⚡ Key takeaways
- In Hermes Agent local mode, every command the agent runs uses your own Windows account. Five checks decide how much a mistake can break.
- Each check is one look or one read-only command. You only change something when the answer is wrong.
- Watch the two shortcuts that switch approvals off: YOLO mode and commands you once approved with “always”.
- These settings catch an agent that makes a mistake. For files or web pages you do not trust, run the whole agent in Docker instead.
Hermes Agent local mode is the default setup: when the agent runs a command, it runs straight on your PC with your rights, and nothing stands in between. That is what makes it useful, and it is also why five settings matter. This checklist takes about ten minutes. Each step has the same four parts: why it matters, how to check it, what a good answer looks like, and how to fix it.
Hermes Agent local mode: the five checks at a glance
Table 1 is the whole checklist. If every row already matches, you are done.
| Check | Safe answer |
|---|---|
| 1. Approvals | smart or manual |
| 2. Unattended runs | deny, three times |
| 3. Shortcuts | YOLO off, no “always” entries you do not recognize |
| 4. Write limit | Your project folder plus the Hermes folder |
| 5. Who can message your bot | Only your own user ID (skip if you use no chat app) |
Before you start
Open PowerShell. The checks only read settings and change nothing. You can also let Hermes do the reading: in Hermes Desktop or in chat, say “Run hermes config get approvals.mode and tell me the answer.” Type the fixes yourself in PowerShell, so the agent never changes its own safety settings.
Hermes keeps its settings in %LOCALAPPDATA%\hermes\, and hermes config set writes each one to the right file there. On Linux or macOS? The differences are at the bottom of this article.
Step 1: keep approvals on
Why: approvals pause Hermes before a dangerous command, such as deleting a folder, so a mistake does not run unseen.
Check:
hermes config get approvals.modeGood if you see: smart (the default: Hermes asks you only about unclear cases) or manual (Hermes always asks). off means no checks at all.
Fix (only if it says off):
hermes config set approvals.mode smartDone when: the check shows smart or manual.
Step 2: keep unattended runs on deny
Why: when nobody is there to answer, such as during a scheduled job, Hermes needs a fixed answer for dangerous commands.
Check:
hermes config get approvals.cron_mode
hermes config get approvals.single_query_mode
hermes config get approvals.unattended_modeGood if you see: deny three times. That is the default. approve lets every dangerous command through while you are not watching.
Fix: for each name that says approve, run the set command with that name. For the first one:
hermes config set approvals.cron_mode denyDone when: all three checks show deny.
Step 3: check the two shortcuts that switch approvals off
Why: steps 1 and 2 do nothing while YOLO mode is on, or for a command you once approved with “always”.
Check: in Hermes Desktop, look at the YOLO toggle in the status bar; our Hermes Desktop guide shows where that is. In the terminal, YOLO is on when a session starts with a red YOLO warning. Then open your settings file and find command_allowlist:
hermes config editGood if you see: the toggle off, no red warning, and a command_allowlist that is missing, empty or holds only commands you recognize.
Fix: switch the toggle off and stop starting Hermes with hermes --yolo, /yolo or HERMES_YOLO_MODE=1. Delete allowlist lines you no longer want, save the file and restart Hermes.
Done when: a new session starts without the YOLO warning.
Step 4: limit where the agent may write files
Why: with a write limit, the agent’s file tools refuse to write outside the folders you name. Shell commands, such as a registry change or a delete, are not stopped by it; those go through the approvals of step 1.
Check: this prints the setting if it exists, and nothing if it does not:
Select-String HERMES_WRITE_SAFE_ROOT "$env:LOCALAPPDATA\hermes\.env"Good if you see: one line with your project folder and the Hermes folder. PowerShell puts the file path and line number in front of it.
Fix (if nothing prints): name both folders, separated by a semicolon. Without the Hermes folder, Hermes can no longer save its own scheduled jobs and skills. Working on several projects? Name the folder they all live in, so you never have to change it. Replace YourUsername and my-project, then restart Hermes:
hermes config set HERMES_WRITE_SAFE_ROOT "C:\Users\YourUsername\projects\my-project;C:\Users\YourUsername\AppData\Local\hermes"Done when: the check prints your two folders.
Step 5: make sure only you can message your agent
Why: once Hermes answers on Telegram, Discord, WhatsApp or Slack, anyone who can message the bot can give it instructions. Skip this step if you only use Hermes on your PC.
Check:
Select-String ALLOWED_USERS "$env:LOCALAPPDATA\hermes\.env"
hermes pairing listGood if you see: a line that ends in your own user ID. Lines that start with # are switched off and do not count. There should be no active line with GATEWAY_ALLOW_ALL_USERS=true, which lets anyone in.
Fix: set your own numeric ID and restart the gateway. For Telegram, @userinfobot tells you your ID; our Telegram gateway guide has the full setup. Other apps work the same with DISCORD_, WHATSAPP_ or SLACK_ALLOWED_USERS.
hermes config set TELEGRAM_ALLOWED_USERS 123456789
hermes gateway restartDone when: both checks show only your ID. Anyone else who messages the bot now gets an 8-character pairing code instead of an answer; approve only a code you expect.
One habit: read project files first
Hermes reads an instruction file from the folder you work in and follows it in every conversation. In a project you downloaded, someone else wrote that file. Before you start Hermes in a folder you did not create, open these files if they exist: .hermes.md, HERMES.md, AGENTS.md, AGENTS.override.md, CLAUDE.md, .cursorrules and the files in .cursor\rules\. Hermes blocks a file that says things like “ignore previous instructions”, but your own read catches what that scan misses.
Where these settings stop
The Hermes docs are plain about local mode: “Commands run directly on your machine with no isolation.” The checks above catch an honest agent that gets something wrong. In the docs’ own words, the write limit “does not sandbox a hostile or compromised agent”. It guards the file tools, not the shell, and a shell command can still reach anything your account can reach.
The real risk is text the agent reads. A web page or a downloaded file can contain sentences written for the model rather than for you. For input you do not trust, the docs advise containment: OS permissions and an isolated backend. In practice, that means running the whole agent in Docker, where the official image sets the write limit for you.
Frequently asked questions
Do I need Docker to run Hermes Agent safely?
Not for your own projects on a PC you control, as long as the five checks pass.
Do I need to redo this after an update?
Run the checks again after each update. They take a minute and show at once if a default changed.
On Linux or macOS: the differences
The Hermes folder is ~/.hermes/, and folders in the write limit are separated by a colon. In steps 4 and 5, replace Select-String … "$env:LOCALAPPDATA\hermes\.env" with grep … ~/.hermes/.env. Step 4’s fix becomes:
hermes config set HERMES_WRITE_SAFE_ROOT "$HOME/projects/my-project:$HOME/.hermes"Every other command is the same.
This article is part of the Agentic AI series.
Discover more from Factnetize
Subscribe to get the latest posts sent to your email.
John Lock
Liked this? There's more where it came from.
Get our digest — articles worth your time, no spam, unsubscribe in one click.
Subscribe to Factnetize →
