@clawpump/claw-agent 0.1.16 → 0.1.17

package/agent/apps/desktop/package.json

@@ -2,7 +2,7 @@
   "name": "hermes",
   "productName": "Claw Agent",
   "private": true,
-  "version": "0.15.7",
+  "version": "0.15.8",
   "description": "Claw Agent by ClawPump — native desktop app for Solana agents, built on Hermes Agent by Nous Research.",
   "author": "ClawPump (built on Hermes by Nous Research)",
   "type": "module",

package/agent/apps/desktop/src/app/mcp/index.test.tsx

@@ -0,0 +1,111 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const getMcpServers = vi.hoisted(() => vi.fn())
+
+vi.mock('@/hermes', () => ({
+  getMcpServers
+}))
+
+async function renderMcpView() {
+  const { McpView } = await import('./index')
+
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } }
+  })
+
+  return render(
+    <QueryClientProvider client={client}>
+      <McpView />
+    </QueryClientProvider>
+  )
+}
+
+afterEach(() => {
+  cleanup()
+  vi.clearAllMocks()
+})
+
+describe('McpView', () => {
+  it('shows a ClawPump API-key connection action for stdio installs that are not authenticated', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: null,
+          command: 'npx',
+          enabled: true,
+          name: 'clawpump-stdio',
+          transport: 'stdio'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('ClawPump MCP')).toBeTruthy()
+    expect(screen.getByText('Not connected')).toBeTruthy()
+    expect(screen.getByRole('button', { name: /connect with api key/i })).toBeTruthy()
+    expect(screen.getByText('claw clawpump setup')).toBeTruthy()
+  })
+
+  it('does not show a connect action when ClawPump credentials are present', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: true,
+          command: 'npx',
+          enabled: true,
+          name: 'clawpump-stdio',
+          transport: 'stdio'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('Connected')).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /connect with api key/i })).toBeNull()
+    expect(screen.queryByRole('button', { name: /connect at the gateway/i })).toBeNull()
+  })
+
+  it('recognizes custom clawpump-prefixed server names as the ClawPump MCP', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: false,
+          enabled: true,
+          name: 'clawpump-agents-local',
+          transport: 'http',
+          url: 'https://agents.clawpump.tech/mcp'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('ClawPump MCP')).toBeTruthy()
+    expect(screen.getByText('clawpump-agents-local')).toBeTruthy()
+    expect(screen.queryByText('Other servers')).toBeNull()
+  })
+
+  it('shows disabled ClawPump servers as disabled without auth actions', async () => {
+    getMcpServers.mockResolvedValue({
+      servers: [
+        {
+          authenticated: true,
+          command: 'npx',
+          enabled: false,
+          name: 'clawpump-stdio',
+          transport: 'stdio'
+        }
+      ]
+    })
+
+    await renderMcpView()
+
+    expect(await screen.findByText('Disabled')).toBeTruthy()
+    expect(screen.getByText(/installed but disabled/i)).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /connect/i })).toBeNull()
+  })
+})

package/agent/apps/desktop/src/app/mcp/index.tsx

@@ -10,9 +10,7 @@ import type { SetStatusbarItemGroup } from '../shell/statusbar-controls'
 // Where an unauthenticated user goes to connect the ClawPump MCP — the gateway
 // (browser login / cpk_* key). Shown prominently when not connected.
 const CLAWPUMP_GATEWAY_URL = 'https://agents.clawpump.tech/dashboard/api'
-const CLAWPUMP_NAMES = new Set(['clawpump', 'clawpump-agents', 'clawpump-stdio'])
-
-const isClawpump = (s: McpServer) => CLAWPUMP_NAMES.has(s.name)
+const isClawpump = (s: McpServer) => s.name.startsWith('clawpump')
 
 interface McpViewProps extends React.ComponentProps<'section'> {
   setStatusbarItemGroup?: SetStatusbarItemGroup
@@ -24,10 +22,20 @@ export function McpView({ setStatusbarItemGroup: _setStatusbarItemGroup, ...prop
   const clawpump = servers.find(isClawpump)
   const others = servers.filter(s => !isClawpump(s))
 
