909 plugins from the official Hermes plugin catalog: 20 official, 9 verified and 880 from the community. 206 were added in the last week. Search, filter by what you want to do, and copy the install command.
72 plugins. Sorted by HermesWatcher's picks: usefulness, polish and trust. Official: made by Nous Research. Verified: listed with a verified maintainer. Community: built by others, so read the source first.
Agent Blackbox
Community
Security for agents: checks every tool call and model request before it runs against a curated, verifiable threat graph (prompt injection, dangerous commands, malicious packages, unsafe skills, phishing and drainer…
Security for agents: checks every tool call and model request before it runs against a curated, verifiable threat graph (prompt injection, dangerous commands, malicious packages, unsafe skills, phishing and drainer indicators) and local rules that keep an agent away from wallet stores, seed phrases, private keys and exchange API keys. Audit mode records; block mode refuses. Can share privacy-safe threat reports with an open community graph once the user turns sharing on (off by default); community findings only ever flag. Hooks only: no tools, no middleware.
Good to know before installing
Hooks see every tool call and model request; `hermes blackbox setup` installs Node (via a checksum-pinned nvm installer) if missing, the OriginTrail DKG node from npm (checksum-pinned) and Blazegraph in Docker or Oxigraph, registers the DKG node and the dashboard as login services (systemd/LaunchAgent), and joins the DKG peer-to-peer network; package installs are looked up on api.osv.dev (name and version); community threat reports signed by a local reporter key (threat identifiers, including domains of fetched pages that served a verified injection) are shared to the community graph only after you turn sharing on (off by default); the optional LLM reviewer sends the current turn's user and tool text to OpenAI or Anthropic; `blackbox attach` copies the plugin into the Hermes homes/profiles and OpenClaw workspaces you name and enables it in their config (automatic attaching is off unless you set `auto_attach: true`); `hermes blackbox chat` creates an `agent-blackbox` profile cloned from the current one (config.yaml and .env); the dashboard runs on 127.0.0.1:9700.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install blackbox
Said no? Turn it on later:
hermes plugins enable blackbox
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Snyk
Official
Scan code (SAST), dependencies, container images, IaC and SBOMs with Snyk through its first-party MCP server (pinned snyk@1.1306.0 over npx stdio, CLI analytics disabled), with the snyk-security-scan workflow skill…
Scan code (SAST), dependencies, container images, IaC and SBOMs with Snyk through its first-party MCP server (pinned snyk@1.1306.0 over npx stdio, CLI analytics disabled), with the snyk-security-scan workflow skill bundled. Portable Agent Plugins v1 package (mcp.json + skills/); needs Node.js/npm on PATH and a free Snyk account (browser login via the snyk_auth tool).
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install snyk
Said no? Turn it on later:
hermes plugins enable snyk
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Rea
Official
Reverse engineer programs with REA (rea.tools): native binaries, .NET assemblies, Electron/JavaScript apps, Android packages, firmware and browser/process activity, through REA's MCP server (pinned rea-agents@6.7.0…
Reverse engineer programs with REA (rea.tools): native binaries, .NET assemblies, Electron/JavaScript apps, Android packages, firmware and browser/process activity, through REA's MCP server (pinned rea-agents@6.7.0 over npx stdio) with REA's reverse-engineer-anything skill adapted for Hermes. Portable Agent Plugins v1 package (mcp.json + skills/); needs Node.js 22.19+/24.11+/26+ on PATH, plus your own Ghidra, Hopper or IDA for native decompilation.
Good to know before installing
A few REA tools run a command under a PTY, launch or drive an application, change a connected Android device or overwrite a chosen file, and Hermes does not prompt before them; the bundled skill tells the agent to ask first and to skip them in unattended runs.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install rea
Said no? Turn it on later:
hermes plugins enable rea
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Instant Context Compactor
Community
Instant context compaction for Hermes Agent: builds the compaction summary in milliseconds with no LLM call, keeping the exact commands, exit codes, errors and files, each linked back to its original message for recall…
Instant context compaction for Hermes Agent: builds the compaction summary in milliseconds with no LLM call, keeping the exact commands, exit codes, errors and files, each linked back to its original message for recall via session_search.
Good to know before installing
No network calls, shell commands or credentials; reads Hermes's config.yaml through Hermes's own loader; subclasses ContextCompressor and relies on its private methods, falling back to the stock compressor if they are missing.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-vcc-engine
Said no? Turn it on later:
hermes plugins enable hermes-vcc-engine
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Entropicmem
Community
Durable local memory for Hermes agents: SQLite FTS5 facts with cited, explainable recall; a Markdown vault with knowledge-graph export and an interactive visual graph.
Durable local memory for Hermes agents: SQLite FTS5 facts with cited, explainable recall; a Markdown vault with knowledge-graph export and an interactive visual graph; and turn-prefetch context injection with reason tokens. Write policy auto-redacts high-confidence secrets at write time (other PII types are warn-only findings) and stored-content injection screening flags and warns on recall and prefetch payloads (flag-and-warn, fail-open by design, not a blocking filter). Includes a 34-command CLI, destructive-op gates with automatic backups, and an append-only audit log.
Good to know before installing
All memory data (vault markdown, memory.db, index.db, backups) stays local under HERMES_HOME/entropicmem/; a shared publish DB defaults to HERMES_HOME/entropicmem-shared/. The CLI init command appends ENTROPICMEM_* settings to HERMES_HOME/.env (append-only). Vector embeddings are off by default; only with embeddings_enabled: true (provider) or ENTROPICMEM_EMBEDDINGS=1 / query --semantic (CLI) and the optional sentence-transformers extra installed does first use download all-MiniLM-L6-v2 weights from huggingface.co; otherwise the provider has no network egress. The CLI ingest command fetches a user-supplied URL; CLI graph export writes to ./export in the cwd by default and its HTML loads D3/marked from d3js.org and cdn.jsdelivr.net when opened; CLI graph serve starts a loopback HTTP server. entropicmem_patch_core edits the plugin's own Core-memory markdown (Persona/User_Profile), not Hermes core, and is off by default.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install entropicmem
Said no? Turn it on later:
hermes plugins enable entropicmem
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Guardrails that follow what a conversation has read. Once a session reads untrusted content (a web page, a browser snapshot, an MCP or third-party plugin's output, a customer's message), airlock seals it: messages to anyone but the owner, network writes, pushes and deploys, memory, skill and cron writes, browser input, URLs that could carry data out and code that reaches the network go through Hermes's own approval gate. Walls hold in every session: credential paths and secret files, the guard's own files and Hermes's config, shell startup files, other profiles, commands that switch approvals off. Shell commands are read the way the shell reads them, so a command that computes or hides what it runs (eval, base64 | sh, $G push, wildcards, write-then-run) is refused until written in clear. Subagents inherit the seal. It also catches an injection by its signature: recognized secrets never leave in a call; a private marker in the agent's context locks the session if it shows up in a tool call; a send to an address the untrusted content named is blocked; repeated refusals lock the session; lookalike Unicode in commands is refused. Plugin and MCP tools nobody admitted need approval. Observe mode, stop switch, `hermes airlock check|demo|log`. Tested on a corpus of 251 attacks and everyday commands, and end to end in the official image.
