CLAIM 6 / Hermes Agent
MCP as a core feature — OAuth 2.1 PKCE, OSV malware scanning, dynamic discovery, SSE transport
partial
Observed
Largely verified in code: SSE transport confirmed, OSV scanning confirmed as a runtime check before spawning servers (depth-verified 2026-06-08). But SSE *discovery* is not supported (#17244), and MCP startup could hang up to 120s on a synchronous `urllib` call on the event loop thread (#29184).
- UPDATE 2026-06-28: the 120s MCP startup hang (#29184) closed via PR #52147.
- UPDATE 2026-07-09(v0.18.2): #17244 re-confirmed OPEN — SSE discovery gap still partializes the "MCP as core feature" claim.
- UPDATE 2026-07-17(v0.18.2, tag v2026.7.7.2): #17244 CLOSED 2026-07-12 by hermes-sweeper (not_planned/implemented_on_main), citing SSE transport support (commit 12289c263, confirmed via `gh api` merged in v2026.5.7 — well before v0.18.2, cleanly in the release). A community commenter confirms the workaround: explicitly setting `transport: sse` under `mcp_servers.<name>` makes SSE servers work. This resolves SSE *transport* but not automatic *discovery* — the operator still has to declare the transport manually rather than the client auto-detecting it. The "dynamic discovery" component of the marketed claim remains unaddressed. Status remains partial.