Quickstart

​

Prerequisites

• A working OpenClaw or Hermes Agent install (the host).
• A StandIn account (standin.komaa.com) - the hosted media bridge that joins the Teams call and connects to your plugin. No worker to run. A paid plan is not required to start: the free identity gives you one BYO-bot identity with 5 minutes of call time per day included.
• A Teams identity for the bot. You have two ways to get one, and this is the choice that decides how much Azure work you do:
  • Install StandIn from the Microsoft Teams Store. No Azure app registration, no App ID, no client secret, no endpoint. Add the app, type signin, and connect your agent from the StandIn portal. A Microsoft 365 admin approves calling once for the organization; chat works before that.
  • Bring your own Microsoft Teams bot (an Azure AD app) and connect it to StandIn - see Teams setup to create and upload it. Choose this when the bot must carry your own name and live entirely in your tenant.
  Connection modes compares the two in full.

• A realtime voice provider key (for realtime mode) - e.g. OpenAI or Azure OpenAI. Streaming mode uses your host’s configured STT/TTS instead.

​

Install (one line)

curl -fsSL https://standin.komaa.com/install.sh | bash

irm https://standin.komaa.com/install.ps1 | iex

​

StandIn Managed Bot

curl -fsSL https://standin.komaa.com/install.sh | bash -s -- --connection managed --runtime hermes --secret '<connection secret>'

$env:STANDIN_CONNECTION='managed'; $env:STANDIN_RUNTIME='hermes'; $env:STANDIN_SECRET='<connection secret>'; irm https://standin.komaa.com/install.ps1 | iex

• The secret is the connection secret from the dashboard. The installer never generates one for a managed connection: it is the key StandIn already signs with, so a made-up value would turn both lanes off silently. Leave --secret out and the installer prompts for it (masked), which also keeps it out of your shell history.
• One secret, two lanes. The installer writes the calling lane (9442) and the managed messages lane (9444, --messages-port to change it) into the plugin config, plus the StandIn gateway reply endpoint on Hermes.
• Two funnel mounts. On Tailscale it mounts /msteams/calling -> 127.0.0.1:9442 and /msteams/messages -> 127.0.0.1:9444, then verifies both. The bring-your-own-bot chat lane (/api/messages -> 3978) is not mounted. On ngrok, cloudflared or devtunnel it prints the two mounts for you to make yourself; see Managed bot chat.
• No pairing. The connection already exists, so the installer prints the two values to paste into it in the dashboard: Agent calling URL = your public host (StandIn appends /msteams/calling) and Agent chat URL = https://<your-public-host>/msteams/messages. Restart the runtime as the installer says, and calling switches on once your Microsoft 365 admin approves.

​

Connect your agent by pairing (recommended)

​

Which plan am I on?

​

Verify (optional)

curl -fsSL https://standin.komaa.com/install.sh -o install.sh

less install.sh

bash install.sh

irm https://standin.komaa.com/install.ps1 -OutFile install.ps1

notepad install.ps1

./install.ps1

​

Manual install

openclaw plugins install npm:@komaa/openclaw-msteams-bridge

{
  "plugins": {
    "entries": {
      "msteams-bridge": {
        "config": {
          "enabled": true,
          "mode": "realtime",
          "port": 9442,
          "path": "/msteams/calling",
          "secret": "<same secret as in your StandIn dashboard>",
          "inboundPolicy": "allowlist",
          "allowFrom": ["<caller AAD object id>"],
          "realtime": {
            "provider": "openai",
            "providers": {
              "openai": { "apiKey": "<key>", "model": "gpt-realtime" }
            }
          }
        }
      }
    }
  }
}

uv pip install --python /path/to/hermes/venv/bin/python "hermes-msteams-bridge[documents]"

plugins:
  enabled: [msteams_bridge]
  entries:
    msteams_bridge:
      config:
        secret: ${MSTEAMS_BRIDGE_SECRET}   # must match the secret set in StandIn
        host: 127.0.0.1
        calling_port: 9442
        # Inbound caller policy: Hermes has no `inboundPolicy` key and no
        # pairing mode for calls - the allowlist IS the policy. Empty means
        # deny all inbound callers (set `allow_all: true` to opt out).
        allowlist: ["<caller AAD object id>"]
        realtime:
          backend: azure
          azure_endpoint: https://<your-azure-resource>.cognitiveservices.azure.com
          azure_deployment: gpt-realtime
          api_key: ${AZURE_FOUNDRY_API_KEY}

hermes msteams-bridge serve --handler realtime