Airlock
Guardrails that follow what a conversation has read. Once a session reads untrusted content (a web page, a browser snapshot, an MCP or third-party plugin's output, a customer's message), airlock seals it: messages to anyone but the owner, network writes, pushes and deploys, memory, skill and cron writes, browser input, URLs that could carry data out and code that reaches the network go through Hermes's own approval gate. Walls hold in every session: credential paths and secret files, the guard's own files and Hermes's config, shell startup files, other profiles, commands that switch approvals off. Shell commands are read the way the shell reads them, so a command that computes or hides what it runs (eval, base64 | sh, $G push, wildcards, write-then-run) is refused until written in clear. Subagents inherit the seal. It also catches an injection by its signature: recognized secrets never leave in a call; a private marker in the agent's context locks the session if it shows up in a tool call; a send to an address the untrusted content named is blocked; repeated refusals lock the session; lookalike Unicode in commands is refused. Plugin and MCP tools nobody admitted need approval. Observe mode, stop switch, `hermes airlock check|demo|log`. Tested on a corpus of 251 attacks and everyday commands, and end to end in the official image.
Good to know before installing
Hooks only (pre_tool_call, post_tool_call, pre_llm_call, subagent_start, on_session_reset, post_approval_response), no tools. No network, no LLM call, runs no command. Reads the profile's config.yaml (home channels, approvals mode) and its own policy file (<HERMES_HOME>/airlock.yaml); lists directories to expand wildcards in commands it checks. Writes under plugin-data/airlock: a journal of decisions, taints and approvals that includes tool arguments, truncated (journal.args: none leaves them out), the taint state and the stop switch. When nobody can approve (--yolo, approvals.mode: off, cron set to approve) it blocks instead of letting Hermes auto-approve (policy approvals_off: follow restores Hermes's behaviour). Install scan: caution, because the default policy and the shell reader name the patterns airlock guards against (startup files, crontab, credential commands, exfiltration shapes).
From the plugin's catalog listing.
How to install
- Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install airlock - Said no? Turn it on later:
hermes plugins enable airlock - Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).
- Category
- Security & privacy
- Maintained by
- otsoa-dubief (Community)
- Needs
- No API keys declared
- Needs Hermes
- 0.21.6 or newer
- Version
- 0.2.1
- In the catalog
- 2026-10-24
- GitHub stars
- 11
Full setup & settings ↗Source code ↗
More in security & privacy
All security & privacy plugins
New Hermes Agent updates every day on X. Follow @HermesWatcher