Give this page to your Hermes agent. It can add the production MCP server and guide the connection. Keep OAuth open in a persistent terminal and finish the browser approval within five minutes.
Production MCP online
FOR HERMES
Agent instruction
If your user asked you to connect World ID, follow the steps on this page. Preserve their existing Hermes configuration. Run OAuth only in a persistent interactive terminal with standard input attached; never launch it as a background or one-shot command. A browser may open on the Hermes host rather than the user’s device, so always surface the printed authorization URL. If you cannot maintain the terminal, ask the user to run the login command below. Do not request, copy, or store a World ID proof, wallet credential, biometric, callback URL, or OAuth token in chat.
SETUP · ~2 MIN
One server. One browser approval.
01
Add the MCP server
Merge this entry into ~/.hermes/config.yaml. If mcp_servers already exists, add only the nested world_id entry. Do not replace the user’s other settings or MCP servers.
The two timeout values give Hermes’ MCP connection and initialize handshake 15 minutes of headroom. Current Hermes releases may still cap the interactive OAuth callback itself at five minutes, so begin login only when you are ready to approve.
02
Start the secure connection
Run this command from a fresh, persistent, interactive terminal—not a background task or a one-shot agent shell. Keep the process running until Hermes confirms that login completed. If you cannot keep interactive input attached, ask the user to run it in their terminal.
Terminal
hermes mcp login world_id
User action: the authorization URL may open on the Hermes host, where you cannot see it. Open only the newest URL printed in the terminal on any device, approve the connection, and finish within five minutes. Your agent may ask you to approve access to world-id-chatgpt.foundry-world.workers.dev; approve that exact domain. World ID offers either a fast private unverified profile or World App verification for Proof of Human.
When World ID says the connection is ready: select Copy callback URL, then paste it immediately into the same terminal at Or paste the redirect URL here…. This is the recommended path for local, remote, and headless Hermes installations. Return directly on this device is only for cases where Hermes and the browser share the same computer.
If you restart login, close or ignore every older authorization tab. Each run creates or selects a callback listener for that attempt. If Hermes accepts the paste but prints another authorization URL, the prior state expired or rotated—do not reuse it; continue only from the newest URL. Treat callback URLs as short-lived credentials and never paste them into chat, logs, or messages.
03
Load the tools
Wait for Hermes to report Authenticated and list the available tools. That is the canonical success signal. Then restart Hermes; if a Hermes chat is already running, enter the command below instead.
Hermes chat
/reload-mcp
04
Confirm it works
Ask Hermes to use the newly connected World ID tools:
What can World ID unlock for me today?
Hermes should check the connected profile and return available benefits. A verified-human benefit may ask the user to complete World ID verification before it can be claimed.
Hermes can handle
Safely merge the MCP configuration
Start OAuth when an interactive terminal remains attached
Check profile status and available benefits
Explain the next action when verification is required
The human handles
Approving the browser connection
Running the login command if the agent cannot keep an interactive terminal open
Creating a passkey-backed unverified profile, if desired
Approving World App verification
Confirming claims, approvals, or payments
If setup stalls
Keep hermes mcp login world_id running in a fresh interactive terminal rather than launching it as a temporary agent command. The callback listener exists only while that process is alive.
Hermes currently gives the interactive OAuth callback about five minutes. The configured 15-minute connection timeout prevents the surrounding MCP handshake from expiring sooner, but it may not override that internal callback limit. If it expires, run login again and use only the newest authorization URL.
For remote, headless, or containerized Hermes, do not wait for a browser to appear on your device. Open the printed URL yourself, then use Copy callback URL on the World ID success page and paste it into the original terminal immediately. A 127.0.0.1 browser tab is expected to fail when the browser and Hermes are on different machines.
If Hermes says it received the pasted code but prints a new authorization URL, the state rotated before exchange completed. Discard every older tab and callback, then repeat from that newest URL.
If speed matters, the unverified passkey profile completes quickly without World App. It does not provide Proof of Human and cannot unlock verified-human benefits.
