Hermes

Hermes connector wires config.yaml hooks for the Hermes agent runtime, with discovery for MCP, skills, and plugins.

The Hermes connector wires DefenseClaw into the Hermes agent runtime via ~/.hermes/config.yaml hooks and discovery surfaces for MCP servers, skills, and plugins.

Three commands against one Hermes Agent session in observe mode: (1) `echo hello` flows through as action=allow / severity=NONE; (2) `chmod 777 /tmp/dc_test` matches CMD-CHMOD-WORLD HIGH; (3) `cat /etc/shadow` raises a CRITICAL sensitive-file read. Observe mode logs without blocking, and supported tool, LLM, session, and subagent events appear in connector activity.

Setup

defenseclaw setup hermes

Hermes setup is supported on macOS and Linux. The DefenseClaw connector is not certified on native Windows x64, so setup rejects it there.

setup hermes is the dedicated Hermes alias. It uses the shared guardrail setup backend, wires the effective Hermes config ($HERMES_HOME/config.yaml or ~/.hermes/config.yaml), and discovers existing MCP servers, skills, and plugins. There is no proxy-enforcement path — only pre_tool_call can block. Hermes has no native human-approval surface, so confirm verdicts use an immediate system-message fallback with raw_action preserved for audit.

What `setup hermes` actually does

The table highlights convenience options rather than the complete alias surface. The alias also accepts --mode, --rule-pack, --fail-mode, approval, block-message, add/replace, workspace, and rule-pack-directory options. See the quick-alias reference; use full guardrail setup for scanner, detection-strategy, and judge-provider configuration.

Flag	Default	What it does
`--yes / -y`	off	Skip the confirmation prompt.
`--restart / --no-restart`	`--restart`	Bounce `defenseclaw-gateway` after applying changes so the new hooks wire in.
`--with-local-stack / --no-local-stack`	`--no-local-stack`	Also run `setup local-observability up`; follow the command's printed gateway-restart step after it writes the export destination.

The alias defaults Hermes to observe mode and can join an existing hook-connector roster when you choose Add. To tune Hermes after install, keep using defenseclaw setup guardrail --connector hermes — see the variations below.

Common variations — pick the recipe that fits your phase

defenseclaw setup hermes

Confirms once, wires the hooks block in ~/.hermes/config.yaml, and restarts the gateway. Findings flow to mandatory SQLite event history and the TUI; configured v8 destinations receive only the buckets/signals their routes select. No traffic is intercepted and no requests are blocked. Pass --yes to skip the confirmation in CI.

defenseclaw setup hermes --yes --with-local-stack

Same as standard but also runs setup local-observability up so Prom/Loki/Tempo/Grafana come up locally for ad-hoc dashboards. That command writes the export destination after the alias has already restarted the gateway, so run its printed defenseclaw-gateway restart step before expecting exports. See Local observability.

export DEFENSECLAW_LLM_KEY='replace-with-your-key'

defenseclaw setup hermes                                  # base alias first
defenseclaw setup guardrail \
  --connector hermes \
  --rule-pack strict \
  --scanner-mode local \
  --detection-strategy regex_judge \
  --judge-model anthropic/claude-sonnet-4-20250514 \
  --judge-api-key-env DEFENSECLAW_LLM_KEY \
  --judge-hook-connectors hermes \
  --restart

The alias selects Hermes; the follow-up setup guardrail --connector hermes swaps in the strict rule pack, keeps scanning local, and turns the LLM judge on as a second-pass adjudicator on regex-flagged events. Configure the remote scanner separately through full guardrail setup, which validates its endpoint and API-key environment variable.

Hermes has no proxy enforcement, but its pre-tool hook can enforce directly:

defenseclaw setup hermes --mode action

With mode=action, pre_tool_call blocks when policy returns block. A confirm result falls back to a system message because Hermes has no native ask surface. Hermes does not provide a fail-closed hook transport surface, so --fail-mode closed cannot make an unavailable hook block the agent.

Decision aids — should I turn this on?

Human-in-the-loop (HITL)

Per-connector ask matrix. Hermes has no native ask; confirm uses a system-message fallback preserved in audit.

Full setup guardrail flag reference

The complete flag surface for `setup guardrail --connector hermes`.

Defaults & rule packs

What permissive / default / strict actually ship, and which one matches your risk tolerance.

Interactive wizard

Animated terminal demo of the prompt-by-prompt setup flow — the safest path the first time.

Not sure what to pick? Run defenseclaw setup guardrail (no flags) — the interactive wizard walks you through every choice with safe defaults pre-selected and inline help. The Prompt → flag mapping table gives you the CI-shaped command for the same configuration.

Files DefenseClaw will modify

config.yaml (hooks block)

Hook capabilities

Block events

pre_tool_call

Native ask events

None — confirm verdicts are downgraded with the raw action preserved.

Hermes can block supported hook events but has no native human-approval surface. Confirm verdicts use a system-message fallback with raw_action preserved; audit and the TUI are review-only.

Disable

defenseclaw guardrail disable --connector hermes --yes