Connect Hermes Agent to WordPress with one config.yaml block

Before you start

• AgentedSEO is active (WordPress 6.9 or later, PHP 8.1 or later), and you are an administrator.
• The site is on HTTPS. WordPress only offers application passwords over HTTPS.
• The machine Hermes runs on can reach the site. If Hermes runs on a server or in a container, the site must be reachable from there.

Your endpoint speaks MCP over Streamable HTTP, which Hermes connects to with a url entry:

https://your-site.com/wp-json/agentedseo/mcp

Hermes keeps MCP servers in config.yaml under mcp_servers, and secrets in .env next to it. Default profile: ~/.hermes/config.yaml and ~/.hermes/.env. A named profile has its own pair. hermes config path and hermes config env-path print the right files (add -p <profile> for a named one).

01Create the agent’s password

1. Open AgentedSEO › Agents › Connections.
2. Under Connect an agent choose Desktop or code app.
3. Name your agent Hermes and click Create password. AgentedSEO creates the user agentedseo-hermes with the SEO Agent role and an application password, shown once.
4. Under Paste this config into your agent, copy the part of the Authorization value after Basic . Hermes uses YAML, so you only need this value.

02Add the Hermes Agent WordPress server to config.yaml

This is a normal Hermes Agent MCP config for a remote server: a url and a headers map. Two edits.

1. Put the secret in .env

AGENTEDSEO_AUTH=<the part after "Basic " from the Connections screen>

2. Add the server to config.yaml

mcp_servers:
  agentedseo:
    url: "https://your-site.com/wp-json/agentedseo/mcp"
    headers:
      Authorization: "Basic ${AGENTEDSEO_AUTH}"

If mcp_servers already exists, add the agentedseo entry under it. Hermes fills ${AGENTEDSEO_AUTH} from the active profile’s .env when it connects (${env:AGENTEDSEO_AUTH} works too). If the variable is missing, Hermes refuses to connect and names the variable, instead of sending a broken header.

03Reload Hermes

04Check the Hermes Agent MCP server setup

• hermes mcp test agentedseo connects live and lists the tools. If the server refuses, it prints the HTTP status and the start of the answer.
• hermes mcp list shows agentedseo among your servers.
• Inside Hermes the tools are named mcp__agentedseo__<tool>, hyphens turned into underscores: agentedseo-get-capabilities becomes mcp__agentedseo__agentedseo_get_capabilities. Hermes picks the tool; you don’t type the name.
• In WordPress, AgentedSEO › Agents › Connections › Test the connection › Run test. “Authorization header reaches WordPress” must pass.

After its first request, Hermes shows under Connected agents with Last activity and its own Revoke.

05Or sign in with OAuth, no password in a file

Hermes supports OAuth 2.1 for remote servers, and AgentedSEO’s endpoint offers OAuth with dynamic client registration.

$ hermes mcp add agentedseo --url https://your-site.com/wp-json/agentedseo/mcp --auth oauth
$ hermes mcp login agentedseo

Hermes opens your browser on a page on your site that asks you to approve the connection. Sign in as an administrator and click Approve. AgentedSEO creates an SEO Agent user for Hermes, listed on the Connections screen like any other. Hermes keeps and refreshes the tokens itself.

06Your first safe task

I’d start any new agent here: one field on one page, easy to check by eye. Paste this into Hermes, in the terminal or any chat it runs in:

1. Hermes calls agentedseo-set-meta. Meta titles and descriptions ask first by default, so the answer is proposed. The live page has not changed.
2. Open AgentedSEO › Dashboard › Approvals. Check Before and After, the checks it passed and Hermes’s note. Click Approve.
3. Open AgentedSEO › Dashboard › Change log, open the change’s Details and click Undo. The Before value is back, and the undo is logged.

Hermes also gets a batch_id with every write. Ask it to call revert-change with that id and it undoes its own change.

07Two approval layers

I run a fleet of agent profiles myself, each with its own role and job. That is why every connection here gets its own WordPress user: the Change log names the agent behind each change, and Revoke cuts off one without touching the others.

Hermes can also ask before it calls a tool. Add this line to the agentedseo entry, at the level of url, and Hermes asks you before any tool call not marked read-only. AgentedSEO marks its read tools read-only, so reads go through and writes ask.

    trust: untrusted

08What Hermes can and can’t change

I made approving a person’s job on purpose. Hermes can propose, preview and undo, but it has no tool that approves its own work.

Change the per-area defaults in AgentedSEO › Agents › Approval rules. Approving and rejecting are not tools: only a person can do them, in WordPress. Full table: what your agent can and can’t change.

Builder layouts (Bricks, Elementor, Breakdance, Oxygen) are read-only for agents, their SEO fields still change. Scripts and iframes in content are refused.

09Troubleshooting

10Questions about Hermes and WordPress

11Next steps