Good to know before installing
Hooks only (pre_tool_call, post_tool_call, pre_llm_call, subagent_start, on_session_reset, post_approval_response), no tools. No network, no LLM call, runs no command. Reads the profile's config.yaml (home channels, approvals mode) and its own policy file (<HERMES_HOME>/airlock.yaml); lists directories to expand wildcards in commands it checks. Writes under plugin-data/airlock: a journal of decisions, taints and approvals that includes tool arguments, truncated (journal.args: none leaves them out), the taint state and the stop switch. When nobody can approve (--yolo, approvals.mode: off, cron set to approve) it blocks instead of letting Hermes auto-approve (policy approvals_off: follow restores Hermes's behaviour). Install scan: caution, because the default policy and the shell reader name the patterns airlock guards against (startup files, crontab, credential commands, exfiltration shapes).
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install airlock
Said no? Turn it on later:
hermes plugins enable airlock
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Secret-leak protection for Hermes chats. Scans inbound messages and outbound replies for API keys, tokens, and passwords with a 28-pattern detector registry, redacts them before they reach session storage or the user, and injects safe secret-handling rules so the agent never asks for secrets in chat. Zero dependencies, fully offline detection; pairs with the optional hermes-vault CLI for encrypted storage.
Good to know before installing
Rewrites inbound user messages (regex secret redaction, may false-positive on password-like strings), injects a secret-handling prompt each conversation and rewrites assistant replies that ask for secrets; outbound replies are value-redacted with the same registry (regex-based, so a shape no detector covers passes through), with findings logged as detector name plus SHA-256 fingerprint and never the raw value. The vaultknox tool is inert unless the separate vaultknox pip package is installed, its write gate is a tool argument the model sets, and a vault policy that authorises raw consume_token returns the plaintext to the model.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install vaultknox
Said no? Turn it on later:
hermes plugins enable vaultknox
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Diaktoros
Community
Unattended GitHub pull-request review between two Hermes agents: one pushes fixes, a different one reviews, rounds are capped in verdicts, a watchdog reports silent stalls, and the loop never merges.
Unattended GitHub pull-request review between two Hermes agents: one pushes fixes, a different one reviews, rounds are capped in verdicts, a watchdog reports silent stalls, and the loop never merges.
Good to know before installing
Runs unattended Hermes agent turns inside bubblewrap (terminal and file tools, no network, no credentials); a host-side broker and the CLI write to GitHub (reviews, comments, labels, issues, repo webhooks, and opt-in fixer pushes, which may push CI fixes, merge commits of the base into a PR's own branch to resolve conflicts, and issue-fix branches and PRs, including an opt-in auto-fix that hands issues its triage seat labels (never P0-P2, capped per day) to the fixer without a maintainer, plus an opt-in clean merge of the base into a review-only author's same-repository PR branch when it conflicts or falls behind, a branch the loop does not own; it never merges a PR) with repo-scope PAT files you provide; edits Hermes's webhook_subscriptions.json directly and its watchdog re-adds this loop's routes while armed; writes gate scripts into the seat profiles' scripts/ folders and creates one hermes cron job (its migrate command replaces the old hermes-review-loop job and copies that plugin's settings); its backup command writes a 0600 archive of the plugin's state, including webhook route secrets, to a path you choose, and restore writes one back into the Hermes home and recreates the c
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install diaktoros
Said no? Turn it on later:
hermes plugins enable diaktoros
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Offline scam gate. Blocks known-bad links and payments before a tool runs, and asks a human when it cannot see the destination.
Good to know before installing
Blocks agent tool calls that would edit Hermes config/profiles/plugins/hooks or turn approvals off, and with approvals off turns its "ask" into a block (setting when_approvals_off: allow restores asks); keeps its signing key and ask log under ~/.local/state/scamgate and phishing feeds under ~/.cache/scamgate (not per-profile); feeds download only when you run `scamgate update-feeds` (openphish.com, Phishing-Database on GitHub, optional urlhaus); optional SCAMGATE_RDAP=live sends each checked link's domain to its RDAP registry.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install scamgate
Said no? Turn it on later:
hermes plugins enable scamgate
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Ntfy Approval
Community
Answer Hermes' approval prompts from your phone: once selected with security.approval.transport: ntfy, each dangerous-command prompt arrives as an ntfy push notification with Approve once, Approve for session and Deny…
Answer Hermes' approval prompts from your phone: once selected with security.approval.transport: ntfy, each dangerous-command prompt arrives as an ntfy push notification with Approve once, Approve for session and Deny buttons, and no answer still means deny.
Good to know before installing
Once selected, anyone who can read the ntfy topic can approve dangerous commands (the one-time answer codes are in the notification), so on the public ntfy.sh default the topic name is the only secret and NTFY_APPROVAL_TOKEN is optional; each pending approval publishes Hermes' reason, the redacted command (unless send_command is false), the non-default profile name and one-time answer codes to the configured ntfy server, then reads <topic>-reply and deletes the notification; any failure or timeout is a deny; reads NTFY_APPROVAL_TOPIC/NTFY_APPROVAL_TOKEN from the profile .env, never puts the token in a notification, follows no redirects, writes no files and starts no processes.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install ntfy-approval
Said no? Turn it on later:
hermes plugins enable ntfy-approval
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Approval Ledger
Community
Local ledger of Hermes's approval prompts (dangerous commands, protected writes, MCP consent, smart-mode verdicts): /approval-log shows how often each rule asked, how many prompts were approved, denied or left…
Local ledger of Hermes's approval prompts (dangerous commands, protected writes, MCP consent, smart-mode verdicts): /approval-log shows how often each rule asked, how many prompts were approved, denied or left unanswered, and how long a person took to answer, per rule, per surface or per day, for the last 24 hours, any number of hours or days, the latest session or everything recorded; /approval-log recent lists the newest decisions (ten, or up to 100 with /approval-log recent 50).
