Hermes Agent: app connectors and plugins grant different kinds of access

A connector acts in the account you authorize

Version 0.22.0 describes hosted-app connectors reached through the Nous Tool Gateway. Setup opens browser authorization, then makes the tools available in chat. The Connectors page brings those apps and MCP servers into one list, but they remain different connection methods.

Several accounts of one app can have names, such as work and home. The documentation requires selecting the account when several named accounts are active. Check this before requesting a change: authorizing a personal account does not authorize your work account.

Version 0.22.0 offered a free connector-only identity. Version 0.22.5 now announces device-code sign-in, handover from a guest to the signed-in account and a result identifying that account; connectors offer sign-in rather than opening a guest. Check the effective account before a write. This does not make every tool free: the documentation still distinguishes connectors from the wider Tool Gateway. We report no unverified price or quota.

The catalog pins reviewed code, not an absolute guarantee

The catalog introduced during the 0.21 cycle and documented in 0.22.0 lets you install a plugin by name. Each entry points to an exact commit reviewed by a maintainer. An author cannot change that installed code simply by pushing a new revision to a branch.

The documentation says this point-in-time review is not a security audit. A desktop plugin runs inside the app and is not an isolated web page. Installing from a Git URL outside the catalog takes a different route without the same review. Read what an extension needs before giving it credentials.

Recent catalog additions serve different jobs

The 0.22.4 notes list bubblewrap for a Linux bwrap terminal backend, Singularity/Apptainer, and mcp-serve for exposing Hermes as an MCP server. They also name agent-importers, now supporting Cursor, plus inbox and workflow-record from Hermes Labs. Telegram Business moves to the Hermes Labs community tier.

These are catalog entries, not features all enabled by an update. Installing an isolated terminal backend does not establish that other tools have changed their boundaries. Check which backend is actually selected.

The official entries make the choice more concrete. bubblewrap is Linux-only: its sandbox covers terminal and execute_code commands, not file-reading and writing tools running on the host. Background processes do not persist after a command. Singularity/Apptainer also targets Linux, particularly shared systems without Docker, and requires the corresponding runtime to be installed. Neither name proves that every part of your installation is isolated.

mcp-serve lets the connected MCP client read the active profile’s conversations and send messages through its connected accounts. Its --tools option adds selected Hermes tools under their configured providers and costs; it does not expose the terminal. Treat this as access to your messaging, not merely a function catalog. For agent-importers, start with a --dry-run preview. The plugin imports items such as rules, memories and MCP servers into the active profile; secrets are excluded by default. Migrating allowlisted OpenClaw secrets is a separate explicit choice.

Cua Spaces and Meshy: where do work and files go?

The catalog documentation lets us examine two recent additions without using social announcements. Cua Spaces 0.4.0 requires at least Hermes 0.21.6 and moves terminal, file and code work into a selected local or remote machine. Its detailed matrix limits desktop, browser and computer_use placement to compatible Linux Spaces, not macOS or Windows Spaces. Do not infer the browser’s location from the terminal backend.

By default, a Space created for the session is deleted on exit and risky-command prompts are skipped because it is treated as a disposable sandbox. Export anything you want to keep before the session ends. An existing named Space is not deleted and retains those prompts. Check the file destination and Cua SDK telemetry too: the plugin and its SDK make separate disclosures.

Meshy 0.4.0 requires at least Hermes 0.22.3, Node.js 18 or later and a Meshy API key. Its MCP server runs locally, but the relevant prompts, images and models go to Meshy’s API. The plugin requires approval for paid operations and refuses them without an approver in an unattended run. Cost estimates depend on the operation and Hermes build; a local server does not make generation local or free.

OAuth and updates: review the requested access

The 0.22.3 release adds plugin-declared OAuth clients that Hermes signs in and refreshes. It also adds available-update offers in hermes plugins update and a Desktop update button for Git-installed plugins. An extension’s sign-in is not the same as the main model’s access.

The documentation calls for confirmation when a new catalog revision adds tools, hooks, dependencies or OAuth clients, among other changes. It explicitly describes granted capabilities as a consent and audit layer, not a sandbox. A per-profile plugin process, also optional depending on context, is not an operating-system isolation boundary by itself.

For extension authors, post_compaction reports a compaction actually committed to the conversation. This event carries identifiers and counts, not message contents. It can help an external memory restore useful context; the hook does not guarantee complete history retention.

Passwords bypass the model, not the receiving website

The vault described in the documentation and release notes fills logins from the local Hermes vault, 1Password or Bitwarden without placing the password value in the model’s context. Filling is bound to the exact saved website origin. Temporary codes can use the same protected route.

The receiving website can read the password, just as it can when you type it yourself. A hosted browser also sees the page. The documentation therefore does not promise protection against the correct website being compromised. Filling a card requires confirmation and is refused in unattended sessions.

Take over when a bot reaches a login

Bot Screen lets you watch a bot’s desktop on a Linux gateway and take control for a login, approval or CAPTCHA. With the Docker, SSH or Singularity backends described in the release notes, the bot’s screen and browser follow that environment rather than necessarily using your everyday desktop.

Start with one app and a task with no irreversible consequence. Check the account, permissions and result before extending access. We have not installed these plugins or tested the screen-takeover workflow.

• A local model does not make connectors local↗
• The Hermes Agent project overview↗