Skip to content
Mordred

Mordred · privacy enforcement for Hermes

SIX PLUGINS

Privacy, enforced below the agent.

Mordred installs six Hermes plugins for strict provider and endpoint checks, process-scoped Tor or VPN routing, native-key custody, bound Slack and Discord E2E, install policy, and guided configuration. These controls operate at Hermes integration points below the agent, applying privacy rules without relying on prompt-level instructions.

Open live lab Install Mordred
curl -fsSL https://raw.githubusercontent.com/mordredagent/hermes-mordred/main/scripts/install.sh | bash

Assume the traitor is inside. Strict-mode refusals · no usage data sent to us · local audit with optional encryption · read the threat model →

MORDRED PRIVACY BOUNDARY

Policy runs below the agent

6 PLUGINS

HERMES AGENT

requests an outbound action

UNTRUSTED

POLICY ENFORCEMENT

strict refuses · lenient warns
llm_guarde2enetworkkeyvaultprivacy_checkwizard
SEALED

MESSAGE BODIES

ENC:v3 before gateway

REFUSED

REMOTE INFERENCE

unapproved provider / endpoint

DECLARED

NETWORK PATH

tor · process-scoped

DEVICE-BOUND

IDENTITY KEY

Enclave / Keychain / TPM

Audit logs start as local plain text and are encrypted after you set up an encryption key

LOCAL
E2E SEALED LOCAL POLICY NO USAGE DATA SENT TO US

BOUND E2E · PROVIDERS CHECKED · PROCESS ROUTES MANAGED

01 — Protect your keys

Protect Hermes secrets with keys managed by your device. Mordred uses Secure Enclave when available or login Keychain on macOS and TPM 2.0 on Linux, with passphrase-protected backups for recovery.

02 — Control network routes

Choose how integrated Hermes requests reach the network: directly, over Tor, or through a VPN. Strict mode can stop a request when Mordred cannot verify the protected route you selected.

03 — Protect local data

Review a local audit trail of the actions Mordred allows, warns about, or blocks. On macOS, you can also encrypt supported Hermes configuration, memory, and workspace data while it is stored.

Six plugins. One install line.

All six, in detail
mordred_llm_guard

Checks provider identity and endpoint before egress. Strict mode validates the resolved provider, endpoint ownership, local-loopback rules, and declared parent harness. It does not scan prompt text for credentials or redact content.

Read →
mordred_e2e

Protects bound Slack and Discord conversations. Context-bound ENC:v3 keys bind direction, platform, channel, and thread. Mandatory-E2E commands and replies stay encrypted; unrelated or unbound gateway traffic keeps Hermes's normal behavior.

Read →
mordred_network

Manages one process-scoped route. Mordred can bring up Tor, VPN, or clearnet and check integrated provider transports. The default is clearnet. Strict protected routes refuse when evidence is missing; lenient and off may warn and fall back to clearnet. This is not an OS firewall.

Read →
mordred_keyvault

Wraps secrets with a native device key. Purpose-bound envelopes keep native wrapping keys non-exportable. macOS prefers the Secure Enclave but can use a login-Keychain fallback; Linux requires the TPM helper. Portable MRKV snapshots provide an explicit recovery path.

Read →
mordred_privacy_check

Gates skill installation and writes shared audit records. The authoritative install check applies only through hermes-mordred install. At runtime the plugin has a generic strict-mode rule for known network tools, but Hermes does not provide trusted per-skill provenance and direct sockets remain outside this boundary.

Read →
mordred_wizard

Owns the standalone CLI and configuration transaction. The re-runnable setup orchestrator configures policy, optional routing, the platform helper, keyvault, and macOS env and memory encryption. It skips completed work and never auto-resets a blocked or corrupt keyvault.

Read →

Where the six plugins integrate

  1. wizard writes config + policy snapshot
  2. privacy_check gates installs + records decisions
  3. llm_guard checks provider + endpoint in strict mode
  4. network manages the selected process route
  5. e2e + keyvault protects bound gateways + local keys

These are distinct configuration, install, inference, transport, gateway, and key-management hooks. A request does not necessarily traverse every row, and direct sockets or unwrapped executables remain outside the cooperative boundary.

