# Hermetic: Hermes Agent plugin

> Status-bar popover for Hermes Desktop with three views: Costs (spend, cache, pricing drift, OpenRouter provider routing), AAI (skill changes, ratings, tests and replays) and HDR (a guard for risky tool calls, hooks…

Canonical: https://hermeswatcher.com/plugins/hermetic  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/hermetic  
Last updated in catalog: 2026-10-23

Status-bar popover for Hermes Desktop with three views: Costs (spend, cache, pricing drift, OpenRouter provider routing), AAI (skill changes, ratings, tests and replays) and HDR (a guard for risky tool calls, hooks, destinations, sensitive paths, what runs on its own).

## Good to know before installing

Reads this profile's sessions (and other profiles' when you pick them) to audit tool calls, paths and hosts; can edit and save config.yaml and rewrite skill files when you ship or revert a version; AAI replays and judge runs resend conversation context and tool definitions to OpenRouter with your OpenRouter key and incur cost; HDR lists listening TCP ports via ps/lsof; HDR's guard (off by default) checks each tool call through a pre_tool_call hook and, when you turn it on, holds calls Hermes does not check itself (reading keys and logins, writing startup items or key places Hermes does not list) and asks you in its own card or a macOS notification, blocking after up to 20 seconds without an answer or at once when Hermetic is not open, or blocks them outright; the guard is a best-effort match on the paths a call names, not a sandbox; questions from every profile wait in the default profile's hermetic folder; HDR also lists shell and gateway hooks and flags hook scripts edited after approval, keeping a copy of each script to compare.

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.

```bash
hermes plugins install hermetic
```

2. Said no? Turn it on later:

```bash
hermes plugins enable hermetic
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Security & privacy, Hermes Desktop add-ons
- Maintained by: forefy (Community)
- Needs: No API keys declared
- Requires Hermes: `>=0.21.6`
- Version: 1.2.0
- In the catalog since: 2026-10-20, updated 2026-10-23

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/hermetic)
- [Source code](https://github.com/forefy/hermetic#readme)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt