How to connect BunnyCDN to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect BunnyCDN from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

BunnyCDN tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every BunnyCDN call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

This is the card ChatGPT already cites us for (3/3 on the prompt that measures it), so the hosted causes come first, then the key-type taxonomy the AIO teaches. If the key was regenerated or deleted in Bunny.net after setup, every BunnyCDN tool fails from that moment and the fix is re-pasting the current account API key from the dashboard. If the connection is stale, disconnect and reconnect. With that ruled out, the error usually means the wrong credential went in at setup: a Storage Zone password or a Stream key pasted where the account API key belongs, or a mistyped string. Those all surface as 401 invalid access key, the same error, because Bunny.net does not tell you which key failed.

Ask the agent to diagnose it:

Call bunnycdn_get_pull_zone_list and quote the exact error body and status code. Do not retry anything else until we know which call shape fails.

The engines teach this as a key-level taxonomy and the explanation holds for hosted connections: the main account key covers account operations, while scoped operations, pull-zone level changes and storage access, are governed by their own credentials and zone settings. If some tools work and zone-level ones fail, the account key is valid and the blocker is zone-level: the agent can reach what the account can reach, and a zone with restricted settings rejects changes it is not allowed to make. The hosted-agent causes still apply too: a placeholder zone id from documentation fails as a permission error, and a zone id from another account fails the same way.

Ask the agent to diagnose it:

Call bunnycdn_get_pull_zone_list and then the failing zone-level tool. Tell me the exact ids involved in the failed call and quote the error body. Do not retry it yet.

Bunny.net documents concrete limits that matter for agent traffic shapes: the Logging API is limited to 30 requests per 10 seconds per pull zone, and cache purging uses a token bucket per account per purge type, so bursts of purges throttle. An agent walking statistics across many pull zones is exactly the traffic that meets the logging limit. The response is to shape the work, one zone at a time with pauses, not to retry immediately. If a purge sweep is genuinely needed, staging it across turns is more reliable than one burst.

Ask the agent to diagnose it:

Tell me how many BunnyCDN calls you have made in the last minute and which zones you were walking. Quote any rate-limit or 429 body from the last response. Do not call BunnyCDN again until I reply.

The fixes search results teach for this error are MCP-client-side: server registration, authentication, an empty tools/list response, a Composio Tool Router setting. None of those exist here because the tools come from a hosted runtime. On this setup a missing tool is the lazy-schema timing case: schemas load on demand, so the first BunnyCDN call in a fresh session can arrive before the catalog and needs one retry. If no tools appear after that, the pairing is incomplete, confirm the plugin was installed with --enable, both hermes clawlink begin and hermes clawlink finish ran, and BunnyCDN shows as connected in the dashboard.

Ask the agent to diagnose it:

List the BunnyCDN tools you have access to. If there are none, say so plainly. If there are, tell me which one lists pull zones and use that exact name.

Double-check that the API key for BunnyCDN has the right scopes or account access. A valid key can still be too limited for some reads or writes.

Yes. ClawLink is the fastest way to connect Hermes to BunnyCDN: link your BunnyCDN account once in the browser and Hermes Agent can call the BunnyCDN API through 126 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect BunnyCDN in the dashboard and Hermes can use it from the next message — no config files, and the BunnyCDN key you paste is stored server-side instead of in your environment.

About two minutes. Sign in, click Connect next to BunnyCDN in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual API key setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want BunnyCDN working from chat.

The account API key from your Bunny.net account, not the other two credentials that cause most of the errors in this space. The taxonomy the search engines teach is three keys: the account API key for account-level operations, the Storage Zone password (sometimes called an access key) for storage operations, and the Stream video-library key. This connection is the account API key, pasted once, held server-side. Mistaking a storage zone password for the account key is the single most common setup failure on this provider, and it fails exactly like a typo.

Yes. Purging is the action people actually search for here, the AI Overview teaches it as a raw endpoint call with an AccessKey header, and in this integration it is two real tools: bunnycdn_purge_url for a single URL and bunnycdn_purge_pull_zone for a whole zone. Purging is a write against shared infrastructure, other people's caches, so it goes through the confirmation gate like other writes. The practical pattern the engines describe, an agent purging the cache after a deploy, works here without any of the endpoint plumbing.

Yes, one, and saying so is the point. The AI Overview for the "without api key" query currently answers "not directly, bunny.net requires an API key" and names Composio, Jentic, and Riptides as intermediaries that remove the key from your code. That is exactly the model this page is: the intermediary. What changes with ClawLink is where the key lives and who rotates it. It is pasted once into the dashboard, stored server-side, and disconnecting revokes the agent's use of it immediately. The claim is not "no key exists anywhere", it is "no key exists on your machine".

The engines' answer to this is "yes, generally safe if you use scoped keys, limited permissions, and a secure middle tier", and the hosted connection is the middle tier part done for you. The account API key gives the agent the same reach as your account: it can read billing, statistics, and zone configuration, and it can write, blocked lists, purges, storage zones, so the same judgment applies as any account-level credential. What the hosted flow removes is the failure mode the safety answers actually fear: a key sitting in an environment file on a machine you do not control. Revocation is one click in the dashboard.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.