How to connect Ashby to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect Ashby from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

Ashby tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Ashby call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

The engines teach key-type causes: a read-only key on a write call, missing scopes, or a deactivated key, with the fix being to re-check key permissions in Ashby Admin. That maps directly onto a hosted flow: the pasted key carries its own permissions, so start with ashby_get_api_key_info, which returns the key's organisation, user, and permissions, then check the argument, where a placeholder id from documentation fails like a real 403.

Ask the agent to diagnose it:

Call ashby_get_api_key_info and tell me the key's permissions and the organisation it belongs to. Then quote the exact error from the failed call. Do not retry it yet.

Ashby rate-limits its API, and an agent walking every application one call at a time is the traffic shape that meets it. The response is not to retry immediately but to narrow the work: one opening, one stage, one date-bounded set, and the agent telling you what it intends to enumerate before it starts.

Ask the agent to diagnose it:

Tell me how many Ashby calls you made in the last minute and what you were listing. Quote any rate-limit detail from the last response. Do not call Ashby again until I reply.

The taught causes are a client config problem and a known agent-side tool-registration bug, with six Cursor forum threads' worth of fixes. Our 'Tool schema not loaded yet' card is the same phenomenon in a hosted flow: schemas load on demand, so the opening call in a fresh session can arrive before the catalog and needs one retry. The other causes are pairing incomplete, fixed by rerunning hermes clawlink begin and hermes clawlink finish, and a wrong tool name, where the error lists the closest real ones.

Ask the agent to diagnose it:

List the Ashby tools you actually have access to. If there are none, say so plainly. If there are, tell me which one lists applications and use that exact name.

Double-check that the API key for Ashby has the right scopes or account access. A valid key can still be too limited for some reads or writes.

Yes. ClawLink is the fastest way to connect Hermes to Ashby: link your Ashby account once in the browser and Hermes Agent can call the Ashby API through 125 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect Ashby in the dashboard and Hermes can use it from the next message — no config files, and the Ashby key you paste is stored server-side instead of in your environment.

About two minutes. Sign in, click Connect next to Ashby in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual API key setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Ashby working from chat.

The one from Ashby Admin → Integrations → API Keys, created by an admin. Create it with the permissions you want the agent to have: read-only for read-only work, read/write when the agent must move candidates through the pipeline. The key's permissions are the ceiling: no prompt can exceed them, which is also the answer to the safety question below.

Candidates, applications, jobs, openings, interview plans, interviews, interview stages, feedback forms, offers, departments, locations, custom fields, hiring team roles, and interviewer pools are readable; candidates can be added to projects or tags, and hiring team members and interviewer pool users can be added. The writes are visible to your recruiters, so confirm before executing them.

Server-side, on the hosted connection. It is not in ~/.hermes or any env file on your machine. Revoke from the ClawLink dashboard, or delete the key in Ashby Admin, and the connection dies from that moment. There is no token file to hunt down on any machine you have used.

The engines call official integrations safe and frame third-party API-key integrations as the risk path, and this page is the third-party case, so here is the straight answer. The mitigation is custody and scope: the key lives server-side, revokes in one place, and its permissions still apply in Ashby. The risk that remains is the key's own permissions, which is why the setup note says to create it narrowly. If that tradeoff is outside your risk tolerance, read-only key for read-only work.

It adds candidates to projects and tags, adds hiring team members, and adds interviewer pool users. These change what your recruiters see in Ashby, so they are the writes to approve explicitly rather than letting a broad prompt run them.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.