Tutorial 9: Security Settings | Easy Understand Hermes Agent

This is part of the Hermes Agent official tutorial series. View all tutorials

Think of Hermes Agent like a bank vault: it has multiple locks, alarms, and guards so that even if one layer fails, your money (and data) stays safe. That’s exactly what Hermes’ security model does — it wraps your AI assistant in eight layers of protection so it can’t accidentally delete your files, run dangerous commands, or leak secrets.

Step 1: Understand the Eight Security Layers

Hermes doesn’t rely on just one shield. It stacks eight of them:

User authorization — Only people on your allowlist can talk to the agent.
Dangerous command approval — Destructive actions need a human “OK.”
File write safety — Blocks writing to sensitive paths unless you allow it.
Container isolation — Runs risky code inside Docker or similar sandboxes.
MCP credential filtering — Hides API keys from subprocesses.
Context file scanning — Checks project files for prompt injection tricks.
Cross-session isolation — Each session is locked in its own room; no snooping.
Input sanitization — Prevents shell injection via tricky file paths.

You don’t need to configure all of these manually — most work out of the box. But knowing they exist helps you trust your agent more.

Step 2: Configure Dangerous Command Approval

The most important setting is how Hermes handles risky commands. By default, it uses smart mode, which means an AI judge looks at each command and decides:

Low risk (like python -c "print('hi')") → auto-approved
High risk (like rm -rf /) → auto-denied
Uncertain → asks you for approval

You can change this behavior in ~/.hermes/config.yaml:

approvals:
  mode: smart        # smart | manual | off
  timeout: 300       # seconds to wait for your response
  cron_mode: deny    # deny | approve — for scheduled jobs

manual → always ask you, no auto-decisions
off → never ask (not recommended!)

Step 3: Tweak the Approval Timeout

The timeout key controls how long Hermes waits for your reply before giving up. Default is 300 seconds (5 minutes). If you’re often away from your keyboard, increase it:

approvals:
  timeout: 600

Step 4: Decide What Happens with Cron Jobs

Cron jobs run automatically, so they can’t wait for your approval. Set cron_mode:

deny (default) → blocks the dangerous command; the agent must find another way
approve → auto-approves everything in cron context (risky!)

Keep it at deny unless you fully trust your scheduled tasks.

Step 5: Control Slash-Command Confirmations

Two more useful keys:

approvals:
  mcp_reload_confirm: true        # asks before rebuilding MCP tool cache
  destructive_slash_confirm: true # prompts before /clear, /new, /reset, /undo

mcp_reload_confirm — rebuilding the tool cache resets the prompt, which costs extra tokens. Set to false only if you don’t mind the cost.
destructive_slash_confirm — prevents accidentally wiping your conversation. Leave it true unless you’re in a hurry.

Step 6: Know Your Approval Modes at a Glance

Mode	What happens
smart	AI judges risk — auto-approve low, auto-deny high, ask for uncertain
manual	Always ask you for approval
off	No checks at all — you’re on your own

Summary

Hermes Agent’s security is like a seatbelt, airbag, and crumple zone all in one. You don’t have to think about it every day, but when something goes wrong, you’ll be glad it’s there. Start with the defaults, then adjust approvals.mode and timeout to match your comfort level.

Next up: Tutorial 10 — Working with Cron Jobs (automating tasks safely).