GitHub profilePlugins by AtlasOmnia
3 plugins by AtlasOmnia in the catalog, most-starred first.
AtlasOmniaatlas-sidecar-excelSidecar by Atlas Omnia — your Hermes agent in desktop Excel for Mac. The plugin runs an HTTPS localhost bridge on ports 47640-47644, exposing 28 sidecar_excel_* tools and opt-in workbook plans. Manual CA trust and one sidebar Allow are required. Allowing lets the configured site use your Hermes agent and all its tools until revoke; use a site you control or trust and open only documents you trust. API_SERVER_KEY is read through Hermes, never sent to the sidebar or stored by the plugin; TLS private keys are owner-only. For TLS it can only vouch for localhost. The trust command does not limit the certificate to TLS, so protect the key file and remove the trust when you stop using Sidecar. Latest live run: 2026-11-11 about 00:26 in desktop Excel for Mac, plugin and sidebar built from a7b3fd7. Connect, Allow, a 3-row table with header in A1:B4 and =SUM(B2:B4) in B5 read back from the workbook; revoke dropped the sidebar to needs your OK. The bridge answered 200 to the configured origin and 403 to another origin. The sidebar used a private test site via addin_base, with CA trust in the login keychain; this Mac also has it in the System keychain. Earlier the same night at 35ef09e (behaviour unchanged since): reversal on request by clearing the range (no real undo), plugin reload with the sidebar open (it reconnected by itself and edited again), approval remembered after restarting Excel, next Connect after revoke asked for approval again. Not tested: Windows desktop Excel, dark theme, keyboard-only use, public Pages origin, TLS-only trust or all workbook tools/plans. Reopen the sidebar if it does not reconnect. The Excel test Mac also has System-keychain trust; that was not required in our Word and PowerPoint runs, which used login-keychain trust only. By default the plugin serves its bundled sidebar from the same HTTPS bridge at https://localhost:<actual-port>/sidecar-excel/; GitHub Pages or self-hosting is not required. A custom HTTPS site remains available through addin_base. Office.js loads from Microsoft. Hermes may send chat/workbook data to the configured provider. CLI approval/status never starts a listener. Remove matching CA trust manually before deleting the plugin tls directory; uninstall/revoke does not remove OS trust. No telemetry or self-updater. Apache-2.0; LICENSE and NOTICE included. No Microsoft or Nous Research endorsement. Disclosure — While the gateway runs, this plugin keeps an HTTPS listener on 127.0.0.1:47640-47644 and asks you to trust, by hand, a per-install root CA in your macOS login keychain. The CA can only vouch for localhost in TLS, but the trust command does not limit it to TLS, so protect its key file in the plugin's data folder and remove the trust when you stop using Sidecar. After you click Allow in Hermes, the sidebar site (by default the plugin's own localhost page) can run your full Hermes agent with all its tools through your API server until /sidecar-excel revoke. Workbook content goes to your configured model provider, and an opened workbook can inject instructions, so open only documents you trust. Dangerous-command approvals cannot be answered from the sidebar and time out as denied. Office.js loads from Microsoft. Uninstalling does not remove OS trust.CommunitytoolsAtlasOmniaatlas-sidecar-powerpointSidecar by Atlas Omnia — Your Hermes agent, in the sidebar of Microsoft Excel, Word, and PowerPoint. Sidecar puts your Hermes agent in a side panel next to the file you're working on. Ask it to draft, edit, analyze, or build without leaving your document, spreadsheet, or deck. In PowerPoint it reads slides, adds slides, text boxes and shapes, replaces and formats text, and reorders, deletes or re-lays out slides. After one manual local-CA trust step, connect with one click; approval authorizes subsequent chat-driven edits, not per-edit confirmation; runs on your machine, no API key files (protected TLS keys in plugin data). Your agent: it runs on your own Hermes setup, with the models and tools you already use. Setup: install the plugin, enable the Hermes API server, manually trust the per-install local CA using the printed command (never run automatically), run /sidecar-powerpoint manifest to write a manifest for the actual bridge port and sideload it into PowerPoint, click Connect to Hermes and allow it in Hermes with /sidecar-powerpoint. Disclosure — the plugin serves its bundled sidebar at https://localhost:<actual-port>/sidecar-powerpoint/ from an HTTPS listener bound to 127.0.0.1:47650-47654 (first free port) inside the process that runs the Hermes gateway (or plugin host) from when the gateway loads the plugin (setting autostart, default on; off: from the first /sidecar-powerpoint or sidecar_powerpoint_* call) until the plugin stops or Hermes exits; by default it accepts the same exact https://localhost:<actual-port> origin and exactly one Host localhost:<actual-port>. An external HTTPS site remains optional through addin_base; the default needs no web hosting. A per-install CA and localhost certificate are generated in plugin-data/atlas-sidecar-powerpoint/tls/; private keys are owner-only, never logged. For TLS it can only vouch for localhost. The trust command does not limit the certificate to TLS, so protect the key file and remove the trust when you stop using Sidecar. Critical permitted DNS localhost subtree and IP 127.0.0.1/32; no IPv6; CA validity is at most 825 days, leaf at most 397. Legacy unconstrained CAs refuse service: manually remove old trust before deleting the TLS directory and restarting. Protect its CA key and remove OS trust manually on uninstall. Requires cryptography>=43. Allowing lets the configured origin use your Hermes agent and all its tools until you revoke. Use a site you control or trust; open only documents you trust. A sidebar gets a session only after the user allows it in Hermes (/sidecar-powerpoint, or hermes sidecar-powerpoint allow); the approval is remembered as a SHA-256 hash of a