# Vaultknox: Hermes Agent plugin

> Secret-leak protection for Hermes chats.

Canonical: https://hermeswatcher.com/plugins/vaultknox  
Tier: Community  
Official page (Nous Research): https://hermes-agent.nousresearch.com/docs/plugins/vaultknox  
Last updated in catalog: 2026-09-23

Secret-leak protection for Hermes chats. Scans inbound messages and outbound replies for API keys, tokens, and passwords with a 28-pattern detector registry, redacts them before they reach session storage or the user, and injects safe secret-handling rules so the agent never asks for secrets in chat. Zero dependencies, fully offline detection; pairs with the optional hermes-vault CLI for encrypted storage.

## Good to know before installing

Rewrites inbound user messages (regex secret redaction, may false-positive on password-like strings), injects a secret-handling prompt each conversation and rewrites assistant replies that ask for secrets; outbound replies are value-redacted with the same registry (regex-based, so a shape no detector covers passes through), with findings logged as detector name plus SHA-256 fingerprint and never the raw value. The vaultknox tool is inert unless the separate vaultknox pip package is installed, its write gate is a tool argument the model sets, and a vault policy that authorises raw consume_token returns the plaintext to the model.

From the plugin's catalog listing.

## How to install

1. Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.

```bash
hermes plugins install vaultknox
```

2. Said no? Turn it on later:

```bash
hermes plugins enable vaultknox
```

3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see the official page. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide: https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins

## Facts

- Category: Security & privacy
- Maintained by: Ufonik88 (Community)
- Needs: No API keys declared
- Adds tools: `vaultknox`
- Requires Hermes: `>=0.19`
- Version: 0.8.3
- In the catalog since: 2026-09-21, updated 2026-09-23

## Links

- [Full setup and settings (official page)](https://hermes-agent.nousresearch.com/docs/plugins/vaultknox)
- [Source code](https://github.com/Ufonik88/Hermes-VaultKnox/blob/8aea272fd9b071615fcd0c93a38b760485673316/docs/PLUGIN.md)
- [All plugins](https://hermeswatcher.com/plugins.md)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt