@clawpump/claw-agent 0.1.15 → 0.1.17

package/agent/apps/desktop/package.json

@@ -2,7 +2,7 @@
   "name": "hermes",
   "productName": "Claw Agent",
   "private": true,
-  "version": "0.15.5",
+  "version": "0.15.8",
   "description": "Claw Agent by ClawPump — native desktop app for Solana agents, built on Hermes Agent by Nous Research.",
   "author": "ClawPump (built on Hermes by Nous Research)",
   "type": "module",

package/agent/apps/desktop/src/app/chat/sidebar/index.tsx

@@ -95,7 +95,7 @@ import {
   sessionPinId
 } from '@/store/session'
 
-import { type AppView, ARTIFACTS_ROUTE, MESSAGING_ROUTE, SKILLS_ROUTE, WALLET_ROUTE, X402_ROUTE } from '../../routes'
+import { type AppView, ARTIFACTS_ROUTE, MCP_ROUTE, MESSAGING_ROUTE, SKILLS_ROUTE, WALLET_ROUTE, X402_ROUTE } from '../../routes'
 import { SidebarPanelLabel } from '../../shell/sidebar-label'
 import type { SidebarNavItem } from '../../types'
 
@@ -133,7 +133,8 @@ const SIDEBAR_NAV: SidebarNavItem[] = [
   { id: 'messaging', label: '', icon: props => <Codicon name="comment" {...props} />, route: MESSAGING_ROUTE },
   { id: 'artifacts', label: '', icon: props => <Codicon name="files" {...props} />, route: ARTIFACTS_ROUTE },
   { id: 'wallet', label: 'Wallet', icon: props => <Codicon name="credit-card" {...props} />, route: WALLET_ROUTE },
-  { id: 'x402', label: 'x402', icon: props => <Codicon name="zap" {...props} />, route: X402_ROUTE }
+  { id: 'x402', label: 'x402', icon: props => <Codicon name="zap" {...props} />, route: X402_ROUTE },
+  { id: 'mcp', label: 'MCP', icon: props => <Codicon name="plug" {...props} />, route: MCP_ROUTE }
 ]
 
 const WORKSPACE_PAGE = 5

package/agent/apps/desktop/src/app/desktop-controller.tsx

@@ -139,6 +139,7 @@ const SettingsView = lazy(async () => ({ default: (await import('./settings')).S
 const SkillsView = lazy(async () => ({ default: (await import('./skills')).SkillsView }))
 const WalletView = lazy(async () => ({ default: (await import('./wallet')).WalletView }))
 const X402View = lazy(async () => ({ default: (await import('./x402')).X402View }))
+const McpView = lazy(async () => ({ default: (await import('./mcp')).McpView }))
 
 // Latest cron-job sessions surfaced in the collapsed "Cron jobs" section. The
 // Cron sessions are written by a background scheduler tick (the desktop
@@ -1203,6 +1204,14 @@ export function DesktopController() {
             }
             path="x402"
           />
+          <Route
+            element={
+              <Suspense fallback={null}>
+                <McpView setStatusbarItemGroup={setStatusbarItemGroup} />
+              </Suspense>
+            }
+            path="mcp"
+          />
           <Route element={null} path="cron" />
           <Route element={null} path="profiles" />
           <Route element={null} path="settings" />

package/agent/apps/desktop/src/app/mcp/index.test.tsx

@@ -0,0 +1,111 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const getMcpServers = vi.hoisted(() => vi.fn())
+
+vi.mock('@/hermes', () => ({
+  getMcpServers
+}))
+
+async function renderMcpView() {
+  const { McpView } = await import('./index')
+
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } }
+  })
+
+  return render(
+    <QueryClientProvider client={client}>
+      <McpView />
+    </QueryClientProvider>
+  )
+}
+
+afterEach(() => {
+  cleanup()
+  vi.clearAllMocks()
+})
+
+describe('McpView', () => {
+  it('shows a ClawPump API-key connection action for stdio installs that are not authenticated', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: null,
+          command: 'npx',
+          enabled: true,
+          name: 'clawpump-stdio',
+          transport: 'stdio'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('ClawPump MCP')).toBeTruthy()
+    expect(screen.getByText('Not connected')).toBeTruthy()
+    expect(screen.getByRole('button', { name: /connect with api key/i })).toBeTruthy()
+    expect(screen.getByText('claw clawpump setup')).toBeTruthy()
+  })
+
+  it('does not show a connect action when ClawPump credentials are present', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: true,
+          command: 'npx',
+          enabled: true,
+          name: 'clawpump-stdio',
+          transport: 'stdio'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('Connected')).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /connect with api key/i })).toBeNull()
+    expect(screen.queryByRole('button', { name: /connect at the gateway/i })).toBeNull()
+  })
+
+  it('recognizes custom clawpump-prefixed server names as the ClawPump MCP', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: false,
+          enabled: true,
+          name: 'clawpump-agents-local',
+          transport: 'http',
+          url: 'https://agents.clawpump.tech/mcp'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('ClawPump MCP')).toBeTruthy()
+    expect(screen.getByText('clawpump-agents-local')).toBeTruthy()
+    expect(screen.queryByText('Other servers')).toBeNull()
+  })
+
+  it('shows disabled ClawPump servers as disabled without auth actions', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: true,
+          command: 'npx',
+          enabled: false,
+          name: 'clawpump-stdio',
+          transport: 'stdio'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('Disabled')).toBeTruthy()
+    expect(screen.getByText(/installed but disabled/i)).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /connect/i })).toBeNull()
+  })
+})

package/agent/apps/desktop/src/app/mcp/index.tsx

@@ -0,0 +1,134 @@
+import { useQuery } from '@tanstack/react-query'
+
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { getMcpServers, type McpServer } from '@/hermes'
+import { Check, ExternalLink, Loader2, Zap } from '@/lib/icons'
+
+import type { SetStatusbarItemGroup } from '../shell/statusbar-controls'
+
+// Where an unauthenticated user goes to connect the ClawPump MCP — the gateway
+// (browser login / cpk_* key). Shown prominently when not connected.
+const CLAWPUMP_GATEWAY_URL = 'https://agents.clawpump.tech/dashboard/api'
+const isClawpump = (s: McpServer) => s.name.startsWith('clawpump')
+
+interface McpViewProps extends React.ComponentProps<'section'> {
+  setStatusbarItemGroup?: SetStatusbarItemGroup
+}
+
+export function McpView({ setStatusbarItemGroup: _setStatusbarItemGroup, ...props }: McpViewProps) {
+  const query = useQuery({ queryKey: ['mcp-servers'], queryFn: getMcpServers, staleTime: 15_000 })
+  const servers = query.data?.servers ?? []
+  const clawpump = servers.find(isClawpump)
+  const others = servers.filter(s => !isClawpump(s))
+
+  // authenticated === true means the backend found the same OAuth/API-key
+  // credentials the chat runtime uses. Enabled-but-not-connected states need
+  // an action surface; otherwise stdio/API-key installs showed "Not connected"
+  // with no way to fix or refresh credentials.
+  const clawpumpConnected = Boolean(clawpump?.enabled && clawpump.authenticated === true)
+  const clawpumpDisabled = clawpump != null && !clawpump.enabled
+  const clawpumpNeedsConnection = clawpump != null && clawpump.enabled && !clawpumpConnected
+  const clawpumpUsesStdio = clawpump?.transport === 'stdio' || Boolean(clawpump?.command)
+  const clawpumpConnectCommand = clawpumpUsesStdio ? 'claw clawpump setup' : 'claw clawpump login'
+  const clawpumpConnectLabel = clawpumpUsesStdio ? 'Connect with API key' : 'Connect at the gateway'
+
+  const clawpumpConnectionHelp = clawpumpUsesStdio
+    ? 'Add or refresh your ClawPump cpk_* API key, then restart the session so the MCP tools come online.'
+    : 'Sign in at the ClawPump gateway to connect — then your 133 ClawPump tools come online in chat and across the app.'
+
+  const openGateway = () => void window.hermesDesktop?.openExternal?.(CLAWPUMP_GATEWAY_URL)
+
+  return (
+    <section {...props} className="flex h-full min-h-0 flex-col">
+      <div className="min-h-0 flex-1 overflow-y-auto">
+        <div className="mx-auto max-w-3xl space-y-4 px-5 py-4">
+          <header className="flex items-center gap-2">
+            <Zap className="size-5 text-primary" />
+            <h1 className="text-lg font-semibold">MCP Servers</h1>
+          </header>
+          <p className="text-sm text-muted-foreground">
+            Model Context Protocol servers wired into your agent. The ClawPump MCP brings 133 tools —
+            wallet, trading, marketplace, perps, token launch.
+          </p>
+
+          {query.isPending && (
+            <div className="flex items-center gap-2 text-sm text-muted-foreground">
+              <Loader2 className="size-4 animate-spin" /> Loading…
+            </div>
+          )}
+
+          {clawpump && (
+            <div className="rounded-lg border p-4">
+              <div className="flex items-center justify-between gap-2">
+                <div className="flex items-center gap-2">
+                  <span className="font-medium">ClawPump MCP</span>
+                  <span className="text-xs text-muted-foreground">{clawpump.name}</span>
+                </div>
+                {clawpumpConnected ? (
+                  <Badge className="gap-1">
+                    <Check className="size-3" /> Connected
+                  </Badge>
+                ) : (
+                  <Badge variant="outline">{clawpump.enabled ? 'Not connected' : 'Disabled'}</Badge>
+                )}
+              </div>
+              {clawpumpDisabled && (
+                <p className="mt-3 text-sm text-muted-foreground">
+                  ClawPump MCP is installed but disabled. Re-enable it in MCP settings, then restart
+                  the session so the tools come online.
+                </p>
+              )}
+              {clawpumpNeedsConnection && (
+                <div className="mt-3 space-y-2">
+                  <p className="text-sm text-muted-foreground">{clawpumpConnectionHelp}</p>
+                  <div className="flex flex-wrap items-center gap-2">
+                    <Button onClick={openGateway} size="sm">
+                      <ExternalLink className="size-4" /> {clawpumpConnectLabel}
+                    </Button>
+                    <code className="rounded bg-muted px-2 py-1 text-xs">{clawpumpConnectCommand}</code>
+                  </div>
+                  <p className="break-all text-xs text-muted-foreground">{CLAWPUMP_GATEWAY_URL}</p>
+                </div>
+              )}
+            </div>
+          )}
+
+          {!query.isPending && !clawpump && (
+            <div className="space-y-2 rounded-lg border p-4">
+              <p className="text-sm text-muted-foreground">
+                The ClawPump MCP isn&apos;t installed yet. Connect it at the gateway to unlock the 133
+                tools.
+              </p>
+              <div className="flex flex-wrap items-center gap-2">
+                <Button onClick={openGateway} size="sm">
+                  <ExternalLink className="size-4" /> Open the ClawPump gateway
+                </Button>
+                <code className="rounded bg-muted px-2 py-1 text-xs">claw clawpump setup</code>
+              </div>
+              <p className="break-all text-xs text-muted-foreground">{CLAWPUMP_GATEWAY_URL}</p>
+            </div>
+          )}
+
+          {others.length > 0 && (
+            <div className="space-y-2">
+              <h2 className="text-sm font-medium text-muted-foreground">Other servers</h2>
+              {others.map(s => (
+                <div
+                  className="flex items-center justify-between rounded-md border px-3 py-2"
+                  key={s.name}
+                >
+                  <div className="flex items-center gap-2">
+                    <span className="text-sm font-medium">{s.name}</span>
+                    <span className="text-xs text-muted-foreground">{s.transport}</span>
+                  </div>
+                  {s.enabled ? <Badge>Enabled</Badge> : <Badge variant="outline">Disabled</Badge>}
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+      </div>
+    </section>
+  )
+}

