Free recipes / Safety, Costs and Troubleshooting

Lock Down Hermes Agent Approvals and the Command Allowlist

A file snippet for config.yaml that sets approvals you can live with: manual prompts, scheduled jobs that can never run flagged commands, a deny list and a short, audited command allowlist.

You just installed Hermes, you are about to connect a messaging app, or you have clicked always a few times and no longer know what Hermes may run without asking. Saves about 25 minutes

The recipe

# Back up first: hermes backup # ~/.hermes/config.yaml (Hermes Agent v0.21.x; check with hermes --version) approvals: mode: manual # manual: you decide every flagged command yourself. # smart (the default): a helper model approves low-risk commands and asks you about the rest. cron_mode: deny # Scheduled jobs can never run flagged commands. This is the default. Keep it. deny: - "[DENY_PATTERN_1]" - "[DENY_PATTERN_2]" # Always blocked. Quote every pattern: a bare leading * breaks YAML. command_allowlist: - "[SAFE_COMMAND]" # Commands here never ask. Keep the list short and exact. # Every time you answer always to a prompt, a line lands here. # Then, in a terminal: # hermes config check catches typos and stale keys # hermes approvals suggest proposals from your approval history; read them first # Only add --apply after you have read every proposal and agree with all of them. # How prompts work day to day # - Each prompt offers once, session, always or deny. Prefer once. # - While an approval is waiting, any reply like ok, yes or go approves it. Reply only /approve or /deny, and read the command first. # No answer within 300 seconds counts as deny. # - A hardline blocklist (rm -rf / and similar) stays on whatever you set. # - Container backends skip these checks entirely; see recipe 9.9. # Monthly: read command_allowlist line by line and delete anything you # do not recognize or no longer need. # ~/.hermes/.env (separate file) # Who may talk to your gateway. It denies everyone else by default. Recipe 6.2 covers the other platforms. TELEGRAM_ALLOWED_USERS=[YOUR_TELEGRAM_ID]

Fill in these brackets

`[DENY_PATTERN_1]`	e.g. sudo *; a command you never want run, even if prompts are switched off later
`[DENY_PATTERN_2]`	e.g. git push --force*
`[SAFE_COMMAND]`	e.g. pkill -f vite; one exact command you approve often, never a broad glob like rm *
`[YOUR_TELEGRAM_ID]`	e.g. 123456789; your numeric Telegram user ID, not your @username

Pro tip

Leave the prompt-skipping switches alone: --yolo, /yolo and HERMES_YOLO_MODE exist for throwaway test machines, not for an assistant that holds your email, files and keys. If prompts feel too frequent, add one exact command to command_allowlist instead.

Variation

On a shared or always-on machine, add the commands that touch money or publishing, such as your deploy or payment CLI, to approvals.deny, and run them yourself.

Written for Hermes Agent v0.21.x. Check commands against your version with hermes --version. This site is independent and not affiliated with Nous Research.