Nous Research Opens Hermes Plugin Catalog

The four official plugins have a clear character. According to the company, the snyk plugin scans code, dependencies, container images, and infrastructure code through Snyk's own MCP server, and the touchdesigner plugin drives a live TouchDesigner session through an MCP server. hermes-telegram-business is a secretary bot for Telegram Business mode in which every drafted customer reply needs the owner's approval before it is sent. hermes-memory-wiki adds a dashboard tab with subject pages and daily logs derived from local session history, plus a read-only audit panel for the persistent memory files. METAL has reported on Nous Research's launch of Hermes Business and Enterprise, and the fact that three of the four official plugins are a security scan, an approval flow, and an audit panel fits that push.

The community side is broader by the numbers. On the catalog page METAL reviewed, the most-starred entry is web-search-plus, which bundles multiple search providers, at 402 stars, followed by the memory dashboard mnemosyne-dashboard at 215 and icarus, which says the agent remembers its work and trains its replacement, at 148. By category, specialized tools lead with 26 entries, then desktop mods with 23, messaging platforms 15, memory 10, web search 10, hooks and utilities 10, voice 5, automation 5, and inference providers 1. The list includes a plugin that joins a Minecraft server as a bot and relays chat between players and the agent, a 14-tool plugin that controls DaVinci Resolve, an OpenAlex plugin that searches 250 million scholarly works, and a plugin that operates a MetaMask wallet behind approval gates.

Read through a lawyer's eyes, the rules stand out before the list does. According to the company's documentation, the catalog is a curated list pinned by commit hash inside the Hermes Agent repository; installing a plugin by bare name resolves to the pinned commit of the repository that entry points to, and the provenance is recorded. Installing by typing a repository name or a Git URL directly bypasses the catalog and is flagged as a custom, unreviewed source. The documentation draws a firm line between listing and auditing. "A catalog entry means the entry's metadata and declared capabilities were reviewed at admission — it is not a code audit," Nous Research wrote. So a plugin stays disabled after install, enabling it is a separate explicit step, and the right to override built-in tools requires a separate grant on top of that.

The capability system is structured like a contract. A plugin declares capabilities such as overriding built-in tools or choosing the model in its manifest; at install or enable time Hermes shows the list with one-line risk descriptions and asks once, and the consent is recorded with a hash and a timestamp. If an update declares new capabilities, Hermes asks again, and the new capabilities stay off until consent is given. In a non-interactive install with no terminal, the install completes but capabilities are not granted. The documentation states that this layer is consent and audit, not isolation. Plugins run as ordinary in-process Python, so a malicious plugin can ignore every gate, and granting a capability is a statement of trust in the author, not a code audit, the documentation explains.

A static security scan is attached to the install step. According to the company, every install and update scans the whole plugin tree for exfiltration of credential stores, reverse shells, destructive commands, persistence mechanisms, obfuscated execution, and prompt injection in documentation files, and the result falls into one of three verdicts: safe, caution, or dangerous. Caution can be installed after confirmation, but dangerous cannot be overridden even with the force option