All plugins

hephaestus

Ask for a plugin and your own agent writes it, checked by the official validator and doctor; you approve each check, because it runs the draft's code. It installs disabled; only you enable it. Disclosure — forge_check imports each draft's Python and calls its register() on this machine, outside the sandbox, after you approve that exact draft (no prompt if approvals are off or YOLO is on); runs the hermes CLI (fixed argument list, no shell, minimal environment) to validate, doctor, enable, disable and remove plugins; writes forged plugins under HERMES_HOME/plugins and drafts and snapshots in its data folder; a pre_tool_call guard blocks the agent from enabling plugins. No network, no telemetry, no LLM calls.

madebylegionToolsv0.1.0Updated 2 hours ago

About

Ask for a plugin and your own agent writes it, checked by the official validator and doctor; you approve each check, because it runs the draft's code. It installs disabled; only you enable it. Disclosure — forge_check imports each draft's Python and calls its register() on this machine, outside the sandbox, after you approve that exact draft (no prompt if approvals are off or YOLO is on); runs the hermes CLI (fixed argument list, no shell, minimal environment) to validate, doctor, enable, disable and remove plugins; writes forged plugins under HERMES_HOME/plugins and drafts and snapshots in its data folder; a pre_tool_call guard blocks the agent from enabling plugins. No network, no telemetry, no LLM calls.

Hephaestus

Ask Hermes for any plugin your own agent can write: tools, slash commands, Desktop UI. The official Hermes validator and doctor are the hard gate. You hold the switch: the plugin installs off, the agent is blocked from enabling it, a consent card shows what it can touch and what a new version adds, and one click restores the old version byte for byte.

What it looks like

Card: installed off, 18/18 checks, Enable and Roll back

Agent refused when it tried to enable the plugin

Upgrade card: v2 adds environment and internet access

How it works

You say "forge me a plugin that does X." Your agent writes the code from a starting template (tool, command or desktop). Hephaestus runs hermes plugins validate --json and hermes plugins doctor --ci, adds its own checks, builds a permission label, installs a green draft disabled after saving the previous version, and shows a card.

Install

hermes plugins install https://github.com/madebylegion/hermes-plugin-hephaestus
hermes plugins enable hephaestus
hermes plugins doctor hephaestus

Use the full repository URL. A bare local path is read as a GitHub name and fails; to test a local clone, use file:///abs/path/to/clone. Tested on v0.23.1; needs v0.23.1 or newer (each check uses its plugin approval gate).

First run, once: open Capabilities → Plugins and switch on Hephaestus's own Desktop part (press Rescan if it is not listed). Until then you get a plain text card.

Quick start

  1. Forge me a /standup command that summarises my git commits since yesterday.
  2. Forge a Desktop widget that shows the current time in three time zones.

Then press Enable on the card. A new slash command works in the same chat; new tools arrive in the next session. A new Hermes home needs 40–60 s once, over install and first enable. If you type /forge enable <name> in a chat instead, it goes through the CLI and applies from the next session.

The card

  • Enable / Disable switches the forged plugin.
  • Roll back switches it off, runs /forge rollback <name>, and switches it on again, so the restored files load. If the card cannot run the command, it puts it in the composer for you to send.
  • A red "vN adds: …" chip names each permission a re-forge adds.
  • Turn on in Plugins appears for a forged Desktop part, which starts off.
  • There is no Remove button. Use /forge remove <name>.

What only a plugin can do

A skill cannot enforce anything. Hephaestus is code, so it can gate the install by hash (forge_install accepts only a draft whose current bytes passed), refuse on red checks, block agent calls with a pre_tool_call guard, show a consent card, and roll back byte for byte.

Safety model

  • You approve each check. forge_check runs the draft's Python on this machine (see Limits), so Hermes asks you first, for that exact draft (keyed by its tree_sha). If the draft changes, it asks again. Denied, timed out, or no one there to answer (cron, unattended runs): the check does not run.
  • Installed disabled. No forged tool, hook or command is live until you enable it. Only a human enables, and enable always passes --no-allow-tool-override.
  • Hard gate. forge_check fails on any failed validator or doctor check, on symlinks, and on private Hermes imports (the official validator only warns on those). A dangerous security scan also stops the install.
  • Rollback. One previous version is kept. Rollback restores it and checks the hash.
  • Marker file. Hephaestus only touches plugins with .forged-by-hephaestus.

Limits

The guard stops a confused agent, not a hostile one. It is a pattern check.

  • It covers the terminal, execute_code, write_file, patch and process_manage tools. It blocks enabling a forged plugin, editing plugins.enabled, and writing into a forged plugin or desktop-plugins/.
  • It does not cover cronjob, browser code, subagents (delegate_task), computer_use, or MCP tools.
  • It misses a cd to the folder followed by an edit in a second step.
  • It misses a plugin the agent writes by hand outside Hephaestus.
  • A dynamic import such as importlib.import_module('hermes_' + …) gets past the private-import check.
  • The permission label comes from a heuristic code scan. It is for consent, not a sandbox, and can miss code that hides what it does.
  • forge_check executes the draft's Python on this machine. The official validator and doctor import the draft and call its register(), outside any sandbox, as your user. That is why each check needs your approval. The hermes child gets only a short list of environment variables (no provider keys), but the CLI still loads HERMES_HOME/.env itself. If you turned approvals off (approvals.mode: off or YOLO), Hermes does not ask.
  • Tested on Linux only.

Surfaces

Tools forge_new, forge_check, forge_install; command /forge list | enable | disable | rollback | remove <name>; hooks pre_tool_call (guard) and transform_llm_output (adds the card); Desktop desktop/plugin.js.

Tests

python -m pytest -q tests

Needs pytest; takes 4–5 minutes. The tests call the real hermes CLI in a temporary HERMES_HOME.

Disclosure

  • Starts the hermes CLI (validate, doctor, enable, disable, remove). The child gets an explicit environment (PATH, HOME, LANG, TMPDIR, locale, XDG, proxy and certificate variables, plus HERMES_HOME), never the full parent environment.
  • Writes forged plugins to $HERMES_HOME/plugins/ and drafts, snapshots and check records to its own data directory.
  • No network. No telemetry. No LLM calls. Python standard library only.

License

MIT. See LICENSE.

README from the reviewed commit 9805692; it updates when the author re-pins.

Developer Mode

Explore built-in Hermes toolsets and actions.

HermesAgent

Developer?

Create a Hermes extension for Desktop or agent workflows.

Developer Section