package/agent/apps/desktop/src/app/routes.ts

@@ -10,6 +10,7 @@ export const PROFILES_ROUTE = '/profiles'
 export const AGENTS_ROUTE = '/agents'
 export const WALLET_ROUTE = '/wallet'
 export const X402_ROUTE = '/x402'
+export const MCP_ROUTE = '/mcp'
 
 export type AppView =
   | 'agents'
@@ -17,6 +18,7 @@ export type AppView =
   | 'chat'
   | 'command-center'
   | 'cron'
+  | 'mcp'
   | 'messaging'
   | 'profiles'
   | 'settings'
@@ -29,6 +31,7 @@ export type AppRouteId =
   | 'artifacts'
   | 'command-center'
   | 'cron'
+  | 'mcp'
   | 'messaging'
   | 'new'
   | 'profiles'
@@ -54,7 +57,8 @@ export const APP_ROUTES = [
   { id: 'profiles', path: PROFILES_ROUTE, view: 'profiles' },
   { id: 'agents', path: AGENTS_ROUTE, view: 'agents' },
   { id: 'wallet', path: WALLET_ROUTE, view: 'wallet' },
-  { id: 'x402', path: X402_ROUTE, view: 'x402' }
+  { id: 'x402', path: X402_ROUTE, view: 'x402' },
+  { id: 'mcp', path: MCP_ROUTE, view: 'mcp' }
 ] as const satisfies readonly AppRoute[]
 
 const APP_VIEW_BY_PATH = new Map<string, AppView>(APP_ROUTES.map(route => [route.path, route.view]))

package/agent/apps/desktop/src/app/types.ts

@@ -125,6 +125,7 @@ export type CommandDispatchResponse =
 export type SidebarNavId =
   | 'artifacts'
   | 'command-center'
+  | 'mcp'
   | 'messaging'
   | 'new-session'
   | 'settings'

package/agent/apps/desktop/src/hermes.ts

@@ -771,6 +771,26 @@ export function getPodStatus(): Promise<{ connected: boolean; balance_usdc?: num
   })
 }
 
+export interface McpServer {
+  name: string
+  transport: string
+  url?: string | null
+  command?: string | null
+  auth?: string | null
+  enabled: boolean
+  /** true/false when backend can check credentials; null when not applicable/unknown. */
+  authenticated?: boolean | null
+  tools?: string[] | null
+}
+
+/** Configured MCP servers + their connection state (for the sidebar MCP page). */
+export function getMcpServers(): Promise<{ servers: McpServer[] }> {
+  return window.hermesDesktop.api<{ servers: McpServer[] }>({
+    ...profileScoped(),
+    path: '/api/mcp/servers'
+  })
+}
+
 /** ClawPump agent wallets (id + name + USDC balance) for the Pod funding picker. */
 export function getPodWallets(): Promise<{ ok: boolean; wallets: PodWallet[]; error?: string }> {
   return window.hermesDesktop.api<{ ok: boolean; wallets: PodWallet[]; error?: string }>({

package/agent/hermes_cli/distribution.py

@@ -488,7 +488,15 @@ def _clawpump_mcp_config():
         from hermes_cli.mcp_config import _get_mcp_servers, _resolve_mcp_server_config
 
         servers = _get_mcp_servers()
-        name = next((n for n in ("clawpump", "clawpump-stdio") if n in servers), None)
+        # Match the dashboard's _clawpump_mcp(): known names first, then any
+        # clawpump* entry (e.g. clawpump-agents), so every ClawPump MCP variant
+        # the agent can load is also resolvable here.
+        name = next(
+            (n for n in ("clawpump", "clawpump-stdio", "clawpump-agents") if n in servers),
+            None,
+        )
+        if not name:
+            name = next((n for n in servers if n.startswith("clawpump")), None)
         if not name:
             return (None, None)
         return (name, _resolve_mcp_server_config(servers[name]))

package/agent/hermes_cli/mcp_catalog.py

@@ -36,6 +36,7 @@ from hermes_constants import get_hermes_home, get_optional_mcps_dir
 from hermes_cli.colors import Colors, color
 from hermes_cli.config import (
     load_config,
+    read_raw_config,
     save_config,
     get_env_value,
     save_env_value,
@@ -458,7 +459,10 @@ def _prompt_env_vars(specs: List[EnvVarSpec]) -> Dict[str, str]:
 
 
 def _build_server_config(
-    entry: CatalogEntry, install_dir: Optional[Path]
+    entry: CatalogEntry,
+    install_dir: Optional[Path],
+    *,
+    env_names: Optional[List[str]] = None,
 ) -> dict:
     """Translate a manifest into the ``mcp_servers.<name>`` block format used
     by hermes_cli/mcp_config.py."""
@@ -468,6 +472,8 @@ def _build_server_config(
         cfg["command"] = _expand_install_dir(t.command or "", install_dir)
         if t.args:
             cfg["args"] = [_expand_install_dir(a, install_dir) for a in t.args]
+        if env_names:
+            cfg["env"] = {name: f"${{{name}}}" for name in env_names}
     elif t.type == "http":
         cfg["url"] = t.url
         if entry.auth.type == "oauth":
@@ -519,7 +525,9 @@ def _probe_tools(name: str) -> Optional[List[tuple]]:
 
 def _write_tools_include(name: str, include: Optional[List[str]]) -> None:
     """Persist or clear ``mcp_servers.<name>.tools.include``."""
-    cfg = load_config()
+    # Use the raw YAML here. load_config() expands ${ENV} placeholders, and
+    # saving that expanded object would persist API keys into config.yaml.
+    cfg = read_raw_config()
     servers = cfg.setdefault("mcp_servers", {})
     server_entry = servers.get(name) or {}
     if include is None:
@@ -696,10 +704,11 @@ def install_entry(entry: CatalogEntry, *, enable: bool = True) -> None:
         install_dir = _do_git_install(entry)
 
     # Auth
+    auth_env: Dict[str, str] = {}
     if entry.auth.type == "api_key":
         print()
         print(color("  Configure credentials:", Colors.CYAN))
-        _prompt_env_vars(entry.auth.env)
+        auth_env = _prompt_env_vars(entry.auth.env)
     elif entry.auth.type == "oauth":
         if entry.auth.provider:
             # Case 2: provider-mediated (Google, GitHub, etc.). We rely on
@@ -727,7 +736,11 @@ def install_entry(entry: CatalogEntry, *, enable: bool = True) -> None:
 
     # Build and write the mcp_servers entry (without tools filter yet;
     # _apply_tool_selection() finalizes it below).
-    server_cfg = _build_server_config(entry, install_dir)
+    server_cfg = _build_server_config(
+        entry,
+        install_dir,
+        env_names=list(auth_env) if auth_env else None,
+    )
     server_cfg["enabled"] = enable
 
     from hermes_cli.mcp_config import _save_mcp_server

package/agent/hermes_cli/web_server.py

@@ -7983,6 +7983,61 @@ def _redact_mcp_env(env: Dict[str, Any]) -> Dict[str, str]:
     return out
 