Good to know before installing
Writes decision metadata (session id, surface, rule label, answer, timings; no command, description or session key) to plugin-data/approval-ledger/approvals.jsonl, trimmed to 5,000 rows past 2 MB; observer only, cannot answer or change an approval; no network
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install approval-ledger
Said no? Turn it on later:
hermes plugins enable approval-ledger
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Aux Ledger
Community
Local ledger of Hermes's auxiliary LLM calls (titling, compression, vision, approval): /aux shows tokens, time and failures per task, model, provider or day, or lists the newest calls (ten, or up to 100 with /aux…
Local ledger of Hermes's auxiliary LLM calls (titling, compression, vision, approval): /aux shows tokens, time and failures per task, model, provider or day, or lists the newest calls (ten, or up to 100 with /aux recent 50), for the last 24 hours, any number of hours or days, the latest session or everything recorded.
Good to know before installing
Writes auxiliary-call metadata (ids, models, timings, token counts, no prompt or response text) to plugin-data/aux-ledger/calls.jsonl, trimmed to 5,000 rows past 2 MB; no network
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install aux-ledger
Said no? Turn it on later:
hermes plugins enable aux-ledger
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Screens user turns and blocks downstream tools on a BLOCK verdict; the original prompt still reaches the model.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install little-canary
Said no? Turn it on later:
hermes plugins enable little-canary
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Teaches Hermes's built-in secret redactor 71 more vendor credential formats (HashiCorp Vault, Doppler, Amazon Bedrock, Atlassian, Cloudflare, Supabase, Tailscale, Docker Hub, JFrog Artifactory, CircleCI, HubSpot, PostHog, Grafana, Sentry, Shopify and others) through register_redaction_patterns, so those tokens are masked in logs, tool output and model-bound text like the built-in ones.
Good to know before installing
Register() makes one call, ctx.register_redaction_patterns; no tools, hooks, network access, subprocesses, files or environment variables; the patterns can only add masks, and security.redact_secrets: false still turns redaction off.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install redaction-pack
Said no? Turn it on later:
hermes plugins enable redaction-pack
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Wait Ledger
Community
Local ledger of the times Hermes stopped to wait for you (approval prompts, clarify questions, password prompts): /waits shows how many waits there were, how many were answered or left unanswered, and how long Hermes…
Local ledger of the times Hermes stopped to wait for you (approval prompts, clarify questions, password prompts): /waits shows how many waits there were, how many were answered or left unanswered, and how long Hermes stood still in total, typically and at most, per kind of prompt, per platform or per day, for the last 24 hours, any number of hours or days, the latest session or everything recorded; /waits recent lists the newest waits (ten, or up to 100 with /waits recent 50).
Good to know before installing
Writes wait metadata (session id, platform, kind of prompt, how it ended, wait time; no prompt text, answer or session key) to plugin-data/wait-ledger/waits.jsonl, trimmed to 5,000 rows past 2 MB; observer only, cannot answer, delay or change a prompt; no network
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install wait-ledger
Said no? Turn it on later:
hermes plugins enable wait-ledger
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Aichipmunk
Community
Pairs this machine's Hermes bots with the AI Chipmunk mobile app from inside Hermes Desktop — pick a bot, get the reachable host, profile and API key as a scannable code.
Pairs this machine's Hermes bots with the AI Chipmunk mobile app from inside Hermes Desktop — pick a bot, get the reachable host, profile and API key as a scannable code. Registers a `hermes aichipmunk` CLI command, a desktop page and a dashboard API; no tools or hooks.
Good to know before installing
On an explicit confirmed "Switch to Tailscale" it adds a persistent tailscale serve handler putting the API server's own port (plain HTTP inside the tailnet, API_SERVER_KEY auth) onto the tailnet; on a machine with no Tailscale CLI it instead runs hermes config set platforms.api_server.host <tailnet IP> on the owning profile and restarts that gateway; reads API_SERVER_KEY from every profile's .env on this machine on each status poll (masked in lists, the full key only in the pairing link and QR returned to an authenticated dashboard caller, which may be the phone over a published dashboard); shells out to the tailscale and hermes CLIs and probes only this machine's own /health; no third-party network calls.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install aichipmunk
Said no? Turn it on later:
hermes plugins enable aichipmunk
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Pcs Security Tls Posture
Community
Read-only audit of local TLS posture — certificate validity, key strength, deprecated protocols, weak cipher suites, and the certificate each server's configuration points at.
Read-only audit of local TLS posture — certificate validity, key strength, deprecated protocols, weak cipher suites, and the certificate each server's configuration points at.
Good to know before installing
Reads a fixed list of system certificate and nginx/Apache config paths under / (or a caller-supplied prefix); makes no network connections and runs no subprocesses. If the sibling plugin pcs-security-core is installed, its copy of the shared contract is loaded in preference to the bundled one.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install pcs-security-tls-posture
Said no? Turn it on later:
hermes plugins enable pcs-security-tls-posture
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Add custom dangerous command patterns to Hermes's built-in approval system. Users define regex patterns in YAML; a pre_tool_call hook sends block patterns to Hermes's human approval gate and blocks deny patterns immediately. Modifies no Hermes internals.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install custom-dangerous-patterns
Said no? Turn it on later:
hermes plugins enable custom-dangerous-patterns
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Observability + budget guardrails for Hermes Agent — tokens, cost, latency, tool calls per session and cron job. Persists to local SQLite. Exposes /stats and /budget slash commands.
Good to know before installing
Records per-session tokens, cost, latency, tool names and sender/profile ids (no message text) in ~/.hermes/telemetry/telemetry.db; fetches public model pricing from openrouter.ai/api/v1/models on first load and at most once a day; in the default enforce mode first load writes a $5/day, $100/month global budget to telemetry/budget.yaml, and a hard breach blocks every tool call and pauses the over-budget cron job until the window resets (set plugins.entries.hermes-telemetry.settings.mode: observe to record without enforcing); the optional standalone dashboard server binds 127.0.0.1 with no auth.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-telemetry
Said no? Turn it on later:
hermes plugins enable hermes-telemetry
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Pass Secrets
Community
pass (password-store) secret source: resolves secrets from a local, GPG-encrypted, git-tracked password store into environment variables at startup, as a first-class SecretSource beside the built-in Bitwarden and…
pass (password-store) secret source: resolves secrets from a local, GPG-encrypted, git-tracked password store into environment variables at startup, as a first-class SecretSource beside the built-in Bitwarden and 1Password sources. Stdlib-only (subprocess + pathlib), no Python deps, no network — ever. Config: secrets.pass.{enabled,store_path,subdirs,override_existing,timeout_seconds}.
