feat(mcp-catalog): add GitHub, Notion, and Sentry remote-OAuth connectors

optional-mcps/github/manifest.yaml

@@ -0,0 +1,40 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: github
+description: Search, read, and manage GitHub repos, issues, and pull requests.
+source: https://github.com/github/github-mcp-server
+
+# GitHub ships an official remote MCP server with native OAuth 2.1 over
+# Streamable HTTP. Hermes's MCP client + mcp_oauth_manager handle discovery,
+# PKCE, token exchange, and refresh — nothing to install locally. The trailing
+# slash on the URL is GitHub's documented endpoint form (github-mcp-server
+# README, "Remote MCP server").
+transport:
+  type: http
+  url: https://api.githubcopilot.com/mcp/
+
+auth:
+  type: oauth
+  # No `provider:` — this is native MCP OAuth (case 1), not a third-party
+  # provider. The MCP client triggers the browser flow on the first probe /
+  # first connect. (GitHub's remote server also accepts a PAT, but the catalog
+  # entry uses the native OAuth path so there is no token to mint or store.)
+
+# Tool selection at install time:
+# GitHub's remote MCP server exposes a broad tool surface across repos, issues,
+# pull requests, actions, code search, and more. We leave `default_enabled`
+# unset so the install-time checklist starts with everything pre-checked —
+# users prune what they don't want.
+#
+# If you want to encode a curated subset here once it stabilizes, list the
+# tool names under `tools.default_enabled`. Probe failure would then apply
+# that list directly.
+
+post_install: |
+  On first connection, Hermes will open a browser to authenticate with GitHub.
+  After auth, restart your Hermes session so the GitHub tools are loaded.
+
+  You can re-run the tool checklist any time with:
+    hermes mcp configure github

optional-mcps/notion/manifest.yaml

@@ -0,0 +1,37 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: notion
+description: Search, read, and update Notion pages, databases, and comments.
+source: https://developers.notion.com/docs/mcp
+
+# Notion hosts a remote MCP server with native OAuth 2.1 over Streamable HTTP.
+# Hermes's MCP client + mcp_oauth_manager handle discovery, PKCE, token
+# exchange, and refresh — nothing to install locally.
+transport:
+  type: http
+  url: https://mcp.notion.com/mcp
+
+auth:
+  type: oauth
+  # No `provider:` — this is native MCP OAuth (case 1), not a third-party
+  # provider like Google. The MCP client triggers the browser flow on the
+  # first probe / first connect.
+
+# Tool selection at install time:
+# Notion's hosted MCP server exposes a moderate-sized tool surface (search +
+# fetch/create/update across pages, databases, and comments). We leave
+# `default_enabled` unset so the install-time checklist starts with everything
+# pre-checked — users prune what they don't want.
+#
+# If you want to encode a curated subset here once it stabilizes, list the
+# tool names under `tools.default_enabled`. Probe failure would then apply
+# that list directly.
+
+post_install: |
+  On first connection, Hermes will open a browser to authenticate with Notion.
+  After auth, restart your Hermes session so the Notion tools are loaded.
+
+  You can re-run the tool checklist any time with:
+    hermes mcp configure notion

optional-mcps/sentry/manifest.yaml

@@ -0,0 +1,39 @@
+# Nous-approved MCP catalog entry.
+# Presence in this directory = approval. Merged via PR review.
+manifest_version: 1
+
+name: sentry
+description: Search and triage Sentry issues, projects, and error events.
+source: https://docs.sentry.io/product/sentry-mcp/
+
+# Sentry hosts a remote MCP server with native OAuth 2.1 over Streamable HTTP
+# (graceful SSE fallback for older clients). Hermes's MCP client +
+# mcp_oauth_manager handle discovery, PKCE, token exchange, and refresh —
+# nothing to install locally.
+transport:
+  type: http
+  url: https://mcp.sentry.dev/mcp
+
+auth:
+  type: oauth
+  # No `provider:` — this is native MCP OAuth (case 1), not a third-party
+  # provider like Google. The MCP client triggers the browser flow on the
+  # first probe / first connect. Sentry validates the token audience locally
+  # and makes its own server-to-server calls to the Sentry API.
+
+# Tool selection at install time:
+# Sentry's hosted MCP server exposes a moderate-sized tool surface (project +
+# issue lookup, event/error inspection, DSN management, Seer root-cause). We
+# leave `default_enabled` unset so the install-time checklist starts with
+# everything pre-checked — users prune what they don't want.
+#
+# If you want to encode a curated subset here once it stabilizes, list the
+# tool names under `tools.default_enabled`. Probe failure would then apply
+# that list directly.
+
+post_install: |
+  On first connection, Hermes will open a browser to authenticate with Sentry.
+  After auth, restart your Hermes session so the Sentry tools are loaded.
+
+  You can re-run the tool checklist any time with:
+    hermes mcp configure sentry

pyproject.toml

@@ -334,6 +334,9 @@ locales = ["locales/*.yaml"]
 # entry; tests/test_packaging_metadata.py enforces an entry per optional-mcps/<name>.
 "optional-mcps/linear" = ["optional-mcps/linear/manifest.yaml"]
 "optional-mcps/n8n" = ["optional-mcps/n8n/manifest.yaml"]
+"optional-mcps/github" = ["optional-mcps/github/manifest.yaml"]
+"optional-mcps/notion" = ["optional-mcps/notion/manifest.yaml"]
+"optional-mcps/sentry" = ["optional-mcps/sentry/manifest.yaml"]
 
 [tool.setuptools.package-data]
 hermes_cli = ["web_dist/**/*", "tui_dist/**/*", "scripts/install.sh", "scripts/install.ps1"]