# Hermes Windows Process: Hermes Agent plugin

> Answer "what is still running, and who started it" on Windows: win_process_table reads the process table (PID, parent PID, image name) and adds each process's image path and creation time, then marks every row with…

Canonical: https://hermeswatcher.com/plugins/hermes-windows-process  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/hermes-windows-process  
Last updated in catalog: 2026-10-25

Answer "what is still running, and who started it" on Windows: win_process_table reads the process table (PID, parent PID, image name) and adds each process's image path and creation time, then marks every row with whether its recorded parent is still the process that spawned it. Windows stores a parent PID rather than a handle, so a child that outlived its parent points at a PID that is either unused or reused by a newer process; a parent that started after its child cannot have spawned it, so both cases are reported as gone or reused instead of a plausible but wrong parent name. Filters cover one PID, several PIDs, a name or path substring, a parent PID, and an orphans-only view of what outlived its parent, with a result cap and an option to leave out Windows session processes. Use it for leftover gateway/backend/server children after a quit, for telling thirty python.exe rows apart by start time, and for checking whether a process started before or after the thing being debugged. Read-only: processes are opened with PROCESS_QUERY_LIMITED_INFORMATION for QueryFullProcessImageName and GetProcessTimes only - no memory reads (command lines are deliberately out of scope), no handle duplication, no writes, no child processes. Stdlib-only (ctypes): no Python dependencies, no network calls, no file writes, no self-update. Windows only.

## Good to know before installing

The tool reports image names, image paths and start times to the model, and those routinely include the user and machine name (C:\Users\<name>\...) and reveal which editor, shell or agent started which process; treat the output like a Task Manager screenshot.

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.

```bash
hermes plugins install hermes-windows-process
```

2. Said no? Turn it on later:

```bash
hermes plugins enable hermes-windows-process
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Coding & developer tools
- Maintained by: Yicheng-Mark (Community)
- Needs: No API keys declared
- Adds tools: `win_process_table`
- Works on: windows
- Requires Hermes: `>=0.21.4`
- Version: 0.1.0
- In the catalog since: 2026-10-25

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/hermes-windows-process)
- [Source code](https://github.com/Yicheng-Mark/hermes-windows-plugins/tree/main/windows-process)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt