LACP: security tool for Hermes Agent

Local policy, approval and recovery controls that wrap CLI coding agents such as Claude, Codex and Hermes

What LACP does

LACP runs on your machine and keeps remote execution opt-in. The coding-agent host still owns its model, tools, session and interface, while LACP owns the contract around a run: where it may execute, which risk tier applies, when approval is required, what evidence must be kept and how a failed change is recovered. Its controls fall into execution (risk tiers, budgets, context contracts, local or remote sandbox routing), verification (browser, API and contract evidence with PR preflight), memory (session memory, Obsidian workflows, provenance) and coordination (worktree isolation, tmux sessions, swarm manifests).

Commands include lacp run to route a task through policy gates, lacp worktree create and lacp up to run parallel agents on isolated Git worktrees, and lacp doctor to check the setup. One recipe in the README notes that lacp adopt-local wraps claude and codex only and that Hermes stays native, so check how your version treats Hermes. The README lists version 0.10.1 and notes that the Homebrew bottle may lag behind main.

Key features

Risk tiers, budgets and context contracts for each agent run
Approval gates and execution records with provenance
Evidence manifests and PR preflight checks for browser, API and contract tests
Session memory and Obsidian workflows with ingestion controls
Git worktree isolation, tmux sessions and swarm manifests for parallel agents
Rollback paths for failed changes

When to use it

Hardening local coding-agent usage with policy and budget gates
Running one risky command, such as a dependency update with tests, under explicit controls
Generating PR-ready evidence before opening a pull request
Running several agents in parallel on isolated worktrees

Who it is for: Developers and teams who run CLI coding agents locally and want approvals, evidence and recovery around each run.

How it fits with Hermes Agent

The description lists Hermes among the agents LACP wraps, though one README recipe says its adopt-local command wraps claude and codex only and leaves Hermes native.

How to install LACP

These commands are copied from the project's README. Check the repository for the latest steps before you run them.

brew tap 0xNyk/lacp && brew install lacp
lacp bootstrap-system --profile starter --with-verify

FAQ

What is LACP?

LACP is a local-first control plane for CLI coding agents. It adds deterministic routing, approval gates, execution records, memory controls and rollback paths around each run.

Does LACP work with Hermes Agent?

LACP names Hermes among the CLI agents it covers. A README recipe says lacp adopt-local wraps claude and codex only and that Hermes stays native, so confirm the current behavior in the docs.

Is LACP free and open source?

LACP is open source under the MIT license. It is installed with Homebrew or a bootstrap script pinned to a published tag.