per-sidebar grant in plugin-data/atlas-sidecar-powerpoint/approvals.json (owner-only) and revoked with /sidecar-powerpoint revoke. No Sidecar tool can approve; an agent with shell access could run the CLI allow command, subject to Hermes command approval. Forwards the sidebar's chat requests to the user's Hermes API server on loopback (setting api_server_url, default http://127.0.0.1:8642) with API_SERVER_KEY (requires_env, secret) read through agent.secret_scope.get_secret, kept in memory only, never written, logged or sent to the sidebar. The bundled sidebar is served by the plugin at https://localhost:<actual-port>/sidecar-powerpoint/; it loads Microsoft's Office.js from appsforoffice.microsoft.com and sends document data only to the same-origin localhost bridge. An external HTTPS host is optional through addin_base; the default requires no web hosting. A reproducible optional external build (npm run build:static) writes SHA256SUMS. Tool calls from another Hermes chat than the sidebar's are refused. The bridge makes no other outbound service calls, runs no shell commands and has no telemetry or self-updater. Hermes itself uses the configured model/provider and tools; local bridge transport is not a promise of local-only inference. Same author as Workbench (hermes-office-desktop, Office for the web in Hermes Desktop); separate lineage (desktop Office sidebar), distinct sidecar_powerpoint_ tool names and ports, installable together. Sidecar is developed by Atlas Omnia. It is not affiliated with or endorsed by Microsoft or Nous Research. Microsoft, Excel, Word, and PowerPoint are trademarks of the Microsoft group of companies.CommunitytoolsAtlasOmniaatlas-sidecar-wordSidecar by Atlas Omnia — Your Hermes agent, in the sidebar of Microsoft Excel, Word, and PowerPoint. Sidecar puts your Hermes agent in a side panel next to the file you're working on. Ask it to draft, edit, analyze, or build without leaving your document, spreadsheet, or deck. In desktop Word for Mac it reads the document and selection, inserts and replaces text, applies exact-match edit plans, formatting, styles and comments. After one manual local-CA trust step and pane approval, the agent may read and write the bound document; this is not per-edit approval. No API keys stored by the plugin; TLS private keys are protected in plugin data. Your agent: it runs on your own Hermes setup, with the models and tools you already use. Setup: install the plugin, enable the Hermes API server, manually trust the per-install local CA using the printed user-scope command, run /sidecar-word manifest (or hermes sidecar-word manifest) to create and sideload a manifest for the plugin-served localhost sidebar, click Connect to Hermes and allow it in Hermes with /sidecar-word. GitHub Pages or self-hosting is not required by default; a self-hosted HTTPS site may still be selected through addin_base. Disclosure — runs an HTTPS listener at https://localhost:47630-47634 bound to IPv4 127.0.0.1 (first free port) inside the process that runs the Hermes gateway (or plugin host) from when the gateway loads the plugin (setting autostart, default on; off: from the first /sidecar-word or sidecar_word_* call) until Hermes exits; it accepts only the sidebar site's exact origin (plugin setting addin_base) and exactly one Host localhost:<actual-port>. A per-install CA and localhost certificate are generated in plugin-data/atlas-sidecar-word/tls/; private keys are owner-only, never logged. For TLS it can only vouch for localhost. The trust command does not limit the certificate to TLS, so protect the key file and remove the trust when you stop using Sidecar. TLS name constraints permit DNS localhost subtree and IP 127.0.0.1/32; no IPv6; CA validity is at most 825 days, leaf at most 397. Legacy unconstrained CAs refuse service: manually remove old trust before deleting the TLS directory and restarting. Protect its CA key and remove OS trust manually on uninstall. Requires cryptography>=43. A sidebar gets a session only after the user allows it in Hermes (/sidecar-word, or hermes sidecar-word allow); the approval is remembered as a SHA-256 hash of a per-sidebar grant in plugin-data/atlas-sidecar-word/approvals.json (owner-only) and revoked with /sidecar-word revoke. No Sidecar tool can approve; an agent with shell access could run the approval CLI subject to Hermes command approval. Allowing lets the whole configured origin use your Hermes agent and all its tools until revoke. Use a site you control or trust; open only documents you trust. Forwards the sidebar's chat requests to the user's Hermes API server on loopback (setting api_server_url, default http://127.0.0.1:8642) with API_SERVER_KEY (requires_env, secret) read through agent.secret_scope.get_secret, kept in memory only, never written, logged or sent to the sidebar. The sidebar page is bundled with the plugin and served at https://localhost:47630/sidecar-word/ (actual bound port in 47630-47634); it loads Office.js from appsforoffice.microsoft.com and sends document data only to the verified HTTPS localhost bridge. GitHub Pages or other hosting is not required; a self-hosted HTTPS site can still be selected through addin_base. A reproducible build (npm run build:sidebar) writes SHA256SUMS. Pane approval authorizes all known tools, including new content and formatting, only for a valid bound session with active approval. Unknown tools, invalid or missing sessions and revoked approvals fail closed. No comment-per-turn guard is claimed without a trustworthy turn id; tool calls from another Hermes chat than the sidebar's are refused. No other network calls, no shell commands, no telemetry, no self-updater. Same author as Workbench (hermes-office-desktop, Office for the web in Hermes Desktop); separate lineage (desktop Office sidebar), distinct sidecar_word_ tool names and ports, installable together. Sidecar is developed by Atlas Omnia. It is not affiliated with or endorsed by Microsoft or Nous Research. Microsoft, Excel, Word, and PowerPoint are trademarks of the Microsoft group of companies.Communitytools
