# Tracekit: Hermes Agent plugin

> Tracekit's signer decides every tool call before it runs (deny blocks, ask waits for a person) and signs each call and its outcome into a run you can verify offline.

Canonical: https://hermeswatcher.com/plugins/tracekit  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/tracekit  
Last updated in catalog: 2026-10-27

Tracekit's signer decides every tool call before it runs (deny blocks, ask waits for a person) and signs each call and its outcome into a run you can verify offline.

## Good to know before installing

Every tool call's name and arguments, plus its result (in full for tools Tracekit's policy marks untrusted, otherwise a SHA-256 digest), go to a Tracekit signer: by default a same-user dev signer (`python -m tracekit signer serve --dev`) that the plugin starts on first use as a detached background process, which keeps running after Hermes exits until 15 minutes idle and stores signed runs plus each call's redacted arguments and results (encrypted, kept 7 days) under your user's data directory (~/.local/share/tracekit on Linux), or a remote signer when you set TRACEKIT_SIGNER to an https:// URL. The plugin fails closed: when tracekit-ai can't load or the signer refuses or can't be reached, tool calls are blocked (including every tool an execute_code script calls), and an `ask` decision holds the call until someone approves it in Tracekit or Hermes's hook timeout runs out.

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs (this one needs `TRACEKIT_SIGNER_TOKEN`), then asks whether to turn it on.

```bash
hermes plugins install tracekit
```

2. Said no? Turn it on later:

```bash
hermes plugins enable tracekit
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Coding & developer tools
- Maintained by: Cygnux-Labs (Community)
- Needs: `TRACEKIT_SIGNER_TOKEN` (API key)
- Requires Hermes: `>=0.22.5`
- Version: 0.1.0
- In the catalog since: 2026-10-27

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/tracekit)
- [Source code](https://github.com/Cygnux-Labs/Tracekit/wiki/Integrations-Hermes)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt