{"repo":"NousResearch/hermes-agent","public_id":"67605","display_label":"MCP tools and secrets scoping per profile","summary":"A bug and several fixes addressing MCP tool isolation, secret resolution, and connection scoping when switching or multiplexing profiles in the dashboard and desktop gateway. Work centers on ensuring each profile gets its own MCP connections and credentials rather than sharing or inheriting from a launch profile.","subsystem":"dashboard","counts":{"members":9,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":5,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":72219},"resolution":{"state":"resolved","by":"pr-108676"},"freshness":{"state":"verified","last_verified_at":"2026-09-15T11:56:41+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.2222222222222222},"fix_edges":[{"issue_number":67605,"pr_number":72219,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":67605,"pr_number":72293,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":67605,"pr_number":108352,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":67605,"pr_number":108676,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":67605,"pr_number":111481,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":91654,"pr_number":108352,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":94590,"pr_number":108676,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":100397,"pr_number":108352,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":106005,"pr_number":108352,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":111151,"pr_number":111481,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":67605,"title":"[Bug]: Dashboard/desktop profile switch is partial — MCP tools never load and secrets/${VAR} resolve from the launch profile, not the selected one","url":null,"state":"closed"},{"kind":"pr","number":67623,"title":"fix(tui_gateway): scope secrets and MCP discovery to the active profile (#67605)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#72293","number":72293},{"kind":"pr","value":"#72219","number":72219},{"kind":"pr","value":"#72219","number":72219},{"kind":"pr","value":"#67605","number":67605}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":72219,"title":"fix(tui-gateway): scope MCP discovery to the selected profile (Desktop/dashboard)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/mcp_startup.py","tests/test_tui_gateway_server.py","tests/test_tui_gateway_ws.py","tui_gateway/entry.py","tui_gateway/server.py","tui_gateway/ws.py"]},{"kind":"pr","number":72293,"title":"fix(tui-gateway): install the selected profile's secret scope (Desktop/dashboard)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/test_tui_gateway_server.py","tui_gateway/compute_host.py","tui_gateway/server.py"]},{"kind":"pr","number":104534,"title":"fix(mcp): isolate MCP tools per profile under gateway multiplexing","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"edff87fa1e4","number":0},{"kind":"pr","value":"#108676","number":108676},{"kind":"pr","value":"#90027","number":90027},{"kind":"pr","value":"#108352","number":108352},{"kind":"pr","value":"#67605","number":67605}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":108352,"title":"fix(gateway,mcp): multiplexed profiles get their own same-named MCP servers, and start/status/API_SERVER_KEY honour the live multiplexer (#106005, #91654, #100397; salvage #99594/#104534)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["gateway/config_env.py","gateway/status.py","hermes_cli/cron.py","hermes_cli/gateway.py","hermes_cli/gateway_multiplex_served.py","hermes_cli/status.py","hermes_cli/subcommands/gateway.py","hermes_cli/web_routers/ops.py","tests/gateway/test_multiplex_secondary_port_binding_env.py","tests/hermes_cli/test_gateway_multiplex_served_record.py","tests/test_toolsets.py","tests/tools/test_mcp_multiplex_connection_keys.py","tools/mcp_tool.py","tools/mcp_tool_discovery.py","tools/mcp_tool_handlers.py","tools/mcp_tool_health.py","tools/mcp_tool_lifecycle.py","tools/mcp_tool_loop.py","tools/mcp_tool_registration.py","tools/mcp_tool_scope.py","tools/mcp_tool_server_run.py","tools/mcp_tool_transport.py","toolsets.py","website/docs/user-guide/multi-profile-gateways.md"]},{"kind":"pr","number":108676,"title":"fix(multiplex): serve every profile, scope sessions.* + proxy readers, dashboard -p child env","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["gateway/config.py","gateway/config_loader.py","gateway/platforms/api_server.py","gateway/platforms/webhook.py","gateway/run.py","hermes_cli/AGENTS.md","hermes_cli/config_defaults.py","hermes_cli/config_migrations.py","hermes_cli/gateway.py","hermes_cli/mcp_startup.py","hermes_cli/profiles.py","hermes_cli/web_server.py","hermes_cli/web_server_cron.py","hermes_cli/web_server_gateway.py","hermes_state.py","hermes_state_common.py","hermes_state_fts.py","hermes_state_search.py","tests/acp_adapter/test_acp_mcp_discovery.py","tests/cron/test_cron_multiplex_desktop_ticker_scope.py","tests/gateway/test_api_server_multiplex_secret_scope.py","tests/gateway/test_api_server_profile_prefix_misdelivery.py","tests/gateway/test_config.py","tests/gateway/test_handoff_watcher_multiprofile.py","tests/gateway/test_kanban_routed_transport.py","tests/gateway/test_multiplex_adapter_registry.py","tests/gateway/test_multiplex_api_server_routing.py","tests/gateway/test_multiplex_http_routing.py","tests/gateway/test_multiplex_lifecycle.py","tests/gateway/test_multiplex_mcp_discovery.py","tests/gateway/test_multiplex_phase0.py","tests/gateway/test_multiplex_residue_parity.py","tests/gateway/test_profile_resolution.py","tests/gateway/test_webhook_adapter.py","tests/hermes_cli/test_config.py","tests/hermes_cli/test_dashboard_admin_endpoints.py","tests/hermes_cli/test_desktop_cron_ticker_profiles.py","tests/hermes_cli/test_mcp_discovery_timing.py","tests/hermes_cli/test_mcp_startup.py","tests/hermes_cli/test_profiles.py","tests/hermes_cli/test_serve_mcp_discovery_after_bind.py","tests/test_tui_entry_mcp_owner.py","tests/test_tui_gateway_server.py","tests/tools/test_refresh_agent_mcp_tools.py","tests/tui_gateway/test_mcp_late_refresh_thread_owner.py","tui_gateway/entry.py","website/docs/user-guide/multi-profile-gateways.md"]},{"kind":"pr","number":111354,"title":"fix(mcp): isolate dashboard-served profile connections without global multiplex flag","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"57c4e1d963","number":0},{"kind":"commit","value":"5117e3b3a0","number":0},{"kind":"commit","value":"57c4e1d963","number":0},{"kind":"pr","value":"#111481","number":111481},{"kind":"pr","value":"#111151","number":111151}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":111481,"title":"fix(mcp): dashboard-served profiles keep their own MCP connections and credentials (#111151)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/secret_scope.py","tests/tools/test_mcp_multiplex_connection_keys.py","tools/mcp_tool.py","tools/registry.py","website/docs/user-guide/multi-profile-gateways.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}