feat: add MCP server visibility panel

[Michaelyklam]

Thinking Path

• Issue Feature request: MCP server management panel with CLI toggle #696 asks for MCP server management visibility in WebUI, including status, tool counts, and eventual enable/disable controls.
• Hermes Agent's current MCP config lives under top-level mcp_servers, and tools.mcp_tool.get_mcp_status() exposes already-known registry status without probing or starting arbitrary MCP processes.
• The safe v1 is therefore read-only: list configured servers, show enabled/active/configured/disabled/invalid states, expose tool counts when already known, and defer toggles until the reload semantics are explicit.
• The UI keeps Hermes WebUI's no-build-step vanilla JS shape and avoids exposing secrets by reusing config masking before rendering.

What Changed

• Expanded GET /api/mcp/servers to include enabled, active, status, tool_count, connect_timeout, toggle_supported: false, and reload_required: true.
• Added safe handling for invalid/non-dict server config entries and bool-ish enabled values, including numeric YAML values like enabled: 0.
• Updated Settings → System → MCP Servers into a read-only visibility panel with transport/status badges, tool counts, enabled/disabled labels, empty/error states, and toggle-deferred messaging.
• Removed mutating add/delete controls from the visible MCP panel for this v1; the existing backend add/delete endpoint tests remain intact.
• Added regression tests for API payload shape, secret masking/status handling, no-server contract, read-only UI rendering, and source-level MCP panel states.

Why It Matters

• Users can now see which MCP servers WebUI knows about and whether Hermes already has them active without manually reading config files.
• The endpoint avoids surprise MCP process startup or live config mutation while still surfacing useful operational state.
• Invalid config is visible as an explicit UI state instead of silently degrading or breaking the settings panel.

Verification

• node --check static/panels.js
• node --check static/i18n.js
• /home/michael/.hermes/hermes-agent/venv/bin/python -m py_compile api/routes.py
• /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_issue538_mcp_management.py tests/test_issue696_mcp_visibility_panel.py tests/test_chinese_locale.py tests/test_japanese_locale.py -q → 44 passed in 2.27s
• git diff --check
• Full isolated suite from the implementation worktree: env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/ -q → 4293 passed, 2 skipped, 3 xpassed, 1 warning, 8 subtests passed in 392.69s
• Browser QA on isolated WebUI server (127.0.0.1:18796) with synthetic MCP config verified configured/disabled rows, masked env/header secrets, tool counts, and read-only notes.

UI media:

Risks / Follow-ups

• Refs Feature request: MCP server management panel with CLI toggle #696 instead of closing it because enable/disable toggles are intentionally deferred until the WebUI and Hermes Agent agree on safe config write + MCP reload semantics.
• Tool counts only reflect already-known runtime status from Hermes Agent; this PR intentionally does not probe, start, or reconnect MCP servers just to count tools.
• Existing backend add/delete handlers remain for compatibility, but the Settings UI does not expose mutating MCP controls in this read-only MVP.

Model Used

• OpenAI Codex gpt-5.5 via Hermes Agent CLI with terminal, file, browser, and kanban tools.

[nesquena-hermes]

Closed by the v0.51.1 release in PR #1681 (merged at e23ba59). Massive thanks @Michaelyklam — this is now 19 merged PRs across the v0.50.292–v0.51.1 release window, an extraordinary contribution rate. Each PR was per-claim-vs-diff verified against your description and every security-relevant code path checked under independent review (Opus advisor, 6/6 questions clean). Your closes #N references are all accurate, your Thinking Path / What Changed / Why It Matters body template is consistently helpful, and your test coverage is solid behavioral scope (not source-string scaffolding) on every PR.

Live on production: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.1

🚀