Good to know before installing
When enabled, shells out to the local pass binary (10 s per entry) for every .gpg entry under the configured store subdirs and injects each as an env var that by default overrides .env and shell values; when enabled, also adds a ~900-char system-prompt note about secret resolution; no network.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install pass-secrets
Said no? Turn it on later:
hermes plugins enable pass-secrets
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Read-only status and peer list for a WireGuard server running on the same Windows machine as Hermes. Two tools: vpn_status (service state, tunnel address and port, server public key, per-peer handshake and transfer) and vpn_peers (the peer list only). The plugin runs only wg.exe show, sc.exe query, and one PowerShell adapter lookup; it never changes the tunnel and never reads the tunnel configuration file or any private key material. Windows only (WireGuard for Windows).
Good to know before installing
Runs local wg.exe show, sc.exe query and one PowerShell Get-NetIPAddress lookup (read-only, never touches the tunnel config or private key); tool results put peer public keys, allowed IPs and peer endpoint IP addresses into the conversation sent to your model provider.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install wireguard
Said no? Turn it on later:
hermes plugins enable wireguard
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
TypeSafe's Jev decision model as Hermes' smart-approval reviewer only: it cannot generate text and refuses every other task. Supports TypeSafe direct, OpenRouter, and configurable Jev-compatible HTTPS endpoints with optional endpoint-specific authentication; validates typed answers and endpoint/redirect boundaries, redacts command credentials, and records bounded structured audit logs.
Good to know before installing
Each command routed to smart approval (redacted best-effort) and the operator's smart-policy text leave the machine for the configured third-party endpoint; provider or validation failures fail closed to ESCALATE.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs TYPESAFE_API_KEY), then asks whether to turn it on.
hermes plugins install jev-approvals
Said no? Turn it on later:
hermes plugins enable jev-approvals
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Search archived coding conversations and retrieve exact session revisions through the separately installed Agent Vault macOS app. Launches the app's existing MCP server through sh; reads the authorized archive through its local daemon. Vault handles storage-provider traffic. No bundled binaries, telemetry, credential-file reads, self-updater, or new background service.
Good to know before installing
Launches the separately installed Agent Vault app's own bundled Node MCP server (/Applications/Agent Vault.app or VAULT_APP_PATH) through sh with your VAULT_MCP_TOKEN binding token; that server code ships with the app, not in this repository. Its tools return archived conversations from Cursor, Codex, Claude Code and Hermes stored under ~/.vault (or VAULT_HOME) into the model's context, which is sent to your model provider. The app handles its own storage-provider traffic; the plugin adds no telemetry, network calls, credential-file reads or background service.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs VAULT_MCP_TOKEN), then asks whether to turn it on.
hermes plugins install agentvault
Said no? Turn it on later:
hermes plugins enable agentvault
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Context and control for any AI. Agent identity, scoped access, and proof across tools.
Good to know before installing
Skills-only package: its workflow skills steer the agent to Proofable's hosted MCP server at mcp.proofable.me (which you add yourself with `hermes mcp add … --auth oauth`) to check identity proofs and agent permissions, create wallet-signed proofs, and store, list or revoke secrets in Proofable's hosted vault, so secrets you store and proof/agent data go to Proofable; Hermes does not prompt before those MCP tools run unless you give the server a trust setting; the skills also suggest Proofable's own optional `proofable` CLI, which edits MCP/project config.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install proofable-mcp
Said no? Turn it on later:
hermes plugins enable proofable-mcp
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Protonpass
Community
Proton Pass secret source: resolves pass://vault/item/field references (mapped source "protonpass") or every env-var-titled item of one vault (bulk source "protonpass_vault") into environment variables at startup…
Proton Pass secret source: resolves pass://vault/item/field references (mapped source "protonpass") or every env-var-titled item of one vault (bulk source "protonpass_vault") into environment variables at startup through the user's own pass-cli, beside the built-in Bitwarden and 1Password sources, with a hermes protonpass setup/status/token/set/remove/sync/disable CLI. Stdlib-only, no Python deps.
Good to know before installing
When enabled, runs the user-installed pass-cli (argv only, allowlisted env, 30 s per call), which talks to Proton's API; a personal access token or AI-agent token is read from Hermes' env and passed only to the pass-cli login child's environment (never argv); writes a 0700 session dir under cache/protonpass and a 0600 value cache (cache_ttl_seconds: 0 disables); no self-update, no downloaded binaries, no telemetry, no background process.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install protonpass
Said no? Turn it on later:
hermes plugins enable protonpass
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Hermes is waiting — full Desktop page for pending approvals. Queue, chip, OS notify. Redacted previews only. No API keys.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install needs-you
Said no? Turn it on later:
hermes plugins enable needs-you
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Hermes Trove
Community
DAG-based context engine that never loses a message — full-text search, semantic recall, assertion-backed evidence compilation, and pre-answer sufficiency gating Disclosure — replaces the context engine and stores…
DAG-based context engine that never loses a message — full-text search, semantic recall, assertion-backed evidence compilation, and pre-answer sufficiency gating
Good to know before installing
Replaces the context engine and stores every turn's full raw transcript in HERMES_HOME/trove.db with secret redaction OFF by default; with TROVE_EMBEDDING_PROVIDER=voyage, transcript text is sent to Voyage AI for embeddings; as a fallback it reads private AIAgent attributes read-only via frame inspection. No other network egress.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs TROVE_ENABLE_SLASH_COMMAND), then asks whether to turn it on.
hermes plugins install hermes-trove
Said no? Turn it on later:
hermes plugins enable hermes-trove
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
TypeSafe Jev semantic governance for Hermes' native Curator: classifies relationships between complete skill packages, produces content-hash-bound, fail-closed consolidation plans, and locally guards background destructive skill_manage calls while Hermes retains control of backups and mutations. A profile-scoped 60-second lifecycle debounce coalesces skill changes into dry refreshes.
Good to know before installing
No egress occurs by default; after allow_content_egress is explicitly enabled, redacted bounded skill content is sent to the configured TypeSafe, OpenRouter, or custom Jev endpoint and may spend provider credits. Automatic refreshes never apply mutations, and missing, stale, or incomplete evidence fails closed.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install jev-curator
Said no? Turn it on later:
hermes plugins enable jev-curator
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Llm Antidote
Community
Runtime guardrails, behavioral evaluation, and signed fleet admission for Hermes Agent: a versioned capability policy that blocks or requires approval for model tool calls, paired synthetic behavioral evaluation with…
Runtime guardrails, behavioral evaluation, and signed fleet admission for Hermes Agent: a versioned capability policy that blocks or requires approval for model tool calls, paired synthetic behavioral evaluation with no real side effects, and a signed local promotion gate that refuses a model whose evidence does not satisfy signed fleet policy. Hooks-only (no agent tools).
