# NousResearch/hermes-agent · MCP tools and secrets scoping per profile

## Open now

- Nothing open on GitHub.

A bug and several fixes addressing MCP tool isolation, secret resolution, and connection scoping when switching or multiplexing profiles in the dashboard and desktop gateway. Work centers on ensuring each profile gets its own MCP connections and credentials rather than sharing or inheriting from a launch profile.

## TL;DR

- 9 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 5 merged PR(s), 3 PR(s) closed without merging.
- A fix was merged to main in PR #72219. Verify it addresses your case.
- **Recommended:** read PR #72219 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-108676`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.22`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #67605: \[Bug\]: Dashboard/desktop profile switch is partial — MCP tools never load and secrets/${VAR} resolve from the launch profile, not the selected one

## Prior & competing PRs

- **#72219: fix(tui-gateway): scope MCP discovery to the selected profile (Desktop/dashboard)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `hermes_cli/mcp_startup.py`, `tests/test_tui_gateway_server.py`, `tests/test_tui_gateway_ws.py`, `tui_gateway/entry.py`, `tui_gateway/server.py`, `tui_gateway/ws.py`
- **#72293: fix(tui-gateway): install the selected profile's secret scope (Desktop/dashboard)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `tests/test_tui_gateway_server.py`, `tui_gateway/compute_host.py`, `tui_gateway/server.py`
- **#108352: fix(gateway,mcp): multiplexed profiles get their own same-named MCP servers, and start/status/API_SERVER_KEY honour the live multiplexer (#106005, #91654, #100397; salvage #99594/#104534)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `gateway/config_env.py`, `gateway/status.py`, `hermes_cli/cron.py`, `hermes_cli/gateway.py`, `hermes_cli/gateway_multiplex_served.py`, `hermes_cli/status.py`, `hermes_cli/subcommands/gateway.py`, `hermes_cli/web_routers/ops.py`, `tests/gateway/test_multiplex_secondary_port_binding_env.py`, `tests/hermes_cli/test_gateway_multiplex_served_record.py`, `tests/test_toolsets.py`, `tests/tools/test_mcp_multiplex_connection_keys.py`, `tools/mcp_tool.py`, `tools/mcp_tool_discovery.py`, `tools/mcp_tool_handlers.py`, `tools/mcp_tool_health.py`, `tools/mcp_tool_lifecycle.py`, `tools/mcp_tool_loop.py`, `tools/mcp_tool_registration.py`, `tools/mcp_tool_scope.py` (+4 more)
- **#108676: fix(multiplex): serve every profile, scope sessions.* + proxy readers, dashboard -p child env**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `gateway/config.py`, `gateway/config_loader.py`, `gateway/platforms/api_server.py`, `gateway/platforms/webhook.py`, `gateway/run.py`, `hermes_cli/AGENTS.md`, `hermes_cli/config_defaults.py`, `hermes_cli/config_migrations.py`, `hermes_cli/gateway.py`, `hermes_cli/mcp_startup.py`, `hermes_cli/profiles.py`, `hermes_cli/web_server.py`, `hermes_cli/web_server_cron.py`, `hermes_cli/web_server_gateway.py`, `hermes_state.py`, `hermes_state_common.py`, `hermes_state_fts.py`, `hermes_state_search.py`, `tests/acp_adapter/test_acp_mcp_discovery.py`, `tests/cron/test_cron_multiplex_desktop_ticker_scope.py` (+27 more)
- **#111481: fix(mcp): dashboard-served profiles keep their own MCP connections and credentials (#111151)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `agent/secret_scope.py`, `tests/tools/test_mcp_multiplex_connection_keys.py`, `tools/mcp_tool.py`, `tools/registry.py`, `website/docs/user-guide/multi-profile-gateways.md`
- **#67623: fix(tui_gateway): scope secrets and MCP discovery to the active profile (#67605)**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `#72293`, `#72219`, `#72219`, `#67605`
- **#104534: fix(mcp): isolate MCP tools per profile under gateway multiplexing**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `edff87fa1e4`, `#108676`, `#90027`, `#108352`, `#67605`
- **#111354: fix(mcp): isolate dashboard-served profile connections without global multiplex flag**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `57c4e1d963`, `5117e3b3a0`, `57c4e1d963`, `#111481`, `#111151`

## Fix status

- Merged to main in PR #72219 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-09-15`.
- Subsystem: `dashboard`