 
+_CLAWPUMP_MCP_NAMES = {"clawpump", "clawpump-stdio", "clawpump-agents"}
+
+
+def _is_clawpump_mcp(name: str) -> bool:
+    return name in _CLAWPUMP_MCP_NAMES or name.startswith("clawpump")
+
+
+def _usable_mcp_secret_value(value: Any) -> bool:
+    text = str(value or "").strip()
+    return bool(text and "${" not in text)
+
+
+def _clawpump_api_key_present(cfg: Optional[Dict[str, Any]] = None) -> bool:
+    if cfg:
+        try:
+            from hermes_cli.mcp_config import _resolve_mcp_server_config
+
+            resolved = _resolve_mcp_server_config(cfg)
+        except Exception:
+            resolved = cfg
+        env = resolved.get("env") if isinstance(resolved, dict) else {}
+        if isinstance(env, dict) and _usable_mcp_secret_value(env.get("CLAWPUMP_API_KEY")):
+            return True
+
+    try:
+        from hermes_cli.config import get_env_value
+
+        return _usable_mcp_secret_value(get_env_value("CLAWPUMP_API_KEY"))
+    except Exception:
+        return False
+
+
+def _mcp_server_authenticated(name: str, cfg: Dict[str, Any]) -> Optional[bool]:
+    """True/False if this server's auth state can be determined.
+
+    Lets the GUI render a real "Connected" vs "Connect" state for the ClawPump
+    MCP instead of guessing. OAuth tokens and profile .env values are shared
+    with the chat agent, so the sidebar reflects the same session chat uses.
+    """
+    # ClawPump's stdio/API-key transport is fully usable when the cpk_* key is
+    # present. Returning None made the desktop show "Not connected" even while
+    # wallet routes were succeeding through the same MCP server.
+    if _is_clawpump_mcp(name) and cfg.get("command") and not cfg.get("url"):
+        return _clawpump_api_key_present(cfg)
+
+    is_oauth = cfg.get("auth") == "oauth" or (cfg.get("url") and not cfg.get("command"))
+    if not is_oauth:
+        return None
+    try:
+        from hermes_cli.mcp_config import _oauth_tokens_present
+        return bool(_oauth_tokens_present(name))
+    except Exception:
+        return None
+
+
 def _mcp_server_summary(name: str, cfg: Dict[str, Any]) -> Dict[str, Any]:
     transport = "http" if cfg.get("url") else ("stdio" if cfg.get("command") else "unknown")
     return {
@@ -7994,6 +8049,7 @@ def _mcp_server_summary(name: str, cfg: Dict[str, Any]) -> Dict[str, Any]:
         "env": _redact_mcp_env(cfg.get("env") or {}),
         "auth": cfg.get("auth"),
         "enabled": cfg.get("enabled", True) is not False,
+        "authenticated": _mcp_server_authenticated(name, cfg),
         # Tool selection: list of enabled tool names, or None = all.
         "tools": cfg.get("tools"),
     }
@@ -8005,11 +8061,10 @@ async def list_mcp_servers(profile: Optional[str] = None):
 
     with _profile_scope(profile):
         servers = _get_mcp_servers()
-    return {
-        "servers": [
+        summaries = [
             _mcp_server_summary(name, cfg) for name, cfg in sorted(servers.items())
         ]
-    }
+    return {"servers": summaries}
 
 
 @app.post("/api/mcp/servers")
@@ -12048,11 +12103,25 @@ async def set_dashboard_theme(body: ThemeSetBody):
 # in the vetted catalog (the font's webfont URL is injected as a <link>,
 # so we never accept an arbitrary user-supplied id/URL here).
 def _clawpump_mcp():
-    """Return (server_name, config) for the configured ClawPump MCP, else (None, None)."""
+    """Return (server_name, config) for the configured ClawPump MCP, else (None, None).
+
+    The chat agent loads EVERY configured MCP server, so the ClawPump tools work
+    in chat under whatever entry name the user installed — ``clawpump`` (remote
+    OAuth), ``clawpump-stdio``, or ``clawpump-agents`` (``npx @clawpump/agents``).
+    The dashboard must recognise the SAME entry, otherwise chat works while every
+    sidebar MCP page (wallet / x402 / pod / mail) reports "not configured". Try
+    the known names in preference order, then fall back to any ``clawpump*``
+    server so a future/renamed entry still resolves.
+    """
     from hermes_cli.mcp_config import _get_mcp_servers
 
