Configuration

AgentsFence works with no configuration. To change a default, create ~/.hermes/agentsfence/config.yaml. It is deep-merged over the built-in defaults: maps merge key by key, lists replace.

~/.hermes/agentsfence/config.yaml

compiler:
  provider: openrouter             # openrouter | hermes | rules
  model: anthropic/claude-haiku-4.5
  timeout_seconds: 30
  followup: amend                  # amend | keep

evaluation:
  unauthorized:                    # verdict when a call is outside the policy
    UNKNOWN: BLOCK                 # default ASK_USER
    EXECUTION: ASK_USER
  trust_inferred_reads: true       # treat unmapped get_/list_/search_ tools as READ
  missing_policy: fallback         # fallback (read-only) | block
  strict_yolo: false               # true: ASK_USER → BLOCK when Hermes auto-approves
  plugin_conflicts: warn           # strict: ASK_USER → BLOCK when other plugins also decide tool calls

guards:
  require_bound_recipients: true   # sends need a user-named recipient (or approval)
  exfil_url: {enabled: true, max_query_chars: 200, max_token_chars: 64}
  protected_paths: [~/work/prod-secrets]
  secret_paths: [~/.ssh, ~/.aws/credentials, ~/.hermes/.env]

policy:
  ttl_hours: 12
  inject_summary: true             # tell the model which policy is in force

audit:
  enabled: true
  keep_keys: [to, cc, bcc, recipient, target, url, urls, path, action]
  max_value_chars: 200

tools:                             # add or override tool mappings
  mcp_crm_update_contact: {capability: crm.write, risk: EXTERNAL_WRITE, recipient_args: [email]}

Environment variables

Set these in ~/.hermes/.env (Hermes loads it at startup) or in your shell.

Variable	Default	Purpose
AGENTSFENCE_COMPILER_PROVIDER	openrouter	openrouter, hermes or rules
OPENROUTER_API_KEY	—	key for the OpenRouter compiler
AGENTSFENCE_COMPILER_MODEL	anthropic/claude-haiku-4.5	any OpenRouter model id
AGENTSFENCE_COMPILER_BASE_URL	https://openrouter.ai/api/v1	any OpenAI-compatible endpoint
AGENTSFENCE_FOLLOWUP	amend	amend or keep
AGENTSFENCE_MISSING_POLICY	fallback	fallback or block
AGENTSFENCE_STRICT_YOLO	false	ASK_USER → BLOCK under yolo or auto-approval
AGENTSFENCE_HOME	$HERMES_HOME/agentsfence	policies and audit log
AGENTSFENCE_CONFIG	$AGENTSFENCE_HOME/config.yaml	extra config file
AGENTSFENCE_LOG	—	JSON logs on stderr: debug, info or warning

A stricter profile

evaluation:
  unauthorized: {UNKNOWN: BLOCK, EXECUTION: BLOCK}
  trust_inferred_reads: false
  missing_policy: block
  strict_yolo: true
  plugin_conflicts: strict
guards:
  exfil_url: {max_query_chars: 100}

With trust_inferred_reads: false, every MCP tool you use must be mapped explicitly, otherwise it will ask for approval.