Hermai MCP server for website API schema lookup, hosted fetch execution, request intake, and workflow classification.
Hermai MCP demonstrates solid tool design with clear naming, comprehensive parameter schemas using Zod, and good descriptions. All 6 tools follow verb_noun convention (lookup_, list_, submit_, classify_, check_, fetch_). Schemas are well-typed with min/max constraints and enums where appropriate. Tool annotations (readOnlyHint, idempotentHint) are present. However, output schemas are not documented, callers cannot see what fields to expect from responses. Error handling is present but lacks recovery guidance (e.g., 'if out of credits, call upgrade_workspace'). Parameter descriptions are solid (avg ~80 chars) but some lack format hints (e.g., fetch_schema's 'params' object lacks structure guidance).
Check the status of a previously submitted Hermai schema request. Read-only.
Classify a prose workflow as direct API, hidden endpoint, browser-only, or needs owner/auth. Read-only and local.
Execute a registered Hermai schema and return live data through hosted /v1/fetch. Read workflows only (do not use for write workflows). Requires HERMAI_API_KEY (or HERMAI_PLATFORM_KEY) and consumes Hermai credits: a standard call costs 1 credit, some higher cost sites cost 5, and only successful calls are billed. If the workspace is out of credits the call returns a 402 whose error carries upgrade_to and upgrade_url. Resolve the exact site + endpoint first with lookup_schema, then pass endpoint params here.
List public schemas in the Hermai registry with optional filters. Read-only.
Search Hermai for a schema by domain, task, category, or verification state. Read-only.
Output schemas not documented. Callers cannot see what fields responses contain, forcing LLMs to guess structure and plan downstream tool calls blindly.
fetch_schema description lacks error recovery guidance. States 'returns 402 whose error carries upgrade_to and upgrade_url' but does not tell LLM what action to take (e.g., 'suggest user upgrade workspace').
fetch_schema 'params' parameter is an unstructured object with no schema guidance. LLMs cannot infer what keys are valid or required without seeing endpoint documentation.
submit_schema_request description warns 'Never include cookies, API keys, or private session data' but does not explain why or what happens if they are included. LLMs may not internalize the security implication.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2025-06-18+ | v2 |
Submit the six-field intake for a missing or brittle browser workflow. Never include cookies, API keys, or private session data.
classify_browser_workflow description is vague: 'Classify a prose workflow as direct API, hidden endpoint, browser-only, or needs owner/auth.' Does not explain when to call this vs lookup_schema or what the output categories mean.