Hermes Agent Integration

Install the SupraWall plugin to gate every Hermes tool call with deterministic ALLOW/DENY enforcement, PII scrubbing, and credential vault injection.

22,000+ GitHub stars

Hermes is the fastest-growing self-hosted AI agent of 2026. Secure it in under 2 minutes.

Clone Repo Integration Page

1. Installation

Install the SupraWall Hermes plugin from PyPI. It depends on suprawall-sdk which is installed automatically.

bash

pip install suprawall-hermes

2. Enable the Plugin

Add suprawall-security to your Hermes config. For project-specific plugins, also set HERMES_ENABLE_PROJECT_PLUGINS=true.

yaml

# ~/.hermes/config.yaml
plugins:
  enabled:
    - suprawall-security

3. Set Environment Variables

Only SUPRAWALL_API_KEY is required. All other variables are optional hardening configuration.

bash

export SUPRAWALL_API_KEY=sw_your_key_here
# Optional hardening
export SUPRAWALL_FAIL_MODE=fail-closed
export SUPRAWALL_MAX_COST_USD=5.00
export SUPRAWALL_LOOP_DETECTION=true

4. Vault — Secure Credential Injection

The plugin registers a suprawall_vault_get tool. Hermes can retrieve secrets by name without exposing them in prompts or tool arguments. Secrets are injected at runtime from the SupraWall vault and scrubbed from results after execution.

bash

# Hermes Agent will now use this tool to retrieve secrets:
# "Get my GITHUB_TOKEN from the vault"
# → calls suprawall_vault_get("GITHUB_TOKEN")
# → returns secret value without exposing it in the prompt

5. Slash Commands

Available in Hermes CLI, Telegram gateway, and Discord sessions. Use these to monitor your agent security posture in real time.

bash

/suprawall status
# → 🛡️ Shield: ACTIVE | Budget: $0.42/$5.00 | Audited: 38 tool calls

/suprawall audit
# → Shows last 10 tool calls with timestamps and budget impact

/suprawall budget
# → Session spend: $0.42 / $5.00

Full Configuration Reference

bash

SUPRAWALL_API_KEY=sw_...         # Required. Your SupraWall API key.
SUPRAWALL_FAIL_MODE=fail-closed  # fail-closed (default) | fail-open
SUPRAWALL_MAX_COST_USD=5.00      # Hard budget cap per Hermes session
SUPRAWALL_ALERT_USD=4.00         # Soft alert threshold
SUPRAWALL_MAX_ITERATIONS=100     # Circuit breaker: max tool calls
SUPRAWALL_LOOP_DETECTION=true    # Block identical consecutive tool calls
SUPRAWALL_TENANT_ID=my-team      # Tenant ID for vault and policies
SUPRAWALL_URL=https://...        # Override policy engine URL

How the Hooks Work

pre_tool_call

Fires before every tool execution. Evaluates the planned call against your SupraWall policies. Returns {blocked: true} to veto the call, or null to allow it.

post_tool_call

Fires after every tool execution. Scrubs PII from results, appends to the audit log, and records cost against your budget cap.

← LangChain Integration Page