YouGile Secure MCP

A local stdio Model Context Protocol server for the YouGile API v2, designed for Hermes Agent.

v0.1.0: safe read-only access

The initial release deliberately exposes only these six non-destructive tools:

• list_projects
• list_boards
• list_columns
• list_tasks
• get_task
• list_users

Every MCP tool has readOnlyHint=true, destructiveHint=false, and openWorldHint=false.

Security model

• Uses only YOUGILE_API_KEY; it never accepts, stores, or sends an account login/password.
• Never creates, lists, or deletes YouGile API keys.
• Never writes credentials to /tmp or project files.
• Does not expose create, update, upload, webhook, or delete operations.
• policy.py contains a tested, one-use and payload-bound approval primitive for a future explicitly approved write phase. Delete actions remain disabled.

Install

git clone https://github.com/<your-account>/mcp-yougile.git
cd mcp-yougile
python3 -m venv .venv
.venv/bin/python -m pip install -e '.[dev]'

Set the API key in the environment of the MCP host:

export YOUGILE_API_KEY='your-api-key'
.venv/bin/python run_server.py

Hermes configuration

Keep the secret in ~/.hermes/.env with 0600 permissions:

YOUGILE_API_KEY=your-api-key

Then add this server under mcp_servers in ~/.hermes/config.yaml:

mcp_servers:
  yougile:
    command: /absolute/path/to/mcp-yougile/.venv/bin/python
    args: [/absolute/path/to/mcp-yougile/run_server.py]
    env:
      YOUGILE_API_KEY: "${YOUGILE_API_KEY}"
    timeout: 60
    connect_timeout: 30
    sampling:
      enabled: false

Verify it before restarting Hermes:

hermes mcp test yougile

Development

.venv/bin/python -m pytest -q
.venv/bin/python -m compileall -q src run_server.py

License

MIT