 KiB
YAML
# Hermes plugin-catalog entry for hermes-frihet v0.1.0.
|
|
#
|
|
# Catalog: NousResearch/hermes-agent/plugin-catalog/frihet.yaml
|
|
# Per the catalog rules (plugin-catalog/README.md):
|
|
# - The maintainer of the plugin repository (Frihet-io) is the only one
|
|
# authorised to submit the entry.
|
|
# - ``tier`` MUST be ``community`` — ``official`` in the catalog means
|
|
# "maintained by NousResearch". We describe ourselves as the "Official
|
|
# Hermes Agent integration for Frihet" in the description, not in the
|
|
# catalog's tier label.
|
|
# - The SHA must be a 40-character full commit hash of a tagged, audited
|
|
# commit of Frihet-io/hermes-frihet. Update via a new PR whenever we
|
|
# ship a meaningful change (rule 4 of the catalog admission policy).
|
|
name: frihet
|
|
repo: https://github.com/Frihet-io/hermes-frihet
|
|
# Pinned SHA — Frihet-io/hermes-frihet @ v0.1.0
|
|
# (fix(deps): declare PyYAML as runtime dep with <7 cap, merged via PR #1.)
|
|
#
|
|
# This SHA supersedes ``f331208`` (the older doctor that read the OAuth
|
|
# token cache), ``24a9612`` (first privacy fix), ``3c8325a`` (CI rename
|
|
# + first default_enabled), ``b9a8067`` (slash-command + redact
|
|
# per-line + first connector safety net), ``b77f5df4`` (canonical Frihet
|
|
# externalSideEffects drives classification), AND ``e805bf2`` (source
|
|
# head of the PyYAML branch before squash). It pins all of the above AND:
|
|
# * Hook dispatcher that passes the FULL tool name to the gate (no
|
|
# more silent bypass of the approval gate).
|
|
# * Doctor that derives auth evidence from ``ctx.call_mcp`` — the
|
|
# plugin never reads ~/.hermes/mcp-tokens.
|
|
# * Doctor that drops the list_invoices envelope from its output
|
|
# (no invoice/customer data leaks through /frihet doctor).
|
|
# * Setup that does NOT accept credentials as slash-command
|
|
# arguments (no transcript leak).
|
|
# * Slash-command rejection of unknown subcommands and unexpected
|
|
# positional arguments — neither branch echoes user input back.
|
|
# * redact() per-line masking: every Authorization: line is masked
|
|
# independently, including mislabelled secrets (token=, secret:,
|
|
# api_key:, password=).
|
|
# * tools.default_enabled reduced to 39 read-only operations —
|
|
# every create_* was removed because the canonical Frihet MCP
|
|
# contract declares them under externalSideEffects (webhooks or
|
|
# fiscal). Users opt in to mutating ops via 'hermes mcp configure
|
|
# frihet'.
|
|
# * Plugin classifier reads vendor/frihet-mcp-onboarding.json —
|
|
# a frozen copy of Frihet-io/frihet-mcp/docs/agent-onboarding.json
|
|
# — and treats the humanAuthority.externalSideEffects table as
|
|
# the source of truth. Local pattern lists stay as a fallback
|
|
# for tools the contract has not yet named.
|
|
# * CI renamed to manifest-validate (schema-only) plus a manual
|
|
# live-hermes-validate (workflow_dispatch) for maintainers.
|
|
# * Runtime PyYAML dependency declared in pyproject.toml at >=6.0,<7
|
|
# (catalog security recommendation). Closes the silent "unknown"
|
|
# report from `frihet.py` mcp_server_block_present() in clean venvs
|
|
# without PyYAML preinstalled (regression: 7 tests in tests/test_frihet.py).
|
|
# * New tests/test_pyyaml_dependency.py asserts that yaml is importable
|
|
# in the test environment, gating the runtime-dependency contract.
|
|
# * No code-path changes: frihet.py, hook dispatcher, doctor and
|
|
# /frihet slash command remain byte-identical to the b77f5df4 SHA;
|
|
# this bump only makes the existing tests pass on a clean venv.
|
|
|
|
#
|
|
# Tests: 87 pass + 3 pre-existing skips. hermes plugins validate
|
|
# --install-deps 15/15 with security scan "safe".
|
|
sha: 4f092d58398ab252ea1fa6b07bfefacec717abd9
|
|
description: "Official Hermes Agent integration for Frihet — discoverability, setup, diagnostics, and operating guidance for the Frihet MCP. Zero duplicated tools; the canonical 158-operation Frihet surface stays in @frihet/mcp-server and the remote endpoint https://mcp.frihet.io/mcp. Disclosure — /frihet setup and /frihet doctor send an unauthenticated MCP initialize to mcp.frihet.io (or FRIHET_MCP_URL); /frihet doctor also makes one read-only list_invoices call through Hermes's MCP client once you grant plugins.entries.frihet.mcp_allowlist; reads ~/.hermes/config.yaml only to check that an mcp_servers.frihet block exists; the pre_tool_call hook prompts before Frihet MCP calls it classifies as irreversible or unknown, but reads and draft-first creates pass without a prompt unless the server sets trust: untrusted."
|
|
maintainer: Frihet-io
|
|
tier: community
|
|
category: tools
|
|
docs_url: https://github.com/Frihet-io/hermes-frihet#readme
|
|
requires_hermes: ">=0.21.5"
|
|
version: "0.1.0"
|
|
# Capabilities mirror plugin.yaml exactly.
|
|
# Provides zero Python tools on purpose: the canonical Frihet surface
|
|
# (158 operations) lives in @frihet/mcp-server and is reached via the
|
|
# native Hermes MCP client. The plugin adds:
|
|
# - a skill (skills/frihet/SKILL.md) that encodes the operating contract
|
|
# - a pre_tool_call hook that escalates irreversible Frihet operations
|
|
# to the human approval gate
|
|
# - a /frihet slash command for setup/status/doctor
|
|
capabilities:
|
|
provides_tools: []
|
|
provides_hooks:
|
|
- pre_tool_call
|
|
provides_middleware: []
|
|
# No env vars required. Credentials (Bearer API key or OAuth 2.0+PKCE)
|
|
# live on the ``mcp_servers.frihet`` block in the user's config.yaml,
|
|
# not on the plugin itself.
|
|
requires_env: []
|