Authenticated bridge

The authenticated Streamable HTTP MCP bridge accepts private-network clients and persists task state.

Native HTTP runtime

The bridge source is apps/hermes-async-bridge/hermes_async_bridge.py and should be supervised through the operations guide.

Bearer auth boundary

Network clients use bearer auth from ${HERMES_MCP_TOKEN}. Unauthenticated MCP initialize must fail and authenticated MCP initialize must succeed.

Private network placement

Use private placeholders such as 100.x.x.x or <bridge-host>; no blind public bind.