Observatory › Hermes Agent
Hermes Agent on Windows: what it can do on your computer
In short
As of 29 October 2026, according to its documentation, Hermes Agent starts in the smart mode: what would otherwise need your permission is approved or blocked by another AI model, not by you.
By default, without asking you, it can read files anywhere with its file tools, read files anywhere on the computer from its terminal, edit files anywhere with its file tools, run commands in its terminal, reach any web address, use every tool of its MCP servers, add-ons that give it extra tools, such as access to other services, borrow other agents' logins when it has none of its own and rewrite those agents' credential files when it refreshes a borrowed login.
On Windows, it keeps its configuration in 5 kinds of files. In 4 of them, keys can be written as they are, unencrypted: any program running under your user can read them.
Mode it starts in
Starting mode: smart
When an action needs permission, who gives it: another AI model.
Commands that match a dangerous pattern go to an auxiliary model that approves, denies or asks you. Other commands run without asking in every mode, manual included.
Official source · accessed on 28 October 2026
What it can do by default
According to the vendor's documentation or source code, before you change any setting.
| Action | Where | By default | Note | Source |
|---|---|---|---|---|
| Read files | Any path | Without asking | Only Hermes' own credential stores and .env files are refused. | Official source |
| Read files | The whole computer | Without asking | No sandbox by default: the shell runs on your computer. | Official source |
| Edit files | Any path | Without asking | System paths, SSH keys, Hermes' config.yaml and common credential files are blocked. | Official source |
| Edit files | Protected paths | Asks first | AGENTS.md, CLAUDE.md, SOUL.md, .cursorrules and .hermes files, in any folder, even with --yolo. | Official source |
| Run commands | All commands | Without asking | Commands matching about 110 dangerous patterns go to the auxiliary model first. | Official source |
| Connect to the internet | Any website | Without asking | Without a search key, searches go to the free tiers of Exa, Parallel, Firecrawl and Keenable. Private addresses are blocked. | Official source |
| Use MCP tools (add-ons) | All MCP tools | Without asking | A server without a trust setting is fully trusted. | Official source |
| Read files | Other agents' credentials | Without asking | With no login of its own, Hermes borrows the Claude Code and Codex logins from %USERPROFILE%\.claude\.credentials.json and %USERPROFILE%\.codex\auth.json (or CLAUDE_CONFIG_DIR, CODEX_HOME). On by default; auth.adopt_external_logins: false turns it off. | Official source |
| Edit files | Other agents' credentials | Without asking | When it refreshes a borrowed Claude Code login, it writes %USERPROFILE%\.claude\.credentials.json (or the file in CLAUDE_CONFIG_DIR); the two programs can log each other out. auth.adopt_external_logins: false in config.yaml stops the borrowing. | Official source |
"Asks first": the action needs permission. Depending on the mode it starts in, you give it, or another AI model does.
Where it keeps configuration and keys
Paths on Windows. %USERPROFILE% is your user folder (C:\Users\your-name); <project> is the folder of each project.
| What | Path on Windows | Keys | Note | Source |
|---|---|---|---|---|
| User settings | %LOCALAPPDATA%\hermes\config.yaml | Can hold unencrypted keys | Also holds the MCP servers. If HERMES_HOME is set, Hermes uses that folder instead of %LOCALAPPDATA%\hermes. | Official source |
| Account keys and logins | %LOCALAPPDATA%\hermes\.env | Unencrypted keys | If HERMES_HOME is set, Hermes uses that folder instead of %LOCALAPPDATA%\hermes. | Official source |
| Account keys and logins | %LOCALAPPDATA%\hermes\auth.json | Unencrypted keys | If HERMES_HOME is set, Hermes uses that folder instead of %LOCALAPPDATA%\hermes. | Official source |
| Account keys and logins | %LOCALAPPDATA%\hermes\mcp-tokens\ | Unencrypted keys | If HERMES_HOME is set, Hermes uses that folder instead of %LOCALAPPDATA%\hermes. | Official source |
| Instructions (files the agent reads and follows) | %LOCALAPPDATA%\hermes\SOUL.md | No keys | If HERMES_HOME is set, Hermes uses that folder instead of %LOCALAPPDATA%\hermes. | Official source |
What RosmarOps does with this agent
Evaluated since RosmarOps 0.5.2: RosmarOps reads its configuration on your computer, without network access, and gives it an Agent Posture Score from 0 to 100: how much it can reach with the permissions it has today.
Security change history
Only changes that affect what it can do on your computer or with your accounts. Nothing is deleted: corrections stay on record.
No security changes recorded yet.
Versions observed
- 0.22.5 · released on 22 October 2026 · Official source
Sources and data
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/agent/anthropic_credentials.py#L544-L565 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/agent/file_safety.py#L335-L414 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/agent/prompt_builder.py · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/cli-config.yaml.example · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/hermes_cli/auth.py · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/hermes_cli/config_defaults.py#L1768-L1774 · accessed on 29 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/hermes_cli/config_defaults.py#L297-L298 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/hermes_cli/config_defaults.py#L396-L401 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/hermes_constants.py · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/tools/approval.py#L1165-L1194 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/tools/file_tools_write_guards.py#L166-L179 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/tools/file_tools_write_guards.py#L189-L262 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/tools/mcp_oauth.py · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/tools/mcp_tool.py#L519-L533 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/blob/bf0203a794a07aac3ff764972ab9087baa4e4f4e/website/docs/user-guide/security.md#L57 · accessed on 28 October 2026
- https://github.com/NousResearch/hermes-agent/releases/tag/v0.22.5 · accessed on 28 October 2026
- This page as JSON
Vendor's reply
None received. If the vendor sends one, it is published here, signed and dated, without changing anything above.
See a factual error? Tell us, with the source: legal@rosmarops.com
Read from the vendor's documentation and source code, each fact with its date and source. Not a security guarantee or advice.