Hermes agent fails validation of iss parameter issued by the remote mcp
- Dominant language
- TypeScript
- Stars
- 833
- Forks
- 116
- Avg merge
- 7h 19m
- Merged PRs (30d)
- 3
Description
### MCP Client
Other (please specify below)
### MCP Client Version
Hermes
### Authentication Type
OAuth
### OAuth Scopes (if applicable)
_No response_
### MCP Server Configuration
```json
`/opt/data/config.yaml`
mcp_servers:
cloudflare:
url: https://mcp.cloudflare.com/mcp?codemode=false
auth: oauth
enabled: true
tools:
exclude:
- docs
- '*_radar_*'
- '*_accounts_magic_*'
- '*_accounts_mnm_*'
- '*_accounts_cni_*'
- '*_accounts_teamnet_*'
- '*_accounts_cloudforceone_*'
- '*_accounts_dlp_*'
- '*_accounts_devices*'
- '*_accounts_dex_*'
- '*_accounts_datasecurity_*'
- '*_accounts_emailsecurity_*'
- '*_accounts_scim_*'
- '*_accounts_gateway*'
- '*_accounts_zerotrust_*'
- '*_accounts_one_*'
- '*_accounts_brandprotection_*'
- '*_accounts_intel_*'
- '*_accounts_urlscanner_*'
- '*_accounts_vuln_scanner_*'
- '*_zones_securitycenter_*'
- '*_accounts_securitycenter_*'
- '*_zones_api_gateway_*'
- '*_zones_schema_validation*'
- '*_zones_token_validation*'
- '*_zones_waiting_rooms*'
- '*_accounts_addressing_*'
- '*_accounts_shares*'
- '*_accounts_slurper_*'
- '*_zones_web3_*'
- '*_accounts_flagship_*'
- '*_zones_secondary_dns_*'
- '*_accounts_secondary_dns_*'
- '*_user_load_balancers*'
```
### Failing Endpoint / Tool
_No response_
### Bug Description
Setting up a new hermes agent and using the built in connector to authenticate the MCP via OAuth.
Hit the same issue as described here: https://github.com/NousResearch/hermes-agent/issues/99984 - specifically bug 1 with the iss parameter validation.
Thought best to raise here for visibility as well
### Steps to Reproduce
1. Setup new hermes agent
2. Use built in connector to auth to cloudflare mcp
3. Witness the iss parameter validation error appearing in the hermes UI
### Expected Behavior
OAuth flow to work as normal
### Actual Behavior
Hermes rejects due to missing iss parameter
### Relevant Logs / Error Output
```shell
```
### Additional Context
_No response_
Contributor guide
Research direction
Start by reviewing the MCP OAuth authentication flow and the linked Hermes issue about iss parameter validation. Reproduce the Cloudflare MCP OAuth connection with Hermes and determine whether the server response or Hermes validation is responsible; done means the OAuth flow completes without the missing iss error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100