portveil-mcp 0.4.1 → 0.4.2

package/README.md

@@ -34,6 +34,8 @@ Devices can be named loosely ("scraper" finds "Scraper box"); an ambiguous name
 
 ## Setup
 
+No account yet? [Start free](https://portveil.com/free/) with just an email, no card.
+
 1. In the [Portveil dashboard](https://portveil.com/dashboard/), create an **API token**. Choose **control** scope to let the assistant move devices, or **read** to let it only look. Don't give it your account key.
 2. Note your account ID (`acct_…`).
 3. Add the server to your assistant:
@@ -56,6 +58,20 @@ claude mcp add portveil -e PORTVEIL_ACCOUNT_ID=acct_… -e PORTVEIL_TOKEN=clt_
 }
 ```
 
+**Hermes Agent**: Hermes only installs npm packages older than 14 days, so install into its own folder and run it with node:
+```bash
+cd ~ && npm install --prefix ~/.hermes/mcp-servers/portveil portveil-mcp@latest
+echo 'PORTVEIL_TOKEN=clt_…' >> ~/.hermes/.env
+hermes mcp add portveil --command node \
+  --env PORTVEIL_ACCOUNT_ID=acct_… 'PORTVEIL_TOKEN=${PORTVEIL_TOKEN}' \
+  --args ~/.hermes/mcp-servers/portveil/node_modules/portveil-mcp/dist/index.js
+```
+For Hermes to use it well (when to act, what to confirm first, how to add devices), also install the Portveil skill from [ClawHub](https://clawhub.ai/roybogs/portveil):
+```bash
+hermes skills install roybogs/portveil
+```
+(Source: [`skills/portveil/SKILL.md`](skills/portveil/SKILL.md).)
+
 Devices must be running the Portveil app or the Portveil agent with remote control on. Devices using the plain WireGuard app are shown but can't be moved.
 
 ## Security

package/dist/index.js

@@ -172,7 +172,7 @@ server.registerTool("add_device", {
         kind: z.enum(["phone_or_computer", "linux_machine"]).describe("phone_or_computer: WireGuard app on a phone or laptop. linux_machine: a Linux server or agent machine running the Portveil agent"),
         temporary_minutes: z.number().int().min(5).max(43200).optional().describe("phone_or_computer only: delete the device automatically after this many minutes (5 to 43200, i.e. 30 days). Omit for a permanent device"),
         folder: z.string().min(1).optional().describe("phone_or_computer only: folder to save the tunnel files in. Default ~/Portveil/<name>"),
-        split_tunnel: z.boolean().optional().describe("linux_machine only: default true, so a remote server keeps its SSH session. false sends all of its traffic through Portveil"),
+        split_tunnel: z.boolean().optional().describe("linux_machine only, advanced: default false (full tunnel), which sends everything the machine connects to through Portveil and keeps SSH and other incoming connections on their normal route, so remote servers stay reachable. true only reaches Portveil's own network: the machine's internet traffic would NOT go through Portveil"),
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
 }, ({ name, kind, temporary_minutes, folder, split_tunnel }) => run(async () => {
@@ -183,8 +183,8 @@ server.registerTool("add_device", {
     }
     if (kind === "linux_machine") {
         return `Run these as root on the machine you're adding. It makes its own VPN key, so this can't be done from here. The token prompt doesn't echo; use an admin-scope API token or the account key, and never paste it into a chat.\n\n` +
-            agentSetup(apiBase, accountId, name, split_tunnel ?? true) +
-            `\n\nThe daemon keeps running; install it as a service to survive reboots. "${name}" then appears in list_devices, and can be moved once its exit confirms it${slots}.`;
+            agentSetup(apiBase, accountId, name, split_tunnel ?? false) +
+            `\n\nIts own traffic then goes through Portveil, while SSH and other incoming connections keep their normal route, so a remote session stays up. The daemon keeps running; install it as a service to survive reboots. "${name}" then appears in list_devices, and can be moved once its exit confirms it${slots}.`;
     }
     const dir = resolve(folder?.replace(/^~(?=$|\/)/, homedir()) ?? join(homedir(), "Portveil", name.replace(/[^\w .-]+/g, "_")));
     const k = wgKeypair();

package/dist/portveil.js

@@ -1,7 +1,7 @@
 // Portveil API client and the logic behind the MCP tools. No MCP types here,
 // so it can be tested against a fake API.
 import { generateKeyPairSync } from "node:crypto";
-export const VERSION = "0.4.1";
+export const VERSION = "0.4.2";
 /** "↓ 42.3 Mbps ↑ 6.1 Mbps", or "idle" when nothing is moving. */
 export function describeSpeed(speed) {
     if (speed.down_mbps < 0.1 && speed.up_mbps < 0.1)
@@ -24,7 +24,7 @@ export function wgConfig(priv, address, s) {
 export function agentSetup(apiBase, accountId, name, splitTunnel) {
     const q = (v) => `'${v.replace(/'/g, `'\\''`)}'`;
     return [
-        "apt install -y wireguard-tools curl",
+        "apt install -y wireguard-tools curl nftables",
         "curl -fsSLO https://portveil.com/downloads/portveil-agent",
         "curl -fsSL https://portveil.com/downloads/portveil-agent.sha256 | sha256sum -c -",
         "chmod +x portveil-agent",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "portveil-mcp",
   "mcpName": "io.github.roybogs/portveil-mcp",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "MCP server for Portveil: let AI assistants see your devices and move them between VPN locations.",
   "license": "MIT",
   "type": "module",