Steps
- Before asking Michael for any key: search this page for the tool name.
- Still not found: check both machines’ env stores (Mini ~/.hermes/.env, Mini work profile, MacBook ~/.hermes/.env) and MCP token dirs.
- Genuinely missing: ask Michael, then store the credential in the Mini default profile (gateway home) unless it is personal.
- After connecting anything new: add a row to the Connected table here, and update Leverage scoreboard (weekly) metric inputs in the same session.
Corrected full audit 2026-07-29 (after twice discovering “unconnected” tools were already live). CHECK THIS PAGE and both machines’ credential stores before asking Michael to generate any key. Env stores: Mini ~/.hermes/.env (default profile, where the gateway and all crons run), Mini ~/.hermes/profiles/work/.env, MacBook ~/.hermes/.env.
Connected (verified live)
| Tool | Credential | Store |
|---|---|---|
| Kick (bookkeeping) | MCP, bearer PAT | Mini default config |
| Slack | bot + app tokens | Mini default .env |
| Granola | MCP OAuth tokens | Mini default + work mcp-tokens |
| Gmail michael@ryevalley.co | google_token.json | work profile |
| Gmail hermes@ryevalley.co | google_token.json | hermes-mail profile |
| Google Sheets/Drive/Calendar | same tokens as Gmail | work + hermes-mail |
| GitHub (houckgpt) | gh CLI keyring (MacBook) + GITHUB_TOKEN, GITHUB_TOKEN_ORG | MacBook keyring, Mini default .env |
| Stripe x6 entities | STRIPE_API_KEY_* (read-only, doomed-write verified) | Mini: 4 in default, LORE + RYEVALLEY_HOLDING in work (to consolidate) |
| Mercury x6 entities | MERCURY_TOKEN_* (read-only) | Mini default .env |
| beehiiv (5 publications) | BEEHIIV_API_KEY | Mini default + work |
| Meta Ads | META_ADS_TOKEN (ads_read only, system user hermes-brain) | Mini default .env |
| Vercel (9 projects) | VERCEL_TOKEN | Mini default .env |
| Linear | LINEAR_API_KEY + MCP token | Mini default .env, work mcp-tokens |
| Notion | NOTION_API_KEY | work profile .env, MacBook .env |
| Figma, Sentry, Cloudflare | MCP OAuth tokens | work profile mcp-tokens |
| Exa, Semrush, Ahrefs | *_API_KEY (Lore SEO stack) | Mini default .env |
| PostSyncer | POSTSYNCER_API_KEY | work profile .env |
| Photon (iMessage) | project secret | Mini default .env |
| AMEX Business Checking | via Kick sync (no direct API exists) | n/a |
| Airtable (10+ bases) | AIRTABLE_API_KEY (read scopes) | Mini default .env |
| Calendly (michael@ryevalley.co) | CALENDLY_API_KEY (PAT; carries write scopes by design, use read only). API is behind Cloudflare: needs browser UA | Mini default .env |
| PostHog (org Rye Valley, US cloud) | POSTHOG_API_KEY | Mini default .env |
| Intercom (app: Megaphone) | INTERCOM_API_KEY | Mini default .env |
| Typeform (michael@houck.fyi) | TYPEFORM_API_KEY | Mini default .env |
| Browserbase (Production project) | BROWSERBASE_API_KEY (auth: X-BB-API-Key header) | Mini default .env |
| ElevenLabs (grant tier, 33M chars) | ELEVENLABS_API_KEY (auth: xi-api-key header; restricted key, no models_read) | Mini default .env |
| Resend (lorebuilders.com domain, sending) | RESEND_API_KEY. SENDS REAL EMAIL: confirm-first always. Cloudflare UA rule applies | Mini default .env |
| Supabase | MCP read_only=true, bearer sbp_ token | work profile config |
| AngelList Link | MCP OAuth (28 tools, all read-only: capital accounts, calls, distributions, financial statements, documents). GP access confirmed: firm “House Capital”, vehicle “launch house” (RUV). Tokens on BOTH machines | Mini + MacBook mcp-tokens |
| Apollo | APOLLO_API_KEY (enrichment works; People/Company Search endpoints 403 on current plan tier) | Mini default .env |