-  // authenticated === true → OAuth tokens are on disk (the same session chat
-  // uses), so the MCP is genuinely connected. === false → needs sign-in.
-  const clawpumpConnected = clawpump?.authenticated === true
-  const clawpumpNeedsAuth = clawpump != null && clawpump.authenticated === false
+  // authenticated === true means the backend found the same OAuth/API-key
+  // credentials the chat runtime uses. Enabled-but-not-connected states need
+  // an action surface; otherwise stdio/API-key installs showed "Not connected"
+  // with no way to fix or refresh credentials.
+  const clawpumpConnected = Boolean(clawpump?.enabled && clawpump.authenticated === true)
+  const clawpumpDisabled = clawpump != null && !clawpump.enabled
+  const clawpumpNeedsConnection = clawpump != null && clawpump.enabled && !clawpumpConnected
+  const clawpumpUsesStdio = clawpump?.transport === 'stdio' || Boolean(clawpump?.command)
+  const clawpumpConnectCommand = clawpumpUsesStdio ? 'claw clawpump setup' : 'claw clawpump login'
+  const clawpumpConnectLabel = clawpumpUsesStdio ? 'Connect with API key' : 'Connect at the gateway'
+
+  const clawpumpConnectionHelp = clawpumpUsesStdio
+    ? 'Add or refresh your ClawPump cpk_* API key, then restart the session so the MCP tools come online.'
+    : 'Sign in at the ClawPump gateway to connect — then your 133 ClawPump tools come online in chat and across the app.'
 
   const openGateway = () => void window.hermesDesktop?.openExternal?.(CLAWPUMP_GATEWAY_URL)
 
@@ -62,20 +70,23 @@ export function McpView({ setStatusbarItemGroup: _setStatusbarItemGroup, ...prop
                     <Check className="size-3" /> Connected
                   </Badge>
                 ) : (
-                  <Badge variant="outline">Not connected</Badge>
+                  <Badge variant="outline">{clawpump.enabled ? 'Not connected' : 'Disabled'}</Badge>
                 )}
               </div>
-              {clawpumpNeedsAuth && (
+              {clawpumpDisabled && (
+                <p className="mt-3 text-sm text-muted-foreground">
+                  ClawPump MCP is installed but disabled. Re-enable it in MCP settings, then restart
+                  the session so the tools come online.
+                </p>
+              )}
+              {clawpumpNeedsConnection && (
                 <div className="mt-3 space-y-2">
-                  <p className="text-sm text-muted-foreground">
-                    Sign in at the ClawPump gateway to connect — then your 133 ClawPump tools come
-                    online in chat and across the app.
-                  </p>
+                  <p className="text-sm text-muted-foreground">{clawpumpConnectionHelp}</p>
                   <div className="flex flex-wrap items-center gap-2">
                     <Button onClick={openGateway} size="sm">
-                      <ExternalLink className="size-4" /> Connect at the gateway
+                      <ExternalLink className="size-4" /> {clawpumpConnectLabel}
                     </Button>
-                    <code className="rounded bg-muted px-2 py-1 text-xs">claw clawpump login</code>
+                    <code className="rounded bg-muted px-2 py-1 text-xs">{clawpumpConnectCommand}</code>
                   </div>
                   <p className="break-all text-xs text-muted-foreground">{CLAWPUMP_GATEWAY_URL}</p>
                 </div>

package/agent/apps/desktop/src/hermes.ts

@@ -776,8 +776,9 @@ export interface McpServer {
   transport: string
   url?: string | null
   command?: string | null
+  auth?: string | null
   enabled: boolean
-  /** OAuth servers: true/false once tokens are checked; null when not applicable. */
+  /** true/false when backend can check credentials; null when not applicable/unknown. */
   authenticated?: boolean | null
   tools?: string[] | null
 }

package/agent/hermes_cli/mcp_catalog.py

@@ -36,6 +36,7 @@ from hermes_constants import get_hermes_home, get_optional_mcps_dir
 from hermes_cli.colors import Colors, color
 from hermes_cli.config import (
     load_config,
+    read_raw_config,
     save_config,
     get_env_value,
     save_env_value,
@@ -458,7 +459,10 @@ def _prompt_env_vars(specs: List[EnvVarSpec]) -> Dict[str, str]:
 
