Hermes · Security: Approvals & Allowlists

An agent runs shell commands, some destructive. Hermes gates the dangerous ones behind your approval.

Before executing anything, Hermes matches the command against a curated list of dangerous patterns (recursive deletes, disk formats, DROP DATABASE, overwriting /etc/) and pauses for approval on a match. Three modes set how strict the gate is: manual (default, prompt every time), smart (a cheap model auto-approves safe, auto-denies dangerous, asks when unsure), and off (= YOLO). The CLI prompt offers once / session / always / deny, deny is the default, and a timeout denies too (fail-closed). "Always" writes to a command_allowlist you can audit with hermes config edit. Below everything sits a hardline blocklist (rm -rf /, fork bombs, formatting a live disk) refused regardless of YOLO or allowlist, with no override. For unattended work, the cleaner answer is a container backend: the container becomes the boundary and checks are skipped safely.