# Tenuo: Hermes Agent plugin

> Security guardrails for Hermes tool calls: per-call authorization, so a prompt injection cannot make the agent do more than you allowed.

Canonical: https://hermeswatcher.com/plugins/hermes-tenuo  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/hermes-tenuo  
Last updated in catalog: 2026-10-08

Security guardrails for Hermes tool calls: per-call authorization, so a prompt injection cannot make the agent do more than you allowed. Each call is checked against a signed, expiring permission slip (a warrant) before the handler runs, down to the arguments (file paths, search queries, spending limits), and every decision lands in a local audit log. Give cron jobs, delegate_task subagents and gateway users their own policy.

## Good to know before installing

Hermes-tenuo is a no-op until a warrant is configured and blocks every tool call in a kanban worker that has no per-task warrant; it appends every tool call's name and full arguments to $HERMES_HOME/tenuo/audit.jsonl (disable with audit_log: false); when TENUO_CONNECT_TOKEN or TENUO_CONTROL_PLANE_URL are set, the bundled tenuo SDK (compiled Rust core) streams those decisions, including arguments, to that control plane.

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs (this one needs `TENUO_WARRANT`, `TENUO_SIGNING_KEY`), then asks whether to turn it on.

```bash
hermes plugins install hermes-tenuo
```

2. Said no? Turn it on later:

```bash
hermes plugins enable hermes-tenuo
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Security & privacy
- Maintained by: tenuo-ai (Community)
- Needs: `TENUO_WARRANT`, `TENUO_SIGNING_KEY` (API keys)
- Requires Hermes: `>=0.20`
- Version: 0.1.3
- In the catalog since: 2026-10-06, updated 2026-10-08

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/hermes-tenuo)
- [Source code](https://github.com/tenuo-ai/hermes-tenuo)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt