All plugins

sealed

Secret source that keeps provider credentials in one AES-256-GCM encrypted file instead of plaintext .env: a 32-byte key file unlocks the store at startup and the Hermes secret orchestrator applies the values, so precedence and provenance behave like any other source. Ships `hermes sealed init/set/unset/list/status/rotate`; values are read from a prompt or stdin and are never printed or passed in argv. Disclosure — no network, no helper CLI, no subprocesses. Reads the configured store and key file only (default $HERMES_HOME/secrets/sealed.{store,key}, both 0600); refuses to load when a file is group/world readable if secrets.sealed.strict_permissions is on. The CLI writes those two paths (plus .bak copies on init --force and rotate); values are entered by prompt or stdin. By default sealed values overwrite .env / shell values for the same variable (secrets.sealed.override_existing). No telemetry, no self-updater, no daemon. Requires the `cryptography` package, declared as a plugin dependency.

kailashrajhToolsv1.0.0Updated 4 hours ago

About

Secret source that keeps provider credentials in one AES-256-GCM encrypted file instead of plaintext .env: a 32-byte key file unlocks the store at startup and the Hermes secret orchestrator applies the values, so precedence and provenance behave like any other source. Ships `hermes sealed init/set/unset/list/status/rotate`; values are read from a prompt or stdin and are never printed or passed in argv. Disclosure — no network, no helper CLI, no subprocesses. Reads the configured store and key file only (default $HERMES_HOME/secrets/sealed.{store,key}, both 0600); refuses to load when a file is group/world readable if secrets.sealed.strict_permissions is on. The CLI writes those two paths (plus .bak copies on init --force and rotate); values are entered by prompt or stdin. By default sealed values overwrite .env / shell values for the same variable (secrets.sealed.override_existing). No telemetry, no self-updater, no daemon. Requires the `cryptography` package, declared as a plugin dependency.

This plugin has no README in the catalog yet.

More by kailashrajh

2 plugins by kailashrajh in the catalog.

kailashrajhmdvaultMemory provider that treats a folder of Markdown notes as the agent's long-term store: BM25 retrieval with CJK bigrams over an in-memory index, relevant notes injected before every turn (prefetch), four tools (mdvault_search, mdvault_note, mdvault_recent, mdvault_remember), built-in memory writes mirrored into a human-readable vault note, a `hermes mdvault` CLI and a dashboard config panel. No network, no database, no dependencies; the store is plain .md files the user can edit, git and back up. Disclosure — reads only the configured vault folder (file symlinks skipped, excluded directories ignored), writes only inside that folder (new notes with O_CREAT|O_EXCL, plus the ownership-marked mirror note), no telemetry, no self-updater, no background process, no subprocesses. The vault itself lives outside $HERMES_HOME, so `hermes backup` does not copy it.Communitymemory