What we do not do.

A privacy tool is defined by its refusals, not its features. Here are ours, in the order they matter.

The full threat model
Strict refusal

policy.strict.cloud_not_allowlisted

request refused before the provider call

When strict evidence fails

policy hook refuse audit reason

Lenient mode may warn or fall back; direct sockets and unwrapped processes remain outside these hooks.

  1. 01

    Strict mode does not call missing evidence safe.

    An unknown provider, unsafe endpoint, broken protected route, or missing required sibling is a refusal under strict policy.

  2. 02

    Linux does not fall back to a software key.

    If the TPM helper is absent or unusable, Linux keyvault operations fail instead of silently weakening key custody.

  3. 03

    Bound E2E conversations do not send plaintext.

    Once a Slack or Discord context requires ENC:v3, a missing key or context blocks the message instead of delegating to the plaintext sender.

  4. 04

    Armed memory encryption does not write plaintext.

    If the memory seal is on but the runtime key or supported Hermes seam is unavailable, memory reads and writes refuse until the operator repairs or disables the target.

  5. 05

    We do not collect Mordred telemetry.

    The package sends the maintainers no usage or diagnostic data. Providers and services you deliberately configure keep their own terms and logs.

Trust boundary

Where the trust ends.

Mordred treats agent instructions, retrieved content, remote services, and network traffic as untrusted. It applies policy where registered Hermes hooks can inspect an operation, then relies on your local environment and device key storage as the trusted foundation.

Untrusted

  • Agent + inputs Prompts, tools, and retrieved content
  • Remote services Model providers, Slack, Discord, and the network
  • Outside the hooks Direct sockets and unwrapped processes

Policy — hermes-mordred

  • Provider requests Check provider identity and endpoint
  • Network routes Manage and verify the selected connection
  • Protected data Validate E2E context and local encryption keys

Trusted — local base

  • Local environment Your OS, user account, and Hermes installation
  • Reviewed configuration Local settings and registered Mordred plugins
  • Device key storage Secure Enclave, Keychain, or TPM 2.0
Registered hooks mediate covered operations; they are not an OS-wide sandbox
Explore the full threat model

Four commands to a configured install.

Setup is re-runnable: it writes config.yaml and the derived policy, prepares the available platform helper, initializes keyvault, and skips completed work.

Full quickstart Set up with AI

What setup does

  1. 01 Writes Mordred plugin settings to ~/.hermes/config.yaml and derives mordred/policy.json.
  2. 02 Offers clearnet, Tor, or VPN routing; clearnet remains the default unless you choose another path.
  3. 03 Prepares the available platform helper and initializes keyvault without auto-resetting existing state.
  4. 04 Runs supported macOS at-rest steps and finishes with the read-only status dashboard.
curl -fsSL https://raw.githubusercontent.com/mordredagent/hermes-mordred/main/scripts/install.sh | bash
hermes-mordred setup
hermes-mordred status
hermes

hermes-mordred status

neutral: policy mode lenient · warns and audits; continues
warn: network clearnet · configured; runtime not active here
warn: keyvault not initialised · no hardware helper
neutral: env [off] not enrolled
neutral: memory [off] not enrolled

current state · no changes made

The status command shows what is configured and available without changing anything. Check each row to see what is active and what still needs setup.

Status — alpha

v0.1.0a20 is an alpha.

The CLI surface will break before 1.0, and every break is documented in the GitHub release notes. Read them before you upgrade a machine you depend on.

ALPHA MIT NO USAGE DATA SENT TO US
Release notes on GitHub →
LICENSE
MIT
USAGE DATA
NOT SENT
PYTHON
≥ 3.11
HERMES-AGENT
≥ 0.13
MACOS
ENCLAVE PREFERRED / AT-REST TARGETS
LINUX
TPM 2.0 REQUIRED FOR KEYVAULT