Connecting Nous Research's Hermes Agent to remote Model Context Protocol (MCP) servers can become complex due to configuration sprawl and credential management issues. Arcade.dev offers an MCP gateway that provides a single endpoint for thousands of agent-optimized tools. This gateway centralizes credential management, vaulting downstream tokens away from the agent process. For multi-user services, per-user MCP connections and token storage are necessary, requiring isolation boundaries like containers. Arcade User Sources can provide external identity but do not inherently add per-user MCP isolation to Hermes. To connect, install MCP support and configure Hermes to point to the Arcade MCP gateway using OAuth authentication in config.yaml. It is crucial not to use static API keys but to leverage Hermes's native OAuth flow for a user-bound session. Before making tool calls, authorize required tools or provider scope sets through Arcade's tools.authorize API. Arcade vaults these tokens, preventing them from reaching the language model, and tools can be restricted using tools.include or tools.exclude for least privilege. Agent-optimized tools from Arcade reduce hallucinations and token costs compared to raw API wrappers. Downstream service tokens are centrally managed and refreshed within Arcade, enhancing security and simplifying administration. Authorizing services for Hermes involves using Arcade's tools.authorize API, ensuring the specified email matches the gateway OAuth session identity. Token vaulting at runtime means Arcade handles authentication and token refreshing, with Hermes receiving only the results. Managing tool visibility with tools.include and tools.exclude in config.yaml is essential for maintaining the principle of least privilege, by filtering the available tool catalog.