Good to know before installing
Adds approval prompts to tool calls by default (balanced mode): every MCP, connector or other-plugin tool, memory and skill writes, file reads outside the working and temp directories, and network-capable terminal/code commands go to Hermes's approval prompt; strict mode blocks them instead, and opt-in enforced fleet mode blocks all tool calls until the served model name matches the admitted one. The user-run `hermes antidote eval run` command sends synthetic prompts (and the API key you name) to the OpenAI-compatible endpoint you pass, as billed model calls (default suite up to ~170 requests); `model inspect hf:` queries huggingface.co; `fleet keygen` writes unencrypted Ed25519 private keys (mode 0600) to paths you choose.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install llm-antidote
Said no? Turn it on later:
hermes plugins enable llm-antidote
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install vaultwarden
Said no? Turn it on later:
hermes plugins enable vaultwarden
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Static review of candidate Hermes plugins; target code is never executed.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-plugin-guard
Said no? Turn it on later:
hermes plugins enable hermes-plugin-guard
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Hermes Structured Aux Models
Community
Routes selected Hermes auxiliary tasks (approval, MCP sampling, compression) through bounded Jev decision calls on OpenRouter instead of free-form chat prompts, failing open to the operator's own auxiliary provider for…
Routes selected Hermes auxiliary tasks (approval, MCP sampling, compression) through bounded Jev decision calls on OpenRouter instead of free-form chat prompts, failing open to the operator's own auxiliary provider for anything it cannot express as a decision.
Good to know before installing
Sends redacted approval prompts, MCP tool names and compression transcript blocks to openrouter.ai using your OpenRouter key (read-only); on any error approvals escalate to you, never auto-approve; the default decision_model is a moving alias, pin it.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Security guardrails for Hermes tool calls: per-call authorization, so a prompt injection cannot make the agent do more than you allowed. Each call is checked against a signed, expiring permission slip (a warrant) before the handler runs, down to the arguments (file paths, search queries, spending limits), and every decision lands in a local audit log. Give cron jobs, delegate_task subagents and gateway users their own policy.
Good to know before installing
Hermes-tenuo is a no-op until a warrant is configured and blocks every tool call in a kanban worker that has no per-task warrant; it appends every tool call's name and full arguments to $HERMES_HOME/tenuo/audit.jsonl (disable with audit_log: false); when TENUO_CONNECT_TOKEN or TENUO_CONTROL_PLANE_URL are set, the bundled tenuo SDK (compiled Rust core) streams those decisions, including arguments, to that control plane.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs TENUO_WARRANT, TENUO_SIGNING_KEY), then asks whether to turn it on.
hermes plugins install hermes-tenuo
Said no? Turn it on later:
hermes plugins enable hermes-tenuo
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Desktop fleet page plus a per-bot Home (status, metrics, alerts, tasks, routines, buttons) published by the bot as JSON.
Good to know before installing
Reads each local profile's home files, can run a declared cron routine from the UI on that bot's profile and credentials, and opens chat, a path, or a URL the bot declared; send_prompt buttons send the shown prompt into the bot's Bot Chat. Bot-declared run_action buttons run a script from the bot's home/actions/ folder: a script runs only after the user approves that exact file (SHA-256), is re-approved if it changes, and is limited to 30s and to that folder, but it runs as your user with the Hermes backend's full environment, including provider keys loaded for the profile Hermes was launched with. Approvals are kept under the Hermes root in bot-hq/approvals/. The `hermes hermes-bot-hq setup` command (asks first unless --yes) links the plugin into every profile's plugins folder and enables it there. No database, signup, or telemetry.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-bot-hq
Said no? Turn it on later:
hermes plugins enable hermes-bot-hq
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Bot Activity
Community
Live per-Bot activity timeline for Hermes Desktop: turns, tool calls (arguments, result, duration), approvals and Group Chat streams, grouped by Bot or by Group Chat, with one-click tracking for new Bots.
Live per-Bot activity timeline for Hermes Desktop: turns, tool calls (arguments, result, duration), approvals and Group Chat streams, grouped by Bot or by Group Chat, with one-click tracking for new Bots.
Good to know before installing
Local only, no network or telemetry; records every Bot profile's turns, assistant replies, tool arguments and results, approval commands and Group Chat streams (redacted with agent.redact, capped per field, 3-day / 20k-row retention) into one SQLite file shared by all profiles under plugin-data/bot-activity; reads each Bot profile's state.db, profile.yaml and config.yaml read-only; Track now / Update runs `hermes -p <bot> plugins install <same source> --ref <same sha> --enable --yes-deps` (or copies the plugin and runs `plugins enable`) in the Bot profiles you track, never re-enabling one you disabled.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install bot-activity
Said no? Turn it on later:
hermes plugins enable bot-activity
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Status-bar chip showing the provider balance and runway tracked by the MIT burnclock CLI, read from its local badge cache. Requires the CLI (pip install burnclock); the plugin makes no network calls and reads no credentials.
Good to know before installing
Runs a read-only shell command (cat of burnclock's local cache file) in your active local session every 60 seconds; balances come from the separately installed burnclock CLI (PyPI `burnclock`), which you configure with your provider keys and run yourself.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install burnclock
Said no? Turn it on later:
hermes plugins enable burnclock
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
LDAP / Active Directory password login for the web dashboard. Verifies credentials with an LDAP bind (direct or search-then-bind), never stores passwords, requires ldaps:// or StartTLS, and supports group restriction. Registers the `ldap` dashboard auth provider once dashboard.ldap_auth is configured.
