Pass Secrets
pass (password-store) secret source: resolves secrets from a local, GPG-encrypted, git-tracked password store into environment variables at startup, as a first-class SecretSource beside the built-in Bitwarden and 1Password sources. Stdlib-only (subprocess + pathlib), no Python deps, no network — ever. Config: secrets.pass.{enabled,store_path,subdirs,override_existing,timeout_seconds}.
Good to know before installing
When enabled, shells out to the local pass binary (10 s per entry) for every .gpg entry under the configured store subdirs and injects each as an env var that by default overrides .env and shell values; when enabled, also adds a ~900-char system-prompt note about secret resolution; no network.
From the plugin's catalog listing.
How to install
- Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install pass-secrets - Said no? Turn it on later:
hermes plugins enable pass-secrets - Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).
- Category
- Security & privacy
- Maintained by
- dyiapanis (Community)
- Needs
- No API keys declared
- Needs Hermes
- 0.21.4 or newer
- Version
- 1.0.0
- In the catalog
- 2026-10-05, updated 2026-10-06
Full setup & settings ↗Source code ↗
More in security & privacy
All security & privacy plugins
New Hermes Agent updates every day on X. Follow @HermesWatcher