Hermes

Integrate Intutic governance with Hermes Agent by Nous Research — the skill-based AI developer agent.

How it works

Intutic registers a pre-tool shell hook in Hermes' user config, ~/.hermes/config.yaml (hooks.pre_tool_call), pointing at ~/.intutic/hooks/hermes-check.sh, which filters shell commands and tool calls and blocks with exit code 2. It also installs a governance skill that tells the agent the hook exists, and writes your SOPs into a marked section of the workspace's AGENTS.md, which Hermes reads as instructions. It does not change Hermes' model provider settings — point Hermes at the proxy yourself.

Setup

1. Initialize Intutic

intutic init

The CLI detects Hermes and registers it as a harness:

  ✔ hermes → /path/to/project/AGENTS.md

intutic init only detects the harness and records it in ~/.intutic/config.json; it writes no harness files. The files described on this page are written by intutic gates install (open core, no control plane), from the rule sets in .intutic/sops/ — see What writes harness files:

intutic gates install

2. Start the proxy

intutic start

What gets written

Intutic generates:

• Rules: the section between <!-- INTUTIC:RULES:START --> and <!-- INTUTIC:RULES:END --> in the workspace's AGENTS.md, written when at least one SOP targets Hermes or another AGENTS.md reader in the workspace. Your own text in the file is kept, and the section is shared with every other harness that reads AGENTS.md (see Where rule sets go). A .hermes.md or HERMES.md between the working directory and the git root takes the place of AGENTS.md for Hermes, so keep your Hermes instructions in AGENTS.md. Once Intutic creates AGENTS.md in a workspace that only had a CLAUDE.md, Hermes reads AGENTS.md in its place.
• Hook registration: an entry in the hooks.pre_tool_call list in ~/.hermes/config.yaml, with fail_closed: true (Hermes refuses the call if the gate times out, crashes or prints something it cannot read; its default is to run it) and timeout: 10. Your own entries in the list, and the rest of the file, comments included, are kept; a file that does not parse is left untouched. Earlier versions wrote hooks.preToolUse, which Hermes skips as an unknown event; Intutic replaces it. Hermes asks you to approve a shell hook the first time it sees it.
• Hook script: ~/.intutic/hooks/hermes-check.sh.
• Skill: ~/.hermes/skills/intutic-governance/SKILL.md — tells the agent that tool calls are checked and not to work around a block.

An agent cannot take the gate out of ~/.hermes/config.yaml: the Intutic gate refuses a tool call that names .hermes/config.yaml, reading it included, under Hermes and under every other harness with a hook gate. If the entry goes anyway, run intutic gates install to put it back. Change the Hermes config yourself.

To undo what intutic gates install writes here, run intutic disconnect --harness hermes: each file goes back to what it held before Intutic first wrote it, or is deleted if Intutic created it, and edits you made since are kept. In AGENTS.md only the marked section is taken out, and it stays while another harness that writes it is still connected. See intutic disconnect.