Gmail and Google Docs for Hermes Agent, with guardrails
Hermes gets your inbox, documents and spreadsheets through one hosted MCP server. You decide what it can read, who it can email and which files it can touch, and it asks you instead of guessing when it hits a limit.
Set up Hermes in 3 steps
- 1
Add FGAC as an MCP server
Add this entry to your Hermes config. Nothing to install: it's a remote server with standard MCP OAuth.# ~/.hermes/config.yaml mcp_servers: fgac: url: https://fgac.ai/api/mcp auth: oauth - 2
Sign in
Start a session (or run the command below). Hermes opens a browser: sign in to FGAC with the Google account you want the agent to use. Finish within a few minutes; if it times out, run the command again.hermes mcp login fgac - 3
Start using it
Restart the session so the tools load, then ask Hermes to “summarize my unread email from today”. It starts read-only. Open your FGAC dashboard to let it send, edit, or see more, and to hide mail it shouldn't read.
Prefer to keep sending and raw Google API writes off? Run hermes mcp configure fgac and untick gmail_send and google_api_modify. FGAC still enforces your rules on whatever stays enabled. Using OpenClaw instead? See the OpenClaw guide.
Why not a full-access Google skill?
The popular Google Workspace skills hand Hermes your whole account. That's a lot to trust to an always-on agent that reads untrusted email all day: one injected instruction is enough to forward your inbox somewhere else.
| What Hermes gets | Full-access skill | FGAC |
|---|---|---|
| Reads, drafts, and edits your Gmail, Docs, and Sheets | ||
| Hides 2FA codes, password resets, and mail you mark sensitive | ||
| Sends only to recipients you whitelisted | ||
| Sees only the files you exposed, not your whole Drive | ||
| Asks you with a one-click approval link instead of failing | ||
| Your Google token never sits on the agent's machine | ||
| Revoke the agent in one click without touching Google |
See every setup option
Free for personal use · full documentation