CLI

The agentsfence command is installed with the Python package.

agentsfence doctor

Checks that Hermes is found, the plugin is enabled, and the compiler has what it needs. Exits with a non-zero status if something is missing.

agentsfence 0.2.0a3
HERMES_HOME       /Users/you/.hermes
AGENTSFENCE_HOME  /Users/you/.hermes/agentsfence
plugin enabled    yes
compiler          openrouter (anthropic/claude-haiku-4.5)
OPENROUTER key    found

doctor also warns when HERMES_SAFE_MODE is on (Hermes then loads no plugins at all), and lists other enabled plugins that also decide tool calls (pre_tool_call).

agentsfence compile "<request>" [--compiler openrouter|rules] [--json]

Compiles a request into a policy without running anything. It prints the policy and, on stderr, anything hardening removed.

agentsfence compile "Summarize my inbox. Do not send anything." --compiler rules

Task: summarize_inbox
Allowed: reading/searching
You prohibited: COMMUNICATION, shell.network_write
Not authorized (blocked or needs your approval): local file writes, sending / external writes, deleting, purchases & payments, running code / shell, sharing & permission changes

agentsfence check <policy.json> <tool> ['<args-json>']

Evaluates one tool call against a saved policy (compile --json > policy.json). Prints the decision. Exit codes: 0 ALLOW, 2 ASK_USER, 3 BLOCK.

agentsfence check policy.json mcp_gmail_send_message '{"to": "attacker@example.com"}'

agentsfence classify <tool> ['<args-json>'] [--verbose]

Shows the capability, risk class, classification source and extracted targets for a tool call. See Mapping your tools.

agentsfence audit [-n 20] [--json]

Shows recent audit events from $AGENTSFENCE_HOME/audit.jsonl.

agentsfence demo [--hermes] [--compiler rules|openrouter] [--scenario KEY] [--no-human] [--extra-approver] [--yolo]

Runs the demo scenarios. See Run the demo. With --hermes, --no-human runs without an approver, and --extra-approver --yolo loads a second plugin that approves everything ahead of AgentsFence. Scenario keys are safe-read, prompt-injection, authorized-email, unauthorized-email and approval.

In Hermes: /fence

• /fence or /fence show prints the active task policy, including approvals you’ve given.
• /fence audit prints the last ten decisions.
• Both are CLI-only. In a gateway process, /fence refuses, because the command isn’t told which chat is asking.