aarvion-guard-hermes

aarvion-guard-hermes

Governance plugin for Hermes agents. Intercepts tool calls and inbound messages, forwarding them to the local Aarvion Guard daemon for policy evaluation.

Install

pip install aarvion-guard-hermes
hermes plugins enable aarvion-guard

Setup

1. Install the guard daemon:

   npx @aarvionai/guard
   

2. Pair with your Aarvion dashboard:

   aarvion-guard init <pairing-code>
   

3. Start the guard and run your agent:

   aarvion-guard service start
   hermes run
   

Container

For non-bypassable enforcement, run the pre-built governed container:

docker run -e AARVION_TOKEN=<token> aarvion/hermes-governed:latest

How it works

The plugin registers two Hermes hooks:

• pre_tool_call - every tool invocation is sent to the guard PDP for allow/deny/ask evaluation
• pre_gateway_dispatch - inbound messages are checked against channel governance policies

The guard daemon handles surface classification, DLP scanning, and policy evaluation. The plugin is intentionally thin - it sends raw tool name + args and trusts the guard's Go normalizer.