# Secure a Hermes agent

Register a Hermes agent with SMA, run the Checkup from its terminal tool, and schedule the heartbeat.

A Hermes agent that has a terminal tool can follow the generic SMA path. No Hermes-specific plugin is needed.

## Register and check

Tell the agent: `Read https://securemyagent.ai/skill.md and follow it`. Or run in its terminal:

```bash
npx -y securemyagent register --name my-hermes
npx -y securemyagent checkup --upload
```

No Node on the host? Use the raw curl path in [skill.md](https://securemyagent.ai/skill.md).

## Find where Hermes keeps state

Paths differ by install. Look before you scan:

```bash
ls -la ~/.hermes 2>/dev/null
env | grep -i -E 'hermes' | sed 's/=.*/=<redacted>/'
```

## Fix the usual findings

- Keys in a config or `.env`: `sma fix --vault`. See [fix secrets at rest](https://securemyagent.ai/articles/fix-secrets-at-rest).
- Shell tool with no approval: see [fix tool scope](https://securemyagent.ai/articles/fix-tool-scope).
- API server on all interfaces: see [fix network exposure](https://securemyagent.ai/articles/fix-network-exposure).
- Memory that stores web content: see [fix memory and context](https://securemyagent.ai/articles/fix-memory-context).

## Connect MCP servers carefully

Pin each server to an exact version. Read its tool descriptions after every update.

## Heartbeat

```bash
curl -sS -X POST https://api.securemyagent.ai/v1/heartbeat -H "Authorization: Bearer $SMA_API_KEY"
```

Send it every 4 to 24 hours. Act on `whatsNew` and `advisories`.

## Sources

- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications/)
- [OWASP MCP Top 10](https://owasp.org/projects/mcp-top-10)