Skip to main content

airlock

❖ Communityv0.2.1

Tools · by otsoa-dubief · added

Guardrails that follow what a conversation has read. Once a session reads untrusted content (a web page, a browser snapshot, an MCP or third-party plugin's output, a customer's message), airlock seals it: messages to anyone but the owner, network writes, pushes and deploys, memory, skill and cron writes, browser input, URLs that could carry data out and code that reaches the network go through Hermes's own approval gate. Walls hold in every session: credential paths and secret files, the guard's own files and Hermes's config, shell startup files, other profiles, commands that switch approvals off. Shell commands are read the way the shell reads them, so a command that computes or hides what it runs (eval, base64 | sh, $G push, wildcards, write-then-run) is refused until written in clear. Subagents inherit the seal. It also catches an injection by its signature: recognized secrets never leave in a call; a private marker in the agent's context locks the session if it shows up in a tool call; a send to an address the untrusted content named is blocked; repeated refusals lock the session; lookalike Unicode in commands is refused. Plugin and MCP tools nobody admitted need approval. Observe mode, stop switch, `hermes airlock check|demo|log`. Tested on a corpus of 251 attacks and everyday commands, and end to end in the official image.

Open in Hermes Desktop
hermes plugins install airlock
Repository ↗Reviewed source @ e379b7a ↗Documentation ↗

Screenshots

airlock screenshot 1airlock screenshot 2airlock screenshot 3

What it adds

Hooks 6

pre_tool_callpost_tool_callpre_llm_callsubagent_starton_session_resetpost_approval_response

README

From the reviewed commit e379b7a ↗; it updates when the author re-pins.

airlock

airlock, guardrails for Hermes Agent, by Otsoa Dubief

Guardrails for Hermes Agent. airlock checks every tool call the agent makes and remembers which sessions have read something from outside (a web page, a browser page, a third-party tool, a customer's message). From then on, the actions that leave the machine go through Hermes's own approval gate: messages to anyone but you, uploads, pushes and deploys, memory and skill changes, browser clicks. Reading, searching and drafting stay free.

A recorded Hermes session: the agent reads a pricing page that hides a note for AI assistants, then the post to a webhook stops at Hermes's approval menu and the owner denies it

A real session, recorded, not simulated.

  • Walls in every session: keys and credential files, airlock's own files and Hermes's configuration, shell startup files, other profiles on the same machine.
  • Reads commands as the shell does: a command that hides what it runs is refused until it is written plainly.
  • Catches an injection by its signature: keys and tokens never leave in a call; a private marker in the agent's context locks the session if it shows up in a call; a call to an address the untrusted content named is blocked.
  • Vets third-party tools: plugin and MCP tools nobody admitted wait for your approval.
  • Local: no network call, no LLM call. A journal records every decision.

Install

hermes plugins install airlock
hermes gateway restart        # if a gateway is running
hermes airlock demo           # see it decide, nothing is executed

How airlock decides: a clean session works as usual; once it has read something untrusted, outbound actions ask you; walls hold in every session

Full documentation, policy reference, limits and threat model: github.com/otsoa-dubief/airlock.

Apache-2.0 · by Otsoa Dubief

Disclosure

← Back to the catalog · catalog built Oct 24, 2026