All plugins

tracekit

Tracekit's signer decides every tool call before it runs (deny blocks, ask waits for a person) and signs each call and its outcome into a run you can verify offline. Disclosure — every tool call's name and arguments, plus its result (in full for tools Tracekit's policy marks untrusted, otherwise a SHA-256 digest), go to a Tracekit signer: by default a same-user dev signer (`python -m tracekit signer serve --dev`) that the plugin starts on first use as a detached background process, which keeps running after Hermes exits until 15 minutes idle and stores signed runs plus each call's redacted arguments and results (encrypted, kept 7 days) under your user's data directory (~/.local/share/tracekit on Linux), or a remote signer when you set TRACEKIT_SIGNER to an https:// URL. The plugin fails closed: when tracekit-ai can't load or the signer refuses or can't be reached, tool calls are blocked (including every tool an execute_code script calls), and an `ask` decision holds the call until someone approves it in Tracekit or Hermes's hook timeout runs out.

Cygnux-Labs575Toolsv0.1.0Updated 12 days ago

About

Tracekit's signer decides every tool call before it runs (deny blocks, ask waits for a person) and signs each call and its outcome into a run you can verify offline. Disclosure — every tool call's name and arguments, plus its result (in full for tools Tracekit's policy marks untrusted, otherwise a SHA-256 digest), go to a Tracekit signer: by default a same-user dev signer (`python -m tracekit signer serve --dev`) that the plugin starts on first use as a detached background process, which keeps running after Hermes exits until 15 minutes idle and stores signed runs plus each call's redacted arguments and results (encrypted, kept 7 days) under your user's data directory (~/.local/share/tracekit on Linux), or a remote signer when you set TRACEKIT_SIGNER to an https:// URL. The plugin fails closed: when tracekit-ai can't load or the signer refuses or can't be reached, tool calls are blocked (including every tool an execute_code script calls), and an `ask` decision holds the call until someone approves it in Tracekit or Hermes's hook timeout runs out.

Tracekit plugin for Hermes Agent

Experimental: this works and is tested, but may change and gets less hardening than Tracekit's
stable core.

Tracekit records every tool call Hermes makes as a signed, hash-chained
event, written by a signer the agent can't control, and gates each call with the signer's policy first: a deny blocks
the call, and an ask waits for a person to approve it. The run exports as a bundle anyone can verify offline.

The plugin registers two hooks, pre_tool_call and post_tool_call, and nothing else.

Install

hermes plugins install Cygnux-Labs/Tracekit/integrations/hermes
# so an approval can wait up to ~10 minutes (with Hermes's defaults: ~25 s)
hermes config set plugins.hook_callback_timeout 600
hermes config set timeouts.tools.sequential_call 600
hermes config set timeouts.tools.concurrent_batch 600

The plugin depends on tracekit-ai 1.4.2 or later, the first release with its hooks, which Hermes installs into its
environment with your consent. With no signer
configured, the first tool call starts Tracekit's same-user dev signer. To use another signer, set TRACEKIT_SIGNER
in Hermes's environment (a Unix socket path, tcp://127.0.0.1:PORT with TRACEKIT_SIGNER_TOKEN, or an https:// URL
with TRACEKIT_SIGNER_TOKEN_FILE).

Each Hermes session is one run, closed when Hermes exits; then tracekit last exports and verifies it.

What it does

  • Before each call, the signer decides it under the model's tool-call id. A deny blocks the call and the model
    reads the rule that blocked it. An ask waits inside the hook until someone approves it (tracekit approvals) or
    until shortly before Hermes's limits for the call end (plugins.hook_callback_timeout and the tool deadline), then
    the call runs or is blocked.
  • After each call, the signer records the outcome against the decision.
  • Fails closed. If the signer refuses the call or anything else goes wrong, the call is blocked; so is a call made
    while the signer can't be reached, unless the signer's policy sets the run's fail mode to open (and every call of
    a session whose run couldn't be registered). When the plugin can't load tracekit-ai, it blocks every call, and it
    blocks every tool an execute_code script calls: Hermes gives those no tool-call id.

Details, and what Tracekit doesn't see: Hermes Agent.

Disclosures

  • Network: each tool call's name, arguments and outcome go to the Tracekit signer you configure: by default the
    same-user dev signer over a local socket. A result goes in full only for a tool the signer's policy marks
    untrusted; otherwise only its SHA-256 digest. Nothing else is contacted.
  • Background process: with no TRACEKIT_SIGNER set, the plugin's first call starts the dev signer
    (tracekit signer serve --dev) as your user, if one isn't running. It stores the runs under your user's data
    directory and, in dev mode, keeps each call's redacted arguments and result encrypted for 7 days.
  • Reads outside the plugin: Hermes's plugins.hook_callback_timeout and timeouts.tools.* (through
    hermes_cli.config) and HERMES_CONCURRENT_TOOL_TIMEOUT_S, and the environment variables and files Tracekit's
    client reads to find its signer: TRACEKIT_SIGNER,
    TRACEKIT_SIGNER_TOKEN_FILE, TRACEKIT_SIGNER_CA, TRACEKIT_SIGNER_CERT, TRACEKIT_SIGNER_KEY, and in Tracekit's
    system mode /etc/tracekit/client.json.
  • Credentials: TRACEKIT_SIGNER_TOKEN is read with Hermes's get_secret; with several profiles, a profile without one uses
    none (with one profile, Hermes falls back to the process environment). The
    plugin stores nothing.
  • Approvals: the plugin never answers Hermes's own approval prompt; Tracekit's approvals are answered in Tracekit.

README from the reviewed commit d41c68e; it updates when the author re-pins.