| Canva | AI Connector MCP (mcp.canva.com), OAuth, 33 tools incl. design content read/WRITE, brand templates, asset upload. Tokens on both machines | Mini + MacBook mcp-tokens |
| Hunter.io | HUNTER_API_KEY (michael@ryevalley.co, Free plan: 60 searches + 120 verifications/mo, budget accordingly) | Mini default .env |
| Miro | MIRO_TOKEN (boards read/write, “Dev team”, create/delete verified; team not actively using Miro yet, Hermes may create boards) | Mini default .env |
| Zapier | MCP server (token-in-URL, treat URL as secret) | Mini default config, mcp_servers.zapier |
| Twilio (megaphone.network SMS: OTP codes + creator broadcasts) | TWILIO_ACCOUNT_SID, TWILIO_API_KEY_SID/SECRET, TWILIO_AUTH_TOKEN. Sends real SMS: confirm-first | Mini default .env |
Deliberately NOT connected
- Squarespace (Michael, 2026-07-29: per-site keys too much hassle; revisit on concrete commerce need)
- GoDaddy (domain-only for viralexamples.co, nothing to connect)
- Team members’ Gmail (privacy/security; hermes@ CC ritual instead)
- Houck’s Dealflow beehiiv pub (defunct)
Pending
- Clay: PARKED by Michael (2026-07-29). Do not pursue connection. Standing instruction: proactively surface concrete opportunities where Clay would add leverage (e.g. lead enrichment for Megaphone/Lore/JOLT outreach, newsletter subscriber enrichment, BD list building) as they arise in real work; if one lands, the integration path is the webhook pattern or Clay’s named-client MCP (Claude/ChatGPT/Copilot/Glean only, no generic endpoint as of Jul 2026). NOTE: github clay-inc/clay-mcp is Mesh personal-CRM, NOT clay.com.
- Thera: FULLY CONNECTED + VERIFIED 2026-07-30. Auth: header
X-Thera-API-Key: <key>, base https://api.getthera.com (backend-prod.carbon-benefits.com also works), key read endpoint GET /external/contractors/bulk-details. Response shape: top-levelusersarray (NOTcontractors), each with contracts[] (rate, contractType) and invoices[] (amount, status, approvalStatus, period). ALL AMOUNTS IN MINOR UNITS (cents). 4 entity keys verified 200, read-only confirmed by doomed write (contractor create rejected). Per-contractor rates now available for scoreboard cost-adjusted analysis and Owner tier. - Clay (webhook-in only; design pending use case), Apollo (key pending), AngelList (no API; hermes@ CC ritual + portfolio page)
- Personal batch (personal Mercury, Spotify, Last.fm) -> isolated personal profile, NEVER into business stores or the brain
Known cleanup
- Consolidate business credentials from work profile into default profile (gateway home) so crons can reach them: STRIPE_API_KEY_LORE, STRIPE_API_KEY_RYEVALLEY_HOLDING, NOTION_API_KEY at minimum.
- rye-valley-dashboard project exists on Vercel; purpose unknown, ask Michael.
Short.io
- Connected: 2026-08-01 (MCP, both machines)
- MCP: https://ai-assistant.short.io/mcp (header auth), key in ~/.hermes/.env as SHORTIO_API_KEY on MacBook + Mini
- REST API: https://api.short.io (same key) for anything the MCP lacks
- Domain: go.foundingjourney.com (id 1184876)
- 11 MCP tools incl. create-short-link, edit-link, link/domain statistics, search-links
PostHog (site analytics)
- Org: Rye Valley (US cloud), project 447038 “Rye Valley Web (all sites)”
- ONE project for all properties (free tier = 1 project max); segment by $host
- Client token (public, goes in site code): POSTHOG_CLIENT_TOKEN in Mini .env
- Query key: POSTHOG_API_KEY (personal phx_, Mini .env). Query via HogQL: POST /api/projects/447038/query/ e.g. select $host, count() from events where event = '$pageview’ group by $host
- Properties reporting in (as instrumented): megaphone.network (legacy, own key historically), megaphonestudio.com, joltexclamationpoint.com, lorebuilders.com, hardcalls.co, foundingjourney.com, hockeystickstudio.com