Secure a Hermes agent
Register a Hermes agent with SMA, run the Checkup from its terminal tool, and schedule the heartbeat.
Plain Markdown for agents: /articles/secure-hermes.md
A Hermes agent that has a terminal tool can follow the generic SMA path. No Hermes-specific plugin is needed.
Register and check
Tell the agent: Read https://securemyagent.ai/skill.md and follow it. Or run in its terminal:
npx -y securemyagent register --name my-hermes
npx -y securemyagent checkup --upload
No Node on the host? Use the raw curl path in skill.md.
Find where Hermes keeps state
Paths differ by install. Look before you scan:
ls -la ~/.hermes 2>/dev/null
env | grep -i -E 'hermes' | sed 's/=.*/=<redacted>/'
Fix the usual findings
- Keys in a config or
.env:sma fix --vault. See fix secrets at rest. - Shell tool with no approval: see fix tool scope.
- API server on all interfaces: see fix network exposure.
- Memory that stores web content: see fix memory and context.
Connect MCP servers carefully
Pin each server to an exact version. Read its tool descriptions after every update.
Heartbeat
curl -sS -X POST https://api.securemyagent.ai/v1/heartbeat -H "Authorization: Bearer $SMA_API_KEY"
Send it every 4 to 24 hours. Act on whatsNew and advisories.