Skip to content
MORDRED

Privacy plugins for the Hermes agent

Assume the traitor is inside.

Six privacy plugins for the Hermes agent. Keys stay in the Secure Enclave or TPM, every run declares its route, and every refusal is written down.

Install the suite Read the threat model

Install

pip install hermes-mordred
hermes-mordred setup

Requires hermes-agent ≥ 0.13 · Python ≥ 3.11
macOS 13+ · Secure Enclave or Linux with TPM 2.0

01 — Keys

Generated inside the Secure Enclave or TPM. Never exported, never printed, never synced.

02 — Routes

Tor, VPN, or clearnet — declared per run, switched with one command, never chosen for you.

03 — Proof

An encrypted audit log with a reason code for every refusal, readable only on this device.

Six plugins. One install line.

All six, in detail
mordred_keyvault

Holds the identity. Signing and decryption are requested, never performed in your process — the private key stays behind the platform helper for its whole life.

Read →
mordred_network

Egress is denied by default. A run inherits exactly one declared route — Tor, a VPN, or clearnet — and cannot widen it while running.

Read →
mordred_e2e

Seals message bodies to the recipient before the transport client sees them. Slack, Discord, and mail relays carry ciphertext and metadata, nothing more.

Read →
mordred_llm_guard

The last check before a prompt leaves for a remote model. A match halts the call rather than redacting quietly, because a silent edit hides the real problem.

Read →
mordred_privacy_check

Reads the live configuration rather than the file you meant to write. It decides nothing; it just makes the current state legible, and exits non-zero when a guarantee is unmet.

Read →
mordred_wizard

Guided setup for the other five. It either leaves you in a state the policy can enforce, or stops and tells you which answer is missing.

Read →

How they compose — one outbound message

  1. Agent writes a message
  2. llm_guard scans for secrets
  3. e2e seals the body
  4. network opens the declared route
  5. Slack receives ciphertext

keyvault signs and decrypts underneath all four — the key itself stays in hardware. privacy_check reads the same chain afterwards and reports which links actually held.

What we do not do.

A privacy tool is defined by its refusals, not its features. Here are ours, in the order they matter.

The full threat model
  1. 01

    We do not move your keys.

    There is no export command, no backup blob, no recovery service — lose the device and you lose the identity.

  2. 02

    We do not phone home.

    No telemetry, no crash reports, no update ping. The binary makes no request you did not ask for.

  3. 03

    We do not fail open.

    When a guarantee cannot be met the run stops and prints a reason code. Degraded operation is never the default.

  4. 04

    We do not trust the agent.

    Policy is enforced below it, so a compromised or prompt-injected agent still cannot widen its own permissions.

  5. 05

    We do not read your audit log.

    It is encrypted to your device key and never leaves the machine that wrote it.

Where the trust ends.

Untrusted

  • The agent

Policy — hermes-mordred

  • mordred policy

Trusted — hardware

  • Secure Enclave
  • TPM 2.0
Read left to right — nothing crosses back
See the full boundary

Four commands to a sealed run.

Setup provisions the hardware key and writes a local policy file. Nothing is registered anywhere.

pip install hermes-mordred
hermes-mordred setup
hermes-mordred status
hermes agent run --policy strict
Full quickstart

hermes-mordred status

met: keyvault Secure Enclave · key non-exportable
met: network route = tor · declared in policy.toml
met: e2e 2 gateways · ciphertext only
unmet: llm_guard no guard for provider "openai" — MRD-0142
met: audit log ~/.mordred/audit.age · sealed

1 guarantee unmet · exit 1 · runs will fail closed until resolved

Every refusal carries a code like MRD-0142, so “it stopped” is always answerable.

Status — alpha

v0.1.0a17 is an alpha.

The CLI surface will break before 1.0, and every break is listed in the changelog. Read it before you upgrade a machine you depend on.

ALPHA MIT NO TELEMETRY
Changelog
LICENSE
MIT
TELEMETRY
NONE
PYTHON
≥ 3.11
HERMES-AGENT
≥ 0.13
MACOS
13+ / ENCLAVE
LINUX
TPM 2.0