Skip to content

Quickstart

Four commands. About two minutes.

Setup provisions a hardware key and writes a local policy file. No account, no registration, nothing sent anywhere.

Step 01 — Install

Pulls the six plugins as one package. The shell installer is the same thing with a version pin.

pip install hermes-mordred

Step 02 — Setup

The wizard generates the hardware key, asks which route you want declared, and writes the policy file. It refuses to finish half-configured.

hermes-mordred setup
generating key in Secure Enclave … done
declare egress route [tor / vpn / clearnet]: tor
writing ~/.mordred/policy.toml … done

Step 03 — Verify

One line per guarantee. Exits non-zero if any of them is unmet, so it works in a pre-flight script too.

hermes-mordred status

met: keyvault Secure Enclave · non-exportable
met: network route = tor · declared
met: e2e 2 gateways · ciphertext only
met: llm_guard active · 1 provider
met: audit log ~/.mordred/audit.age · sealed

5 guarantees met · exit 0

Step 04 — Run

Your usual agent command, with the policy attached. From here on, anything the policy forbids simply does not happen.

hermes agent run --policy strict
policy strict · route tor · guard on · log sealed
agent ready

What just happened on your machine.

A key was born

Created inside the Enclave or TPM with export disabled at creation. It cannot be copied to another machine — including by you.

A policy was written

Plain TOML at ~/.mordred/policy.toml. Read it, diff it, put it in version control. It is the whole configuration.

Nothing was sent

No account, no registration, no version ping. The only network traffic was the package download itself.

Disable or remove

Turning a plugin off is explicit and logged — there is no silent bypass flag.

hermes-mordred disable llm_guard
pip uninstall hermes-mordred

[TBD]Uninstalling leaves the hardware key in place; the destroy command is pending engineering.