# Secure Env Ingress: Hermes Agent plugin

> One-use HTTPS forms for missing environment secrets, native encrypted Browser Vault logins/TOTP setup keys and payment cards, protected hosted payment-field filling, nested HTTPS verification codes/passcodes, and…

Canonical: https://hermeswatcher.com/plugins/secure-env-ingress  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/secure-env-ingress  
Last updated in catalog: 2026-10-13

One-use HTTPS forms for missing environment secrets, native encrypted Browser Vault logins/TOTP setup keys and payment cards, protected hosted payment-field filling, nested HTTPS verification codes/passcodes, and approved secret operations outside chat and LLM input.

## Good to know before installing

/senv setup supplies a skill using sudo for host packages and TLS setup after approval; the TLS listener binds all interfaces by default; pre_gateway_dispatch observes gateway messages to bind commands to their sender. In interactive Telegram sessions, secure_env_vault saves logins or fills a code field through the captured browser supervisor without explicitly submitting the site form. Explicit parent payment/nested-code targeting requires compatible host task/profile ownership and browser-generation evidence and fails closed without it; this is not a general fix for native Vault named-tab selection. Payment filling requires separate native consent and exact document/control guards; explicit resume requires existing nonempty values to match Vault. Site input callbacks, especially 3-D Secure, may authorize or auto-submit an operation. Unknown outcomes require external verification before retry. secure_operation executes administrator-allowlisted, SHA-256-pinned external Python consumers with gateway privileges; consumers are trusted, not sandboxed, and none are enabled by default. Secret input is not persisted by this mode; consumers must enforce their own handling policy. Links ar

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.

```bash
hermes plugins install secure-env-ingress
```

2. Said no? Turn it on later:

```bash
hermes plugins enable secure-env-ingress
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Web, research & browsing
- Maintained by: web3blind (Community)
- Needs: No API keys declared
- Adds tools: `secure_env_vault`, `secure_payment_fill`, `secure_operation`
- Works on: linux
- Requires Hermes: `>=0.21.7`
- Version: 0.8.1
- In the catalog since: 2026-09-23, updated 2026-10-13

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/secure-env-ingress)
- [Source code](https://github.com/web3blind/hermes-secure-env-plugin/blob/96fac2a1295f51d45466276276af32e6d6059c41/README.md)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt