How to connect DigitalOcean to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect DigitalOcean from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

DigitalOcean tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every DigitalOcean call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

The causes the search results teach for this error are the manual route's: the Authorization header must carry Bearer dop_v1_... with the actual token value rather than the token's display name, environment variables pointing at the wrong thing, and "generate a new PAT" as the blunt fix. On a hosted connection the header is handled, so the remaining causes are two. First, the connection's OAuth grant was revoked or expired, which happens when the DigitalOcean account's security settings change, and reconnecting from the dashboard re-runs the consent flow. Second, only some calls fail, which is a permissions shape rather than a token shape. What is not the cause is anything in ~/.hermes or the plugin pairing: the plugin token and the DigitalOcean grant are different credentials, and search answers that conflate them will send you down the wrong path.

Ask the agent to diagnose it:

Call digital_ocean_list_all_droplets to check which account the connection acts as, then quote the exact error from the failed call. If it is an invalid-token error I will reconnect DigitalOcean from the dashboard; do not retry before then.

The causes the search results teach for this error are token-level: a PAT lacking the required scopes, or a team account on a billing hold. In a hosted connection the token-scope cause does not exist, and the real checks are account-level. The connected account must hold the team role the operation needs, and a team with a billing hold gets permission errors across the API even when reads work. Second, the agent may have sent a placeholder or guessed id (like "YOUR_ID" or a droplet id from documentation) instead of a real one: ask it to run digital_ocean_list_all_droplets or digital_ocean_list_all_domains first and retry with a real id from those results. Most 403s at this stage are one of these two, not a ClawLink bug.

Ask the agent to diagnose it:

Run digital_ocean_list_all_droplets and show me the real ids, then quote the exact 403 text from the failed call. Retry with a real id from that list, and if the error mentions billing, tell me before reconnecting.

DigitalOcean rate-limits its API, and an agent walking a large account, every droplet, then every domain, firewall, and database, one call at a time, is exactly the traffic shape that meets the limit. The response is not to retry immediately, which lands in the same window, but to change the shape of the work: use the list tools to page through results instead of fetching one object per call, and have the agent tell you what it intends to enumerate before it starts. If a full audit is genuinely needed, running it in stages across turns is more reliable than one sweep.

Ask the agent to diagnose it:

Tell me how many DigitalOcean calls you have made in the last minute and what you were enumerating. Quote any rate-limit text from the last response. Do not call DigitalOcean again until I reply.

Two different failures. If Hermes shows no DigitalOcean tools at all, the connection or pairing is incomplete: confirm the plugin was installed with --enable, that both hermes clawlink begin and hermes clawlink finish ran, that DigitalOcean shows as connected in the dashboard, and start a fresh chat. If most tools work and a single name fails, that name is wrong rather than missing: the error lists the closest real tools, and the real catalog is one clawlink_list_tools --integration digitalocean away. There is also a first-call timing case unique to this setup: schemas load on demand, so the opening DigitalOcean call in a fresh session can arrive before the catalog and needs one retry. What does not apply is the advice for this symptom that assumes a local MCP init failure, clearing an npx cache and fixing an mcp.json, which is what the search results teach.

Ask the agent to diagnose it:

List the DigitalOcean tools you actually have access to. If there are none, run clawlink_list_integrations and confirm the plugin pair, then tell me what you see. If there are, tell me which one lists droplets and use that exact name.

Try reconnecting DigitalOcean and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

Yes. ClawLink is the fastest way to connect Hermes to DigitalOcean: link your DigitalOcean account once in the browser and Hermes Agent can call the DigitalOcean API through 48 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect DigitalOcean in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

About two minutes. Sign in, click Connect next to DigitalOcean in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want DigitalOcean working from chat.

No. The manual flow teaches generating a Personal Access Token with Write scope, or registering an OAuth app and managing client secrets; the AI Overview answers the 401 query with "generate a new PAT". Here the authorization happens on DigitalOcean's consent screen in the browser and the connection is stored server-side. The engines' insistence that "a credential is always required" is true and is exactly the point: the hosted connection is that credential, so you never generate, paste, or accidentally leak a token, and disconnecting from the dashboard revokes the agent's access immediately.

No. Hosting Hermes means creating a server, running the install script, and managing it yourself, which is the interpretation the search engines assume for "connect digitalocean to hermes". This page is the other meaning: connecting the DigitalOcean account you already have to Hermes so the agent can manage your droplets, domains, and other resources from chat. The two are complementary: you could host Hermes on a Droplet and connect this way on the same account, but the setup on this page is about account access, not server provisioning.

The 48 tools cover the infrastructure surface: droplets and their snapshots, domains and DNS records, firewalls, databases, Kubernetes clusters, load balancers, volumes, SSH keys, and images. The writes to be deliberate about are creating and destroying droplets, firewalls, and domain records, because those are real infrastructure with real cost and availability consequences. Reads, starting with digital_ocean_list_all_droplets and digital_ocean_list_all_domains, are the safe first steps, and the list tools are built for exactly the audit shape an agent should run before touching anything.

The AI Overview answers this query with the usual yes-if-scoped framing, and the hosted setup is the scoped shape: the connection is a single OAuth grant, there is no token to over-scope or leak, and revocation is one dashboard click. The behavioral half is yours and matters more here than on most providers, because the account controls billable infrastructure. Start with reads, require a confirmation step before creating or destroying anything, and treat any fetched content as untrusted input. A droplet deletion is not recoverable from chat.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.