Connect agents to MEMIS

Connect to the MEMIS MCP server for me using OpenClaw.

Use this MCP resource:
- https://www.memis-agent.online/api/mcp

OAuth discovery:
- Protected resource metadata: https://www.memis-agent.online/.well-known/oauth-protected-resource/api/mcp
- Authorization server metadata: https://www.memis-agent.online/.well-known/oauth-authorization-server

Use delegated user login with OAuth2 authorization code + PKCE (S256).
Do not use a robot account or service account.

If your MCP client supports protected-resource discovery, start from the MCP URL or the protected resource metadata URL and follow the authentication challenge automatically.

If OpenClaw needs explicit OAuth settings, use:
- issuer: https://sso.memis.online/realms/emis2
- client_id: emis-app-mcp-native
- scopes: openid profile email emis:institution:read emis:student:read emis:hr:read emis:curriculum:read emis:workflow:read

Important:
- Do not write access tokens, refresh tokens, code verifiers, issuer, or client_id back into OpenClaw's mcp.servers.*.oauth config block.
- For OpenClaw, save only the MCP URL, transport, auth: "oauth", and oauth.scope in config, then let `openclaw mcp login` store OAuth state separately.

After connecting, verify the MCP server by:
1. listing tools
2. calling get_access_context
3. if available, calling search_institutions

If login is required, open the browser and let me authenticate as the current EMIS user.

Connect to the MEMIS MCP server for me using Hermes agent.

Use the canonical hosted URLs below exactly as written:
- MCP resource: https://www.memis-agent.online/api/mcp
- Protected resource metadata: https://www.memis-agent.online/.well-known/oauth-protected-resource/api/mcp
- Authorization server metadata: https://www.memis-agent.online/.well-known/oauth-authorization-server

Use delegated user login with OAuth2 authorization code + PKCE (S256).
Do not use a robot account or service account.

Important Hermes compatibility notes:
- Do not rely on dynamic client registration. Use the explicit client_id: emis-app-mcp-native.
- Prefer the canonical www URLs above so Hermes does not get stuck on apex-to-www redirects.
- If Hermes supports explicit auth metadata better than protected-resource discovery, use the authorization server metadata URL above directly.
- Requested scopes: openid profile email emis:institution:read emis:student:read emis:hr:read emis:curriculum:read emis:workflow:read

If Hermes needs an explicit config block, use a shape like:

```yaml
mcp_servers:
  memis-mcp:
    url: "https://www.memis-agent.online/api/mcp"
    auth: oauth
    oauth:
      client_id: "emis-app-mcp-native"
      issuer: "https://sso.memis.online/realms/emis2"
      oauth_metadata_url: "https://www.memis-agent.online/.well-known/oauth-authorization-server"
      scope: "openid profile email emis:institution:read emis:student:read emis:hr:read emis:curriculum:read emis:workflow:read"
      redirect_port: 0
```

After connecting, verify:
1. run `hermes mcp test memis-mcp`
2. confirm the saved config still points to:
   - url: https://www.memis-agent.online/api/mcp
   - issuer: https://sso.memis.online/realms/emis2
   - oauth_metadata_url: https://www.memis-agent.online/.well-known/oauth-authorization-server
3. confirm OAuth token files exist under:
   - C:\Users\Dell Pro PA1420\AppData\Local\hermes\mcp-tokens\memis-mcp.json
   - C:\Users\Dell Pro PA1420\AppData\Local\hermes\mcp-tokens\memis-mcp.meta.json
4. if interactive tool inspection is available inside Hermes, list tools
5. call get_access_context
6. if available, call search_institutions

If login is required, open the browser and let me authenticate as the current EMIS user.