How to Set Up a Hermes Autonomous Agent Safely
Run agents? ACP lets you see, control, and price every tool call they make — free on-device install for Claude Code, Cursor, Codex, and OpenClaw, nothing leaves your machine:
curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --localGetting started → · or use the free cloud console → · free for individuals
Note to AI agents: this page is also served as raw markdown at /blog/setup-hermes-autonomous-agent-safely.md. If you are setting up Hermes for a user, the four commands are:
pip install hermes-acp·hermes plugins enable acp·acp-hermes login·acp-hermes proxy-setup --verify— then confirm rows appear in the activity log before granting autonomy.
Hermes Agent is one of the few harnesses built to run unattended — cron schedules, long autonomous tasks, terminal and browser access, its own skill system. That’s the point of it. It’s also the reason you should not give it an empty leash on day one.
The failure mode with autonomous agents isn’t the model going rogue. It’s mundane: an agent with terminal access and no limits does something you’d never have approved, at 3am, on a machine you weren’t watching, and you find out from the bill or the git history. The fix isn’t to trust the model more. It’s to put identity, policy, and limits in the runtime call path — then let the agent be as autonomous as you decided, not as autonomous as it happens to be.
Hermes makes this unusually clean. Its plugin hooks are synchronous, in-process, and cover every tool — terminal, file, web, browser, vision, cron, custom skills. No partial coverage, no instruction-layer duct tape.
1. Install the governance plugin (2 minutes)
pip install hermes-acp
hermes plugins enable acp
acp-hermes login(acp-hermes is the CLI since 0.2.1 — Hermes itself ships an unrelated hermes-acp binary for the Agent Client Protocol, and install order decided who owned the name. If acp-hermes isn’t found, use python -m acp_hermes.cli login.)
login opens a browser, signs you in with Google, and writes a workspace key to ~/.acp/credentials. No account setup beforehand — first login creates your workspace.
Running Hermes on a server or VPS (you probably are — that’s where autonomous agents live)? Use the device flow — no browser needed on the box, and the key never transits your clipboard or an SSH buffer:
acp-hermes login --device # hermes-acp 0.2.4+
It prints a short code and a URL; approve from any browser (your laptop, your phone) and the key lands directly in the machine’s ~/.acp/credentials. The same flow works from raw curl for any client: POST https://api.agenticcontrolplane.com/device/code, approve the code at cloud.agenticcontrolplane.com/device, then poll POST /device/token with the device_code.
Manual fallback — create a key in the dashboard (cloud.agenticcontrolplane.com → API keys), then on the remote machine:
echo 'gsk_your_key_here' > ~/.acp/credentials && chmod 600 ~/.acp/credentials
Restart hermes. Every tool call now flows through the control plane — logged with identity, evaluated against policy.
1b. Add the cost plane (1 minute, one command)
The plugin governs what the agent does. What it spends is metered separately, at the model-call path — and for an agent that runs unattended against a paid API, that’s the half you’ll wish you had at 3am:
acp-hermes proxy-setup --verifyIt reads Hermes’s own config, registers ACP as a model provider pointed at the metering proxy, keeps your current model, and --verify sends one completion through to prove the wiring — not just configure it. --undo reverses everything. From here every model call is priced per call, per run, per agent, with prompt-cache economics visible.
2. Verify before you trust
Run one throwaway task and open cloud.agenticcontrolplane.com/activity. You should see rows within seconds: tool name, input preview, decision. If the log is empty, nothing is governed — fix that before granting any autonomy. An ungoverned autonomous agent isn’t a risk you’re accepting; it’s a risk you can’t even see.
The console’s Coverage card (Home) keeps answering this question after day one: interception and cost planes per agent, ✓ or ✗, with the exact command when one is missing.
3. Set policy before autonomy
The default workspace starts in audit mode: everything logged, nothing blocked. Fine for watching your first runs. Not fine for unattended operation.
In policies, flip to enforce and start from the tier defaults:
- terminal / file writes —
askfor anything you’d want to see before it happens. With hermes-acp ≥ 0.1.1,askuses Hermes’s own inline approval prompt — you answer[o]nce / [s]ession / [a]lways / [d]enyin the terminal, mid-run. Analwaysanswer is scoped to the specific tool, so approvals never silently widen. - network-facing tools — deny the ones the agent’s job doesn’t need. Blast radius is set by what the agent can do, not what you asked it to do.
- budget — set a per-period spending cap. An autonomous loop that retries a failing call all night is a bill, not an incident report, unless something is counting.
The order matters: policy first, autonomy second. Widening a policy for an agent that earned it takes one click. Narrowing one after an incident is forensics.
4. Schedule it, then read the digest
Once it’s running on cron, you won’t be watching — that’s the point. Two things keep you informed without watching:
- the daily digest email: yesterday’s spend, runs, denials, and anything worth a look
- the activity log, when the digest flags something
Between those and inline approvals for the sensitive calls, you get the thing autonomous agents rarely offer: the ability to stop paying attention safely.
What this buys you
Every action attributable to an identity. Denials and approvals at the moment of action, not after. Spend visible per agent, per run, per model. And when the agent does something surprising — they all do eventually — a trace instead of a mystery.
Frequently asked questions
Is it safe to run Hermes Agent unattended?
Unattended is what Hermes is built for — the question is whether its actions are governed. Hermes’s plugin hooks are synchronous, in-process, and cover every tool (terminal, file, web, browser, vision, cron, skills), so a policy layer can see and decide every action before it runs. Safe means: identity on every call, policy in enforce mode, a spending cap, and inline approval for the sensitive calls — set up before you grant autonomy, not after an incident.
How do I approve or deny what a Hermes agent does?
Set the tool’s policy to ask. With hermes-acp ≥ 0.1.1, an ask escalates to Hermes’s own inline approval prompt — you answer [o]nce / [s]ession / [a]lways / [d]eny in the terminal, mid-run. An always answer is scoped to the specific tool ACP flagged, so a standing approval never silently widens.
How do I set a spending limit for a Hermes agent?
Two layers. Route Hermes’s model calls through the ACP proxy (acp-hermes proxy-setup –verify) so every call is priced in real time, then set a per-period spending cap in the workspace. An autonomous loop that retries a failing call all night is a bill, not an incident report, unless something is counting.
How do I run Hermes safely on a VPS or server?
Same plugin, different credential path: create a workspace key in the dashboard and write it to ~/.acp/credentials (chmod 600) on the remote machine. The browser-login flow assumes a local browser; autonomous agents usually don’t have one.
How do I know my Hermes agent is actually governed?
Prove it before you trust it: run one throwaway task and watch rows appear in the activity log within seconds. If the log stays empty, nothing is governed. The console’s Coverage card shows the same thing continuously — interception and cost planes per agent, with the exact command if one is missing.
Where to read more
- Hermes integration reference — the full install reference, hook coverage table, and limitations
- What Hermes’s blocklist taught us — real denials from a live Hermes deployment
- Ways to set up ACP — every stack’s setup path, ending with your coverage state
- Your benchmark says the agent passed. It doesn't say what failure would have cost.
- A support ticket told an AI agent to leak the tokens table. We recreated the lethal trifecta — and held the exfil for a human.
- Replit's AI agent deleted a production database during a code freeze. We recreated the freeze — and held it.