Wiki · Start here
Security
The safeguards are on from the start — and in unattended runs a dangerous command is simply denied.
Six safeguards working together
| Safeguard | What it protects against |
|---|---|
| 1. Who may talk to the agent | Strangers. On Telegram and Discord an allowlist of accounts decides; anyone outside it is not obeyed |
| 2. Approval of dangerous commands | Irreversible damage. Before running something that deletes or overwrites, the agent asks for your approval |
| 3. File protection | Overwriting important files. Keys, agent settings and other sensitive paths are always blocked |
| 4. Isolated runs | Escaping the sandbox. Work can run in a separated environment (a container) with no way out to the rest of the server |
| 5. Project file scanning | Injected instructions. Texts and project files are scanned for attempts to manipulate the agent |
| 6. Secret filtering | Leaking keys. Commands and the sandbox receive only what makes sense — not the whole server environment |
Command approval in practice
When the agent is about to do something dangerous, it asks instead of acting. You see the exact command and decide: allow once, allow permanently (it joins a permanent list), or deny.
| Mode | Behaviour | When to use it |
|---|---|---|
smart (default) | Asks for dangerous commands, not for ordinary ones | Always — a sensible balance |
| YOLO (no asking) | Needs no approval at all | Only on your own server with no one else's data, and when you know what you are doing |
Some commands are refused no matter what, even in the no-asking mode — a hard floor that cannot be
switched off. If it asks too often, you can allow a command permanently after approving it (then it stops
asking), or let the recorded approval history suggest it for you with hermes approvals suggest.
When nobody is watching
Some runs happen unattended: nightly scheduled jobs, requests from other systems. There it does not help that nobody can answer — a dangerous command is simply denied. The same applies to single-query sessions and runs triggered from outside. That is what keeps automation safe: a job you wrote yesterday cannot delete the server at night.
Files and secrets
| Rule | Reason |
|---|---|
| Keys and passwords belong in the agent's settings | Not in texts, skills or memory. Settings are one place you can watch, and they are not written into code backups |
| Protected paths are always blocked | The agent cannot overwrite its own settings or files holding credentials |
| A write sandbox can be enabled | HERMES_WRITE_SAFE_ROOT narrows where the agent may write |
| Secrets do not leave the server | Commands receive only a limited selection of environment values, not everything |
Who may talk to the agent
Once connected to Telegram or Discord, the agent is publicly reachable — so access is limited by an allowlist of accounts and, for direct messages, by pairing (a stranger must pair first, only then is the agent listening). More in Telegram and Discord.
Our tips
| Tip | Why |
|---|---|
| Do not enable the no-asking mode on a machine with other people's data | One oversight can then take everyone's data. Leave the default until you have a reason |
| Keep secrets in the settings | Never write them into prompts, skills or notes for the agent |
| Only connect MCP servers from trusted sources | A connection is third-party code with access to your server |
| Ask what is allowed now and then | Inside a chat, /security shows what is permanently allowed and which paths are protected |
| Sort backups before permissions | Safeguards lower the risk; they do not replace a backup |
When it does not work
| Symptom | Cause and what to do |
|---|---|
| The agent keeps asking about the same thing | An approval is valid once. Allow the command permanently, or take the suggestion from hermes approvals suggest |
| The agent refuses even a safe command | The command falls under the hard floor or under your own deny rule. Find another approach — better than disabling safeguards |
| The agent ignores me on Telegram | You are not on the allowlist, or pairing is missing |
| Writing to a file stopped working | The path is protected, or the write sandbox is on. Check where writing is permitted |
| I want certainty that nothing happened on its own | Look at the run history and the list of approved commands |