Tutorial 29: Security Deep Dive

This is part of the Hermes Agent official tutorial series. View all tutorials

Think of Hermes Agent’s security like a bank vault with eight separate locks — even if someone picks one, the others keep your money (and data) safe. Today, we’ll open each lock one by one and see how they work.

Step 1: Who Gets to Talk to Your Agent?

First, you decide who can even knock on the vault door. Hermes uses user authorization — an allowlist of approved people and DM pairing on messaging apps. If your name isn’t on the list, the agent won’t respond. Simple and effective.

Step 2: Dangerous Command Approval

Before running any shell command, Hermes checks it against a list of “dangerous patterns” (like deleting files or changing permissions). If it matches, you get a say.

You set the policy in ~/.hermes/config.yaml:

approvals:
  mode: smart          # smart | manual | off
  timeout: 300         # seconds to wait for your reply
  cron_mode: deny      # deny | approve

Here’s what each mode does:

Mode	What it means
smart (default)	Uses a helper AI to judge risk. Safe commands (like python -c "print('hello')") auto-run. Truly dangerous ones get auto-denied. Uncertain ones ask you.
manual	Always asks you for approval on dangerous commands. No shortcuts.
off	Turns off all checks — not recommended unless you’re in a fully controlled environment.

You also get a timeout — if you don’t answer in 300 seconds, the command is blocked. And for automated cron jobs, cron_mode: deny means they can’t run dangerous commands without a human.

Step 3: File Write Safety

Not every file should be written to. Hermes has a denylist of forbidden paths (like system files) and an optional write sandbox that confines write_file and patch to a safe folder. Think of it as giving the agent a coloring book instead of letting it draw on your walls.

Step 4: Container Isolation

For really risky tasks, Hermes can run inside a Docker, Singularity, or Modal container with hardened settings. If something goes wrong, the damage stays inside the box — not on your main system.

Step 5: MCP Credential Filtering

MCP (Model Context Protocol) tools run as separate subprocesses. Hermes filters their environment variables so they can’t see your API keys or other secrets. Each tool gets only what it needs, nothing more.

Step 6: Context File Scanning

Prompt injection is when a file contains hidden instructions that try to trick the agent. Hermes scans project files for these patterns before they reach the model. It’s like checking your mail for suspicious powder before opening it.

Step 7: Cross-Session Isolation

Every session is a separate room. One session can’t peek into another’s data or state. Even cron job storage paths are hardened against path traversal attacks — so no sneaky ../ tricks to escape the sandbox.

Step 8: Input Sanitization

Finally, when the terminal tool accepts a working directory parameter, Hermes validates it against an allowlist. This prevents shell injection — where a malicious path like ; rm -rf / could sneak in. Only approved paths get through.

Putting It All Together

You don’t need to configure all eight layers at once. Start with the defaults — they’re solid. Then, as you get comfortable, tweak approvals.mode and add container isolation for high-risk tasks.

Key takeaway: Security isn’t one big wall; it’s many small gates. Hermes gives you eight of them, and you control how tight each one is.

Next up: We’ll dive into cron jobs — how to schedule tasks safely, even when no human is around to approve every step. See you there!