     servers = _get_mcp_servers()
-    name = next((n for n in ("clawpump", "clawpump-stdio") if n in servers), None)
+    name = next(
+        (n for n in ("clawpump", "clawpump-stdio", "clawpump-agents") if n in servers),
+        None,
+    )
+    if name is None:
+        name = next((n for n in servers if n.startswith("clawpump")), None)
     return (name, servers[name]) if name else (None, None)
 
 

package/agent/tools/mcp_tool.py

@@ -2995,6 +2995,73 @@ def _interrupted_call_result() -> str:
 # Config loading
 # ---------------------------------------------------------------------------
 
+_CLAWPUMP_MCP_NAMES = {"clawpump", "clawpump-stdio", "clawpump-agents"}
+
+
+def _is_clawpump_stdio_mcp(name: str, cfg: dict) -> bool:
+    return (
+        (name in _CLAWPUMP_MCP_NAMES or name.startswith("clawpump"))
+        and bool(cfg.get("command"))
+        and not cfg.get("url")
+    )
+
+
+def _usable_secret_value(value) -> bool:
+    text = str(value or "").strip()
+    return bool(text and "${" not in text)
+
+
+def _clawpump_api_key_for_stdio_env() -> str:
+    try:
+        from agent.secret_scope import get_secret, is_multiplex_active
+
+        key = (get_secret("CLAWPUMP_API_KEY", "") or "").strip()
+        if key:
+            return key
+        if is_multiplex_active():
+            return ""
+    except Exception:
+        try:
+            from agent.secret_scope import is_multiplex_active
+
+            if is_multiplex_active():
+                return ""
+        except Exception:
+            pass
+
+    try:
+        from hermes_cli.config import get_env_value
+
+        return (get_env_value("CLAWPUMP_API_KEY") or "").strip()
+    except Exception:
+        return ""
+
+
+def _with_clawpump_stdio_env(name: str, cfg: dict) -> dict:
+    """Backfill legacy ClawPump stdio configs with the saved API key.
+
+    The stdio subprocess environment intentionally excludes generic secrets
+    unless they are named in ``mcp_servers.<name>.env``. Older ClawPump setup
+    flows saved ``CLAWPUMP_API_KEY`` to ``.env`` but did not add that env block,
+    so the MCP could be configured yet start without credentials.
+    """
+    if not _is_clawpump_stdio_mcp(name, cfg):
+        return cfg
+
+    env = cfg.get("env") if isinstance(cfg.get("env"), dict) else {}
+    if _usable_secret_value(env.get("CLAWPUMP_API_KEY")):
+        return cfg
+
+    key = _clawpump_api_key_for_stdio_env()
+    if not key:
+        return cfg
+
+    updated = dict(cfg)
+    updated_env = dict(env)
+    updated_env["CLAWPUMP_API_KEY"] = key
+    updated["env"] = updated_env
+    return updated
+
 def _interpolate_env_vars(value):
     """Recursively resolve ``${VAR}`` placeholders.
 
@@ -3076,7 +3143,7 @@ def _load_mcp_config() -> Dict[str, dict]:
         for name, cfg in _filter_suspicious_mcp_servers(servers).items():
             interpolated = _interpolate_env_vars(cfg)
             if isinstance(interpolated, dict):
-                safe_servers[name] = interpolated
+                safe_servers[name] = _with_clawpump_stdio_env(name, interpolated)
         return safe_servers
     except Exception as exc:
         logger.debug("Failed to load MCP config: %s", exc)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawpump/claw-agent",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "publishConfig": {
     "access": "public"
   },