Good to know before installing
Dashboard logins are verified by binding to your configured LDAP/AD server with the user's password (TLS with certificate validation required unless allow_insecure is set); sessions are stateless HMAC tokens (12h access / 30d refresh by default) signed with HERMES_DASHBOARD_LDAP_SECRET or a random per-process key, and logout cannot revoke them; group removal and disabled accounts are not re-checked until the refresh token expires; failed logins count toward the directory's account-lockout policy.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install dashboard-auth-ldap
Said no? Turn it on later:
hermes plugins enable dashboard-auth-ldap
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Native Beads (bd) work-graph plugin: fixed-argv adapter, scoped ready frontier, claim with read-back, guarded writes. Six tools over an explicit store path + actor; honest exit-code map incl. stale-13; plain bd stays fully sufficient (escape hatch). No desktop pane ships yet.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-beads
Said no? Turn it on later:
hermes plugins enable hermes-beads
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Microsoft-Decision-1 (Azure AI Foundry System One) decision provider for bounded agent decisions. Registers typed-decision tools (decision_noul, decision_choice, decision_score, decide) that preserve full probability distributions, plus an opt-in pre_tool_call hook that requests human approval for known-risk calls without sending their arguments to Azure. Reference implementation of the typed decision-provider runtime in #113008.
Good to know before installing
The four decision tools send the caller-supplied state/questions text to the Azure Foundry endpoint you set in AZURE_FOUNDRY_BASE_URL (nothing is sent while it is unset); with MS_DECISION_GATE=1 the pre_tool_call gate sends only a coarse operation label for known-risk tool calls to that endpoint and routes them to Hermes's human approval prompt (MS_DECISION_GATE_MODE=block hard-denies instead); the labelled eval corpus under tests/ contains literal destructive commands as should-refuse examples.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs AZURE_FOUNDRY_API_KEY, AZURE_FOUNDRY_BASE_URL), then asks whether to turn it on.
hermes plugins install ms-decision-provider
Said no? Turn it on later:
hermes plugins enable ms-decision-provider
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Read-only Desktop model map for main, auxiliary, sub-agent and MoA routes.
Good to know before installing
Reads the selected profile's full config.yaml through the host's `config.get` (the response includes any credential fields it holds); only model-routing fields are kept and nothing is stored or sent off the machine.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install profile-models
Said no? Turn it on later:
hermes plugins enable profile-models
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Surp Hermes X402 Llm
Community
Marketplace-aware LLM routing for Surp — live prices for all models, provider TPS and trusted flags, mid-chat seller switching, secret masking, and approval-gated paid chat.
Marketplace-aware LLM routing for Surp — live prices for all models, provider TPS and trusted flags, mid-chat seller switching, secret masking, and approval-gated paid chat.
Good to know before installing
The messages passed to surp_chat and SURP_API_KEY go to the surp.ivc.lol gateway, run by the individual developer ivcained (operator page https://surp.ivc.lol/operator, terms https://surp.ivc.lol/terms; not affiliated with Surplus Intelligence), which forwards them to third-party sellers on the Surplus Intelligence marketplace, including sellers not flagged trusted unless trusted_only is set; paid surp_chat calls spend from the user's prepaid Surp balance (USDC on Base, 5 % gateway markup), each behind a per-model Hermes approval prompt (denied in cron and other unattended runs by default) plus a per-request ceiling (max_spend_usd, default $0.05); the price, provider, quote, combo and cache tools call the same gateway without a key; routing preferences are stored under HERMES_HOME/cache/surp-hermes-x402-llm/.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs SURP_API_KEY), then asks whether to turn it on.
hermes plugins install surp-hermes-x402-llm
Said no? Turn it on later:
hermes plugins enable surp-hermes-x402-llm
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Degeneracy Guard
Community
Asks the user to confirm a tool call whose arguments look like a repetition loop rather than data, through Hermes' approval gate (denied or unanswered means refused).
Asks the user to confirm a tool call whose arguments look like a repetition loop rather than data, through Hermes' approval gate (denied or unanswered means refused); replaces flagged degenerate output with a short notice; warns when a session grows long.
Good to know before installing
No network, shell, subprocesses, own threads, telemetry or credentials; writes incident records and a session counter to its plugin data directory; a stream-side record keeps the last 800 characters of flagged output.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install degeneracy-guard
Said no? Turn it on later:
hermes plugins enable degeneracy-guard
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Secret source plugin that resolves environment variables from an Infisical secret store (cloud or self-hosted) at Hermes startup. Registers a mapped source ("infisical", inf:// references) and a bulk source ("infisical_bulk").
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install infisical
Said no? Turn it on later:
hermes plugins enable infisical
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Route a task to the right (model, reasoning effort) arm before you start. Classifies the task into a lane, prints a provenance-carrying route card, and installs per-model reasoning-effort defaults. Strong rules run locally; weak-signal classification calls the host LLM and consumes tokens. The separate harness and shim can make paid provider calls when explicitly run; no plugin-owned credentials.
Good to know before installing
Weak-signal task classification sends the task text to your active Hermes model via the host LLM facade (token cost). The model-callable tool, /route, /rate and observed /model and /reasoning commands append task text and command args to a local ledger at <HERMES_HOME>/evalroute/labels.jsonl. "hermes evalroute install-routes" rewrites agent.reasoning_overrides in config.yaml when you run it. The bundled harness and Hermes shim are never run by the plugin. When run by hand they make paid provider calls, execute model-generated code on the host via shell checkers, and run hermes -z with approvals bypassed. Disclosure — "hermes evalroute sync" (run by hand) downloads the route table from the Hugging Face dataset keppy/evalroute-flywheel into HERMES_HOME and route cards then show that dataset's text; "hermes evalroute dispatch" (run by hand) spawns a single-query hermes chat on the routed model (Nous provider by default) — or, with --runner claude-code, a `claude -p` (Claude Code) process under the user's own Claude account, whose per-run cost is recorded in the local sidecar — with the brief as its query, inheriting the current environment except HERMES_YOLO_MODE (the worker never inh
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install evalroute
Said no? Turn it on later:
hermes plugins enable evalroute
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Hermes Wincred
Community
Resolve Hermes environment variables from the current user's Windows Credential Manager at startup, instead of keeping provider keys in plaintext in .env or auth.json.
Resolve Hermes environment variables from the current user's Windows Credential Manager at startup, instead of keeping provider keys in plaintext in .env or auth.json. Config is secrets.wincred.map, an ENV_VAR -> generic-credential-target mapping (bare names or wincred:// names); each value is read with CredReadW in the current user's vault and handed to the secret-source orchestrator, which applies it with the usual precedence, provenance and conflict rules. Values may be UTF-8 or UTF-16LE (cmdkey and the Credential UI write UTF-16); anything that does not decode to text, or that contains interior NULs, is skipped with a warning instead of being injected as a mangled key.
