Add hermes_mcp, the bridge between Hermes and the ROS graph

The MCP server is now a ROS node and the only way in or out, per the owner's
decision that ROS never leaves the robot. It serves MCP on the USB address only
with a bearer token, keeps the stable tool name look() (which waits for the next
camera frame, so it is never stale, and passes the camera's JPEG through), and
registers turn_head/head_position only when a head is fitted, which today it is
not. While an authenticated client is connected it republishes the agent
heartbeat on /hermes/state, so the face wakes on connect and sleeps about 40 s
after the client leaves; look() also makes the face squint.

The token is generated on the Pi into /etc/robot-mcp.env (root:hermes, 640) and
never printed. Verified end to end from talos with a real MCP client over the USB
link: tools listed, a 157 KB JPEG back in 0.08 s, a wrong token refused, the Wi-Fi
path dropped by the firewall. Host config snippets now point at 10.55.0.2.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
This commit is contained in:
2026-10-05 00:20:58 -07:00
co-authored by Claude Sonnet 5.5
parent d8db0a48f5
commit 167f53ceeb
17 changed files with 462 additions and 24 deletions
+7 -3
View File
@@ -1,10 +1,14 @@
# Merge these into ~/.hermes/config.yaml on Omarchy.
# Put the token from the Pi's install.sh output in ~/.hermes/.env as:
# ROBOT_MCP_TOKEN=<64 hex characters>
# The robot is at 10.55.0.2 on the USB link (the host is 10.55.0.1; see host/omarchy/robot-usb-link.sh).
# Put the token in ~/.hermes/.env as: ROBOT_MCP_TOKEN=<64 hex characters>
# It lives only on the Pi, in /etc/robot-mcp.env (read it with: ssh hermes@10.55.0.2 sudo cat /etc/robot-mcp.env).
# The robot's firewall accepts this port only over the USB link, from 10.55.0.1.
# While Hermes holds a connection the robot's face is awake; when it stops, the face falls asleep after
# about 40 seconds. A robot with no head fitted offers only look(); turn_head appears when servos do.
mcp_servers:
robot:
url: "http://ROBOT_IP:8765/mcp"
url: "http://10.55.0.2:8765/mcp"
headers:
Authorization: "Bearer ${ROBOT_MCP_TOKEN}"
connect_timeout: 15