hermes mcp add silently absorbs --env KEY=VALUE into args when --env follows --args

[kcidatae]

Summary

hermes mcp add NAME --command CMD --args -y pkg-name --env KEY=VALUE does not error, but it silently treats --env KEY=VALUE as additional positional arguments consumed by the greedy --args ... flag, instead of populating the server's env: block in config.yaml. The resulting stdio subprocess never receives KEY=VALUE as an environment variable — it gets --env and KEY=VALUE appended to its CLI argv instead, which most MCP servers (e.g. @modelcontextprotocol/server-github) will ignore or choke on.

Repro

hermes mcp add github --command npx --args -y @modelcontextprotocol/server-github --env GITHUB_PERSONAL_ACCESS_TOKEN=***

Resulting config.yaml (wrong):

mcp_servers:
  github:
    command: npx
    args:
      - -y
      - '@modelcontextprotocol/server-github'
      - --env
      - GITHUB_PERSONAL_ACCESS_TOKEN=***
    enabled: true

Note there is no env: key at all — GITHUB_PERSONAL_ACCESS_TOKEN is just a literal string tacked onto args, so the server subprocess never sees the token as an environment variable.

Workaround

Put --env before --args (order matters because --args is documented as "must be the last option" but the flag also greedily eats every following token including unrelated flags):

hermes mcp add github --command npx --env GITHUB_PERSONAL_ACCESS_TOKEN=*** --args -y @modelcontextprotocol/server-github

This produces the correct config:

mcp_servers:
  github:
    command: npx
    args:
      - -y
      - '@modelcontextprotocol/server-github'
    env:
      GITHUB_PERSONAL_ACCESS_TOKEN: ***
    enabled: true

Expected behavior

Either:

1. hermes mcp add should parse --env regardless of position relative to --args (argparse subparsers can usually do this if --args uses nargs='...' with an explicit terminator, or if --env is required to come before positional/greedy args — but then the CLI should reject or warn on the wrong order instead of silently misfiling the value), or
2. At minimum, the CLI should warn / refuse when it sees --env-looking tokens (KEY=VALUE pairs preceded by a flag-like string) end up inside args after the fact, since this is a silent data-corruption footgun for credentials specifically.

Environment

• OS: Windows 10 (via git-bash / MSYS)
• Hermes Agent CLI (hermes mcp add)
• Reproduced with multiple stdio servers (@modelcontextprotocol/server-github, should apply to any server needing --env)

[alt-glitch]

This was generated by AI during triage.

Related to #37501: both affect hermes mcp add --env, but this report is the greedy --args ordering case; #37501 is repeated-flag accumulation.