How to connect Intercom to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect Intercom from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

Intercom tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Intercom call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

When the connection is healthy and one action still fails, the problem is authorization, not authentication: the token is fine, the permission is missing. The taught cause order: the connected user's role inside the workspace (teammate permissions decide what they can do, and a restricted teammate fails writes that reads succeed on), then stale OAuth scopes (a grant made before a permission change keeps its old limits, and disconnect then reconnect from the dashboard re-issues it), then the arguments (a placeholder or invented contact or conversation id returns permission-shaped errors because Intercom hides what you cannot see). State which of the three you checked before touching anything else.

Ask the agent to diagnose it:

Call intercom_list_all_admins and intercom_identify_an_admin. Tell me which teammate this connection acts as and whether they have workspace admin rights, then quote the exact error from the failed call. Do not retry it yet.

Two different failures. If Hermes shows no Intercom tools at all, the connection or the pairing is incomplete: confirm both hermes clawlink begin and hermes clawlink finish ran and Intercom shows as connected in the dashboard, then reconnect and start a fresh chat. If most tools work and a single name fails, the name is wrong rather than missing, and the error lists the closest real ones. The cause search results teach for this symptom is a stale client connection or an outdated remote server URL in a local client's config, which does not apply here: there is no local MCP endpoint to update. There is one first-call timing case: schemas load on demand, so the opening Intercom call in a fresh session can arrive before the catalog and needs one retry.

Ask the agent to diagnose it:

List the Intercom tools you actually have access to. If there are none, say so plainly. If there are, tell me which one fetches a conversation and use that exact name.

This is the placeholder-ID trap in its purest form and it is a cause no engine teaches: the agent is calling a real tool with a made-up or copied-from-an-example id. Intercom answers with the same permission-shaped error it uses for genuinely restricted objects, so the failure reads as an authorization problem when the id is simply wrong. Have the agent search first with intercom_list_all_activity_logs or a listing tool to find the real id, or paste the Intercom URL of the conversation or contact into the chat. Only after confirming the id is real should you look at roles or scopes.

Ask the agent to diagnose it:

Find the conversation or contact I am asking about by listing recent items, not by retrying the failed id. Show me the id you intend to use next and the object type it belongs to before you call anything.

Try reconnecting Intercom and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

Yes. ClawLink is the fastest way to connect Hermes to Intercom: link your Intercom account once in the browser and Hermes Agent can call the Intercom API through 133 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect Intercom in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

About two minutes. Sign in, click Connect next to Intercom in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Intercom working from chat.

Intercom now ships its own remote MCP server at mcp.intercom.com/mcp with a browser OAuth login, which is a real hosted option and is what Google's AI Overview now recommends. The tradeoffs to know: it is US-hosted only (an EU variant exists at mcp.eu.intercom.com/mcp), and it exposes roughly 13 core tools that are read and search biased. ClawLink connects to the same Intercom API through hosted OAuth with 133 tools, so the number is not comparable tool for tool; the official server is a thin official slice, this integration is the broader account surface. Pick on where your data is hosted and how many operations you need, not on who hosts the OAuth.

No. The config-file route exists and is what most guides teach: a Composio Connect CLI install, an mcp_servers: block in ~/.hermes/config.yaml, an API key pasted in, a daemon restart. This page's setup replaces all of it: install the plugin once, run hermes clawlink begin and hermes clawlink finish, connect Intercom from the dashboard, and the tools appear in a fresh chat. Nothing about this setup lives in a file Hermes reads at startup.

Conversations and contacts are the core: list, assign, close, and create conversations, create and look up contacts, attach contacts to companies, tag contacts, and read the activity log, admins, articles, collections, companies, help centers, macros, and notes. Writes to flag are conversation assignment and closing, contact creation, tags, and article creation, since those change things customers and teammates see. The read tools are broad enough that most support questions are answerable without writing anything.

The safety answer engines give is a list of guards: strict permission boundaries, prompt-injection awareness, avoiding over-permissioning, PII redaction, and human escalation. This connection satisfies the mechanics: the OAuth grant is scoped to what the tool table on this page shows, conversation content is handled through your connected account rather than stored keys, and revocation from the ClawLink dashboard is immediate. The behavior guardrails are yours: connect an account with the access the agent actually needs, keep draft-mode replies for customer-facing writes, and have the agent flag anything containing PII before it sends it.

Yes, and that is a taught cause rather than a guess. When the connected user's role or the OAuth scopes change, actions that previously worked start failing with permission errors while reads keep working. The fix engines teach and this page agrees with is disconnect and reconnect from the dashboard so the grant is re-issued with current scopes, then start a fresh chat so Hermes picks the refreshed connection up.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.