Good to know before installing
This source reads your Windows Credential Manager: only the generic credentials named in the map, with no enumeration of the vault. Resolved values become environment variables of the Hermes process and its children, exactly like .env entries, so anything that can read that environment can see them. The package is read-only and stdlib-only (ctypes): it never creates, updates or deletes credentials, writes no files, starts no subprocesses, makes no network calls and does not self-update. Windows only. Credential Manager is user-scoped, so this raises the at-rest bar for backups, cloud sync and dotfiles; it is not a boundary against code already running as the same user. Applying fetched values stays the orchestrator's job; the plugin never writes os.environ itself. Disclosure — when enabled, reads only the Windows Credential Manager generic credentials named in secrets.wincred.map (no vault enumeration) and injects them as environment variables of the Hermes process and its children, exactly like .env entries; read-only, stdlib ctypes, no subprocesses, no network, no file writes; user-scoped at-rest protection, not a boundary against code already running as the same user.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-wincred
Said no? Turn it on later:
hermes plugins enable hermes-wincred
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Hermetic
Community
Status-bar popover for Hermes Desktop with three views: Costs (spend, cache, pricing drift, OpenRouter provider routing), AAI (skill changes, ratings, tests and replays) and HDR (a guard for risky tool calls, hooks…
Status-bar popover for Hermes Desktop with three views: Costs (spend, cache, pricing drift, OpenRouter provider routing), AAI (skill changes, ratings, tests and replays) and HDR (a guard for risky tool calls, hooks, destinations, sensitive paths, what runs on its own).
Good to know before installing
Reads this profile's sessions (and other profiles' when you pick them) to audit tool calls, paths and hosts; can edit and save config.yaml and rewrite skill files when you ship or revert a version; AAI replays and judge runs resend conversation context and tool definitions to OpenRouter with your OpenRouter key and incur cost; HDR lists listening TCP ports via ps/lsof; HDR's guard (off by default) checks each tool call through a pre_tool_call hook and, when you turn it on, holds calls Hermes does not check itself (reading keys and logins, writing startup items or key places Hermes does not list) and asks you in its own card or a macOS notification, blocking after up to 20 seconds without an answer or at once when Hermetic is not open, or blocks them outright; the guard is a best-effort match on the paths a call names, not a sandbox; questions from every profile wait in the default profile's hermetic folder; HDR also lists shell and gateway hooks and flags hook scripts edited after approval, keeping a copy of each script to compare.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermetic
Said no? Turn it on later:
hermes plugins enable hermetic
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
past.dev memory provider: recall before each turn from source-traced memory of past conversations, with sessions sent to past.dev when they end. Maintained by past.dev.
Good to know before installing
The user's message (as the recall query) and each session's user and assistant text, with common secret shapes redacted, are sent to the past.dev API (api.past.dev by default, or the address you configure) under your past project key, with a past-hermes/<version> User-Agent; the key and identity are read from PAST_API_KEY or ~/.past/config.json, which past.dev's other connectors share; off by default on messaging-gateway sessions.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install pastdotdev
Said no? Turn it on later:
hermes plugins enable pastdotdev
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Local Presidio-based PII pseudonymization for Hermes model requests and tool results with an encrypted profile-scoped alias vault.
Good to know before installing
PII detection runs locally with Presidio and the spaCy en_core_web_lg model, which you install manually; alias mappings are stored encrypted in the Hermes plugin DB under HERMES_PRIVACY_GATEWAY_KEY; requests are blocked when the engine cannot load; tools outside rehydrate_tool_allowlist receive alias tokens, not plaintext.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs HERMES_PRIVACY_GATEWAY_KEY), then asks whether to turn it on.
hermes plugins install privacy-gateway
Said no? Turn it on later:
hermes plugins enable privacy-gateway
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Look a paid x402 or MPP URL up in vet402's public record of real purchases before the agent pays it. BLOCK stops the tool call. ALLOW, and a WARN that only says vet402 has not bought there yet, let it run. Any other WARN, a URL with no record for the paying HTTP method, and a vet402 outage ask for approval, and the call is refused when nobody can answer (yolo, approvals off, cron). vet402 only knows endpoints in public x402 and MPP discovery, so an unlisted URL asks. By default only mpp_fetch is checked, and a payment made inside Hermes HTTPX traffic is not seen.
Good to know before installing
Sends each guarded or model-queried URL (scheme, host, port and path; userinfo, query and fragment stripped) and its HTTP method to vet402.com in up to two HTTPS GETs; a missing record or a vet402 outage asks for approval and is refused when nobody can answer, unless VET402_UNKNOWN=allow lets it pay; while enabled, its skill adds one line to the skills index of every session.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install vet402
Said no? Turn it on later:
hermes plugins enable vet402
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Darkmoon
Community
Triage the findings file of a Darkmoon autonomous pentest scan (JSON or SARIF): filter by severity and proof status, get a severity-sorted summary and a pass/fail gate for a release.
Triage the findings file of a Darkmoon autonomous pentest scan (JSON or SARIF): filter by severity and proof status, get a severity-sorted summary and a pass/fail gate for a release. Read-only and offline: no network, no subprocess, no credentials, standard library only. Darkmoon is open source (GPL-3.0); its web dashboard and remediation agent are Pro and are not used here.
Good to know before installing
Reads a local .json or .sarif file at a model-supplied path (10 MB cap) and returns its findings; no network, subprocess or writes
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install darkmoon
Said no? Turn it on later:
hermes plugins enable darkmoon
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Runs agent commands in billable DeepInfra cloud sandboxes and uploads your Hermes skills, cache and skill-registered credential files to the sandbox at /workspace/.hermes; dangerous-command approval is skipped inside the sandbox.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs DEEPINFRA_API_KEY), then asks whether to turn it on.
hermes plugins install deepinfra-sandbox
Said no? Turn it on later:
hermes plugins enable deepinfra-sandbox
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Signed, independently checkable receipts for Hermes approval verdicts and, since 0.2.0, for turns that stop on iteration exhaustion. Observe-only: a post_approval_response hook requests an invinoveritas decision receipt for each Guardian LLM verdict (or every approve/deny with scope=all); post_llm_call + on_session_end record, when a turn ends with max_iterations_reached, whether the turn's todo ledger (the last todo result or the list re-injected after compaction) was complete (turn_scope: exhausted by default, all, or off). Each receipt is a signed set of salted commitments that anyone can check for free at /verify-proof and that the holder can later open with the salt kept locally. Never approves, denies, delays, continues or blocks anything.
