Protonpass
Proton Pass secret source: resolves pass://vault/item/field references (mapped source "protonpass") or every env-var-titled item of one vault (bulk source "protonpass_vault") into environment variables at startup through the user's own pass-cli, beside the built-in Bitwarden and 1Password sources, with a hermes protonpass setup/status/token/set/remove/sync/disable CLI. Stdlib-only, no Python deps.
Good to know before installing
When enabled, runs the user-installed pass-cli (argv only, allowlisted env, 30 s per call), which talks to Proton's API; a personal access token or AI-agent token is read from Hermes' env and passed only to the pass-cli login child's environment (never argv); writes a 0700 session dir under cache/protonpass and a 0600 value cache (cache_ttl_seconds: 0 disables); no self-update, no downloaded binaries, no telemetry, no background process.
From the plugin's catalog listing.
How to install
- Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install protonpass - Said no? Turn it on later:
hermes plugins enable protonpass - Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).
- Category
- Security & privacy
- Maintained by
- lucas-nicolas (Community)
- Needs
- No API keys declared
- Needs Hermes
- 0.20.1 or newer
- Version
- 0.1.0
- In the catalog
- 2026-10-16
Full setup & settings ↗Source code ↗
More in security & privacy
All security & privacy plugins
New Hermes Agent updates every day on X. Follow @HermesWatcher