 
 def _build_server_config(
-    entry: CatalogEntry, install_dir: Optional[Path]
+    entry: CatalogEntry,
+    install_dir: Optional[Path],
+    *,
+    env_names: Optional[List[str]] = None,
 ) -> dict:
     """Translate a manifest into the ``mcp_servers.<name>`` block format used
     by hermes_cli/mcp_config.py."""
@@ -468,6 +472,8 @@ def _build_server_config(
         cfg["command"] = _expand_install_dir(t.command or "", install_dir)
         if t.args:
             cfg["args"] = [_expand_install_dir(a, install_dir) for a in t.args]
+        if env_names:
+            cfg["env"] = {name: f"${{{name}}}" for name in env_names}
     elif t.type == "http":
         cfg["url"] = t.url
         if entry.auth.type == "oauth":
@@ -519,7 +525,9 @@ def _probe_tools(name: str) -> Optional[List[tuple]]:
 
 def _write_tools_include(name: str, include: Optional[List[str]]) -> None:
     """Persist or clear ``mcp_servers.<name>.tools.include``."""
-    cfg = load_config()
+    # Use the raw YAML here. load_config() expands ${ENV} placeholders, and
+    # saving that expanded object would persist API keys into config.yaml.
+    cfg = read_raw_config()
     servers = cfg.setdefault("mcp_servers", {})
     server_entry = servers.get(name) or {}
     if include is None:
@@ -696,10 +704,11 @@ def install_entry(entry: CatalogEntry, *, enable: bool = True) -> None:
         install_dir = _do_git_install(entry)
 
     # Auth
+    auth_env: Dict[str, str] = {}
     if entry.auth.type == "api_key":
         print()
         print(color("  Configure credentials:", Colors.CYAN))
-        _prompt_env_vars(entry.auth.env)
+        auth_env = _prompt_env_vars(entry.auth.env)
     elif entry.auth.type == "oauth":
         if entry.auth.provider:
             # Case 2: provider-mediated (Google, GitHub, etc.). We rely on
@@ -727,7 +736,11 @@ def install_entry(entry: CatalogEntry, *, enable: bool = True) -> None:
 
     # Build and write the mcp_servers entry (without tools filter yet;
     # _apply_tool_selection() finalizes it below).
-    server_cfg = _build_server_config(entry, install_dir)
+    server_cfg = _build_server_config(
+        entry,
+        install_dir,
+        env_names=list(auth_env) if auth_env else None,
+    )
     server_cfg["enabled"] = enable
 
     from hermes_cli.mcp_config import _save_mcp_server

package/agent/hermes_cli/web_server.py

@@ -7983,14 +7983,51 @@ def _redact_mcp_env(env: Dict[str, Any]) -> Dict[str, str]:
     return out
 
 
+_CLAWPUMP_MCP_NAMES = {"clawpump", "clawpump-stdio", "clawpump-agents"}
+
+
+def _is_clawpump_mcp(name: str) -> bool:
+    return name in _CLAWPUMP_MCP_NAMES or name.startswith("clawpump")
+
+
+def _usable_mcp_secret_value(value: Any) -> bool:
+    text = str(value or "").strip()
+    return bool(text and "${" not in text)
+
+
+def _clawpump_api_key_present(cfg: Optional[Dict[str, Any]] = None) -> bool:
+    if cfg:
+        try:
+            from hermes_cli.mcp_config import _resolve_mcp_server_config
+
+            resolved = _resolve_mcp_server_config(cfg)
+        except Exception:
+            resolved = cfg
+        env = resolved.get("env") if isinstance(resolved, dict) else {}
+        if isinstance(env, dict) and _usable_mcp_secret_value(env.get("CLAWPUMP_API_KEY")):
+            return True
+
+    try:
+        from hermes_cli.config import get_env_value
+
+        return _usable_mcp_secret_value(get_env_value("CLAWPUMP_API_KEY"))
+    except Exception:
+        return False
+
+
 def _mcp_server_authenticated(name: str, cfg: Dict[str, Any]) -> Optional[bool]:
-    """True/False if this server uses OAuth and we can tell whether tokens are
-    on disk; None when auth state isn't applicable/known (stdio key servers).
+    """True/False if this server's auth state can be determined.
 
     Lets the GUI render a real "Connected" vs "Connect" state for the ClawPump
-    MCP instead of guessing — the OAuth token is shared on disk, so the sidebar
-    reflects the same authenticated session the chat agent uses.
+    MCP instead of guessing. OAuth tokens and profile .env values are shared
+    with the chat agent, so the sidebar reflects the same session chat uses.
     """
+    # ClawPump's stdio/API-key transport is fully usable when the cpk_* key is
+    # present. Returning None made the desktop show "Not connected" even while
+    # wallet routes were succeeding through the same MCP server.
+    if _is_clawpump_mcp(name) and cfg.get("command") and not cfg.get("url"):
+        return _clawpump_api_key_present(cfg)
+
     is_oauth = cfg.get("auth") == "oauth" or (cfg.get("url") and not cfg.get("command"))
     if not is_oauth:
         return None
@@ -8024,11 +8061,10 @@ async def list_mcp_servers(profile: Optional[str] = None):
 
     with _profile_scope(profile):
         servers = _get_mcp_servers()
-    return {
-        "servers": [
+        summaries = [
             _mcp_server_summary(name, cfg) for name, cfg in sorted(servers.items())
         ]
-    }
+    return {"servers": summaries}
 
 
 @app.post("/api/mcp/servers")

package/agent/tools/mcp_tool.py

@@ -2995,6 +2995,73 @@ def _interrupted_call_result() -> str:
 # Config loading
 # ---------------------------------------------------------------------------
 
+_CLAWPUMP_MCP_NAMES = {"clawpump", "clawpump-stdio", "clawpump-agents"}
+
+
+def _is_clawpump_stdio_mcp(name: str, cfg: dict) -> bool:
+    return (
+        (name in _CLAWPUMP_MCP_NAMES or name.startswith("clawpump"))
+        and bool(cfg.get("command"))
+        and not cfg.get("url")
+    )
+
+
+def _usable_secret_value(value) -> bool:
+    text = str(value or "").strip()
+    return bool(text and "${" not in text)
+
+
+def _clawpump_api_key_for_stdio_env() -> str:
+    try:
+        from agent.secret_scope import get_secret, is_multiplex_active
+
+        key = (get_secret("CLAWPUMP_API_KEY", "") or "").strip()
+        if key:
+            return key
+        if is_multiplex_active():
+            return ""
+    except Exception:
+        try:
+            from agent.secret_scope import is_multiplex_active
+
+            if is_multiplex_active():
+                return ""
+        except Exception:
+            pass
+
+    try:
+        from hermes_cli.config import get_env_value
+
+        return (get_env_value("CLAWPUMP_API_KEY") or "").strip()
+    except Exception:
+        return ""
+
+
+def _with_clawpump_stdio_env(name: str, cfg: dict) -> dict:
+    """Backfill legacy ClawPump stdio configs with the saved API key.
+
+    The stdio subprocess environment intentionally excludes generic secrets
+    unless they are named in ``mcp_servers.<name>.env``. Older ClawPump setup
+    flows saved ``CLAWPUMP_API_KEY`` to ``.env`` but did not add that env block,
+    so the MCP could be configured yet start without credentials.
+    """
+    if not _is_clawpump_stdio_mcp(name, cfg):
+        return cfg
+
+    env = cfg.get("env") if isinstance(cfg.get("env"), dict) else {}
+    if _usable_secret_value(env.get("CLAWPUMP_API_KEY")):
+        return cfg
+
+    key = _clawpump_api_key_for_stdio_env()
+    if not key:
+        return cfg
+
+    updated = dict(cfg)
+    updated_env = dict(env)
+    updated_env["CLAWPUMP_API_KEY"] = key
+    updated["env"] = updated_env
+    return updated
+
 def _interpolate_env_vars(value):
     """Recursively resolve ``${VAR}`` placeholders.
 
@@ -3076,7 +3143,7 @@ def _load_mcp_config() -> Dict[str, dict]:
         for name, cfg in _filter_suspicious_mcp_servers(servers).items():
             interpolated = _interpolate_env_vars(cfg)
             if isinstance(interpolated, dict):
-                safe_servers[name] = interpolated
+                safe_servers[name] = _with_clawpump_stdio_env(name, interpolated)
         return safe_servers
     except Exception as exc:
         logger.debug("Failed to load MCP config: %s", exc)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawpump/claw-agent",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "publishConfig": {
     "access": "public"
   },