Good to know before installing
One HTTPS POST per recorded approval decision or recorded turn to api.babyblueviper.com/decision-receipt (or the configured api_url) under INVINOVERITAS_API_KEY, paid automatically at 100 sats per receipt from your invinoveritas balance with no per-call confirmation (defaults: Guardian LLM verdicts, and only turns that stop on max_iterations_reached; scope: all adds every human approve/deny, turn_scope: all pays on every turn); sends a fixed question, the options, the choice, a nonce-salted SHA-256 of the context and the tool_call_id/turn_id, never the command text, todo contents or reply text; stores receipts, salts and the full contexts (including the command as Hermes passed it, and the todo ledger) in plugin-data/invinoveritas-receipts/receipts.jsonl.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs INVINOVERITAS_API_KEY), then asks whether to turn it on.
hermes plugins install invinoveritas-receipts
Said no? Turn it on later:
hermes plugins enable invinoveritas-receipts
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Phone notifications, questions and approvals through Pushary's native Hermes approval transport, with optional per-tool gates.
Good to know before installing
Approval transport and per-tool gates hand dangerous-command approvals to whoever holds the devices or Slack channel paired to your Pushary account (fails closed); messages queued in the Pushary app or Mac notch are injected into the next turn as operator instructions and wait in ~/.pushary/run/hermes-commands; sends session events with a machine id (~/.pushary/machine-id when present, else a hashed hostname) on every turn, the redacted command and description of each approval it carries, the redacted reason when Hermes marks a turn failed (max 200 characters), redacted gated-tool arguments and pushary_remind reminder text to pushary.com; reads PUSHARY_API_KEY only through Hermes.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs (this one needs PUSHARY_API_KEY), then asks whether to turn it on.
hermes plugins install pushary
Said no? Turn it on later:
hermes plugins enable pushary
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Ephemeral credential paste: request_secret asks through clarify and injects the reply over CDP, never storing it.
Good to know before installing
The reply is typed into the focused field of the page whose origin matches the requested service, over the endpoint from BROWSER_CDP_URL or SECRET_HANDOFF_CDP_URL; the answer is visible in the CLI scrollback or the chat history of the surface that asked, and the value is never written to disk, the tool result, or the session transcript.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install secret-handoff
Said no? Turn it on later:
hermes plugins enable secret-handoff
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Uses local Presidio and spaCy to redact supported PII in outgoing user text.
Good to know before installing
Filters Chat Completions user messages and Responses user input locally; system prompts, tool outputs and tool-call arguments are preserved. Fail-open: detector errors, including a missing model, send original text. Install spaCy en_core_web_sm 3.8.0 separately from its GitHub release wheel in the Hermes Python environment before enabling; Hermes installs only the named PyPI dependencies. No runtime model downloads or remote detection.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-pii
Said no? Turn it on later:
hermes plugins enable hermes-pii
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Ring when a Hermes turn finishes so you can leave the window. OS notification, optional chime, and a busy/done chip. Optional "needs you" when approval is waiting. No API keys.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install done-bell
Said no? Turn it on later:
hermes plugins enable done-bell
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Background Review Watch
Community
Status-bar chips for the background self-improvement review and batch context compaction: review running/done/stale with live elapsed time, a turn-countdown fill bar to the next nudge, an always-visible compaction chip…
Status-bar chips for the background self-improvement review and batch context compaction: review running/done/stale with live elapsed time, a turn-countdown fill bar to the next nudge, an always-visible compaction chip (compacting/done/failed/stale with committed reduction or failure class), reply-guard recovery and review-overlap diagnostics, and a Settings page that tunes both orphan ceilings.
Good to know before installing
Renderer-only; polls filtered read-only tails of agent.log via host.logs to parse lifecycle markers; listens for review.summary/message.start/message.complete events; stores three small plugin-storage records (settings + last compaction + last review); no network calls beyond the local gateway, no credential access, no self-update.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install background-review-watch
Said no? Turn it on later:
hermes plugins enable background-review-watch
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
ree_validate_receipt, ree_verify_receipt, ree_infer. Validate does not re-execute and does not stand behind text_output, finish_reason, token_count, model.name, or ree_version. Verify re-executes on CPU. Infer runs one of three small models and writes one receipt.
Good to know before installing
Starts containers from the local image gensynai/ree:v0.8.0 (pinned by digest) and never pulls it; running docker pull yourself is consent to the REE-Binary-License. ree_verify_receipt and ree_infer mount ~/.cache/gensyn and ~/.cache/huggingface read-write (a Hugging Face token file stored there is visible to the container; no token is passed in the environment), may download Hugging Face weights for any model a receipt names, and their container network is not limited to Hugging Face; they ask for Hermes approval on every call and refuse under cron, yolo, approvals off, single-query, unattended runs, host isolation, or when the approval API is missing. ree_validate_receipt runs with network none, does not ask, and returns no receipt text. Any person admitted to one of your gateways can call these tools and approve containers on your Docker daemon; disable per surface with hermes tools. Choosing "always" adds one config.yaml allowlist line per call and never covers the next call. New receipts and temporary work files are written under ~/.cache/hermes-ree; nothing is stored under HERMES_HOME. The container is not a hostile-code sandbox. No cron is created.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-gensyn-ree
Said no? Turn it on later:
hermes plugins enable hermes-gensyn-ree
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Approval-gated local security audit for Hermes Agent using Gitleaks, OSV-Scanner, and Semgrep CE.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install hermes-security-audit
Said no? Turn it on later:
hermes plugins enable hermes-security-audit
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
Kuma
Community
Uptime-Kuma monitoring for agents: the community MCP server for Uptime Kuma v2 (pinned @0.11.18 over npx stdio) with workflow skills for incident review, status digests, and confirmation-gated maintenance.
Uptime-Kuma monitoring for agents: the community MCP server for Uptime Kuma v2 (pinned @0.11.18 over npx stdio) with workflow skills for incident review, status digests, and confirmation-gated maintenance. Credentials stay in host-native MCP config (portable Agent Plugins v1 package, mcp.json + skills/; needs Node.js >= 22 on PATH and a Uptime Kuma v2 instance).
Good to know before installing
First run has npx fetch @davidfuchs/mcp-uptime-kuma@0.11.18 (single-maintainer community package) from npm; that server exposes 31 read/WRITE tools against your Uptime Kuma instance, including permanent delete tools the bundled skills never call.
From the plugin's catalog listing.
How to install
Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install kuma
Said no? Turn it on later:
hermes plugins enable kuma
Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide↗ (opens in a new tab).
Full setup steps, settings and screenshots are on the plugin's official catalog page from Nous Research.
No plugins match that search.
Read before you install
Plugins run code inside your agent. Official plugins come from Nous Research's own repo. Community plugins are independent projects, so check the source, the permissions they ask for and any API keys they need. New to plugins? Start with skills vs plugins vs MCP.
