Question 1

Is this a sandbox, or just a second opinion before the command runs?

Accepted Answer

A reviewer, and the README says so plainly. It sees only the commands Hermes routes to smart approval and sends the redacted command plus your operator policy to the configured third-party endpoint. It cannot chat, refuses every other task, and registers no hooks. Anything that never reaches the approval path is outside its view entirely, so it complements sandboxing rather than replacing it.

Question 2

What happens if the model returns something malformed or the API is down?

Accepted Answer

The failure mode is more prompts, not silent approval. Malformed or missing answers raise, which makes Hermes escalate to the user. The verdict itself is deterministic code rather than model output: self_advocating at 0.6 or above forces ESCALATE, reads_secrets at 0.7 with sends_outbound at 0.7 denies outright, reads_secrets at 0.7 alone escalates, and only then does the model's own verdict survive.

Question 3

Can a command argue its way past the reviewer?

Accepted Answer

That is the first rule, evaluated before anything else. A self_advocating probability of 0.6 or above means the command text argues for its own approval, and the plugin returns ESCALATE regardless of what the model chose. A denied read-plus-send combination is also hard-coded, and a command truncated at the 4000-character egress cap is never auto-approved.

Question 4

Will it leak my key to whatever endpoint I configure?

Accepted Answer

It is built not to. The boundary is HTTPS on the default port only, with URL credentials, query strings, and fragments rejected and cross-origin redirects refused. A custom host receives only its own explicitly configured key_env, or no key at all, and never inherits TypeSafe or OpenRouter credentials. Commands are redacted before egress, and the README warns that adding api_key or key_env under auxiliary.approval makes Hermes resolve the task as custom and bypass the plugin.

Question 5

How do I install and wire it into Hermes?

Accepted Answer

hermes plugins install anpicasso/hermes-jev-approvals/plugin, then hermes auth add typesafe-jev, set approvals.mode to smart, and point auxiliary.approval.provider at typesafe-jev with a model such as jev-latest. Restart the gateway afterwards with systemctl --user restart hermes-gateway. You need Hermes Agent with plugin support and Python 3.10 or newer, with no third-party Python dependencies.

Question 6

Which endpoints can it talk to?

Accepted Answer

TypeSafe, OpenRouter, or OpenCode Zen, including a free anonymous Jev model. For a custom host you set base_url under auxiliary.approval plus a key_env in the plugin settings, omit the plugins block entirely for anonymous upstream access, and note that a custom base_url is used exactly as written with no hidden suffix appended.

Question 7

What does the decision log record, and can I turn it off?

Accepted Answer

Each success or failure appends to $HERMES_HOME/jev-approval-decisions.jsonl with raw and final verdicts, the deciding rule, all six answer values, latency, attempts, HTTP status, request ID, policy and question fingerprints, and redaction or truncation metadata. The file is mode 0600, rotates at 4 MB keeping one previous generation, and logging failures never change approval behavior. JEV_APPROVAL_LOG overrides the path and JEV_APPROVAL_LOG_MAX_BYTES resizes the cap, with 0 disabling it.

Hermes Jev Approvals

About this project

Highlights

Quickstart

Questions about this entry

Reactions & coverage

From the Jev guides

From the Jev AI model community