The suite
Six plugins. Six integration points.
They install together but run at different Hermes integration points. The suite checks provider and endpoint identity, protects bound Slack and Discord contexts, manages a selected process route, stores native-backed keys, gates skill installs, and owns configuration.
| Plugin | Decides | On refusal | Platform |
|---|---|---|---|
| llm_guard | Whether the resolved provider and endpoint satisfy strict policy | Strict request or session refused | macOS / Linux |
| e2e | Whether a bound gateway command or reply has valid E2E context | Bound message refused | macOS / Linux |
| network | Route lifecycle and transport evidence for integrated Hermes requests | Strict request or session refused | macOS / Linux |
| keyvault | Whether a purpose-bound unwrap or signing request is authorized | Key operation refused | macOS / Linux |
| privacy_check | Skill-install metadata and generic strict network-tool policy | Strict install or tool call blocked | macOS / Linux |
| wizard | Which incomplete setup step should run next | Setup stops with repair guidance | macOS / Linux |
mordred_llm_guard
Checks provider identity and endpoint before egress.
Strict mode validates the resolved provider, endpoint ownership, local-loopback rules, and declared parent harness. It does not scan prompt text for credentials or redact content.
- CHECKS
- provider / endpoint / harness
- CONTENT DLP
- not provided
It refuses
- A strict cloud request whose provider is not allowlisted.
- A strict request with an absent, unsafe, or mismatched endpoint.
mordred_e2e
Protects bound Slack and Discord conversations.
Context-bound ENC:v3 keys bind direction, platform, channel, and thread. Mandatory-E2E commands and replies stay encrypted; unrelated or unbound gateway traffic keeps Hermes's normal behavior.
- GATEWAYS
- slack / discord
- WIRE
- ENC:v3 · context-bound channel key
It refuses
- Plaintext, malformed, or legacy commands on mandatory-E2E contexts.
- A bound reply when the channel key or channel/thread context is unavailable.
mordred_network
Manages one process-scoped route.
Mordred can bring up Tor, VPN, or clearnet and check integrated provider transports. The default is clearnet. Strict protected routes refuse when evidence is missing; lenient and off may warn and fall back to clearnet. This is not an OS firewall.
- ROUTES
- tor / vpn / clearnet
- DEFAULT
- clearnet
It refuses
- Strict Tor/VPN use when the configured route is down or has drifted.
- Strict Tor use when provider proxy, DNS, or IPv6 evidence is unsafe or unknown.
mordred_keyvault
Wraps secrets with a native device key.
Purpose-bound envelopes keep native wrapping keys non-exportable. macOS prefers the Secure Enclave but can use a login-Keychain fallback; Linux requires the TPM helper. Portable MRKV snapshots provide an explicit recovery path.
- MACOS
- Secure Enclave preferred · Keychain fallback
- LINUX
- TPM 2.0 required · no software fallback
It refuses
- A decrypt request whose logical key, envelope, or purpose does not match.
- Linux key operations when the TPM helper is absent or unusable.
mordred_privacy_check
Gates skill installation and writes shared audit records.
The authoritative install check applies only through hermes-mordred install. At runtime the plugin has a generic strict-mode rule for known network tools, but Hermes does not provide trusted per-skill provenance and direct sockets remain outside this boundary.
- METADATA
- network requirements / keyvault requirement
- BOUNDARY
- wrapper install + known Hermes hooks
mordred_wizard
Owns the standalone CLI and configuration transaction.
The re-runnable setup orchestrator configures policy, optional routing, the platform helper, keyvault, and macOS env and memory encryption. It skips completed work and never auto-resets a blocked or corrupt keyvault.
- WRITES
- ~/.hermes/config.yaml + mordred/policy.json
- SETUP
- re-runnable · completed steps skipped
It refuses
- Automatically resetting or overwriting a blocked or corrupt keyvault.
- Pretending an interactive step completed during non-interactive setup.
How they compose.
These rows show where configuration and decisions meet; they are not one linear pipeline. A provider request, a skill install, and a bound gateway reply exercise different subsets.
- wizard writes config + policy snapshot
- privacy_check gates installs + records decisions
- llm_guard checks provider + endpoint in strict mode
- network manages the selected process route
- e2e + keyvault protects bound gateways + local keys
keyvault supplies purpose-bound unwrap and signing operations to integrations that request them; it does not mediate every tool call.
privacy_check gates installs made through hermes-mordred and applies a generic strict rule to known network tools. It is not an after-the-fact status reporter.