airlock: security tool for Hermes Agent

airlock

otsoa-dubief/airlock

Hermes Agent guardrails that hold risky actions for approval once a chat reads untrusted content

In short

airlock is a Hermes Agent plugin that checks every tool call, marks conversations that have read untrusted content, and holds outbound actions for your approval. Reading, searching and drafting stay free.

What airlock does

Web pages, browser snapshots, MCP and plugin output, curl and git clone reads, files in Downloads and optionally customer messages taint a conversation. After that, messages to others, network writes, pushes, memory and skill writes, scheduled jobs, browser clicks and handoffs to other agents wait for a human. Subagents inherit their parent's taint.

Fixed walls hold in every session. Credentials such as ~/.ssh, ~/.aws and .env files, Hermes's own configuration, shell startup files, other Hermes profiles and catastrophic deletions are protected. airlock also reads shell commands the way the shell does, refusing hidden ones like base64 piped to sh, while ordinary pipes pass. Held actions appear in Hermes's approval menu. The README shows a recorded session on a development build of Hermes Agent 0.22.2.

Key features

Taint tracking per conversation
Approval gates for outbound and persistent actions
Protected credentials and Hermes configuration
Shell command parsing for hidden execution
Subagent taint inheritance
hermes airlock status command

When to use it

Stopping a hidden web-page instruction from posting your data
Keeping a mail-reading agent from pushing code unprompted
Auditing which chats are sealed

Who it is for: Hermes Agent users who let the agent browse, read mail or run commands.

How it fits with Hermes Agent

It is built as a Hermes Agent plugin and uses Hermes's own approval menu.

How to install airlock

These commands are copied from the project's README. Check the repository for the latest steps before you run them.

hermes plugins install otsoa-dubief/airlock/airlock --force --enable
hermes gateway restart

FAQ

What is airlock?

airlock is a Hermes Agent guardrail plugin that seals conversations after untrusted content is read and requires approval for outbound actions.

How do I install airlock?

Run hermes plugins install otsoa-dubief/airlock/airlock --force --enable, then restart a running gateway. The --force flag is needed because Hermes's plugin scan flags airlock's policy text.

Is airlock free and open source?

Yes. The repository is licensed under Apache-2.0.