Use cases

AI for sensitive work, on your terms.

Company documents and server logs go only to the providers and routes you approved.

Company work

Summarize contracts and internal docs

When: You don't want confidential documents sent to whatever model happens to be configured
Mordred: In strict mode, refuses any provider or endpoint that is not on your allowlist
Result: Model requests only go to providers you allowlisted

llm_guard

Company work

Work with the agent in company Slack

When: You want the agent in a Slack or Discord channel without plaintext on the gateway
Mordred: Keeps commands and replies as ENC:v3 in channels bound to mandatory E2E
Result: No plaintext is sent in a bound channel

e2e

See the component

Company work

Draft customer replies

When: Tickets with names and addresses must only go to a provider you approved
Mordred: In strict mode, refuses endpoints you have not approved; it does not mask the content itself
Result: Personal data does not reach an AI you did not approve

llm_guard

Company work

Keep agent memory encrypted on macOS

When: You worry secrets pile up in agent memory as plaintext
Mordred: Encrypts memory with a device-bound key, preferring the Secure Enclave
Result: Copied memory files cannot be read on another machine

keyvault

Encryption steps

Server admin

Get help reading production logs

When: Logs with IP addresses and tokens must not reach unexpected endpoints
Mordred: In strict mode, sends only to approved providers over the route you chose; it does not mask the logs
Result: Logs do not go to unexpected endpoints

llm_guardnetwork

Server admin

Protect keys on Linux servers

When: A leaked key on a server would be costly
Mordred: Seals keys with the TPM, with no software fallback
Result: A copied key envelope is useless elsewhere

keyvault

See the component

Server admin

Send model calls only through a VPN

When: Model calls must not leave over a direct connection
Mordred: In strict mode, refuses when the VPN route cannot be confirmed
Result: Calls do not quietly fall back to a direct connection

network

See the component

Server admin

Check ops skills before install

When: You want to add third-party automation to a server
Mordred: Checks a skill's declared network and key requirements when you install it with hermes-mordred install
Result: Skills that fail the check are stopped before they install

privacy_check

Try it in the Lab

Personal

Ask about your own Telegram chats

When: You want to find plans or promises in past Telegram conversations
Mordred: Reads an encrypted, read-only archive and answers with a private or local model only (preview, macOS)
Result: Your chats do not reach other AI providers

e2ekeyvault

Start with a one-line install.

One plugin brings all six components. Settings can be changed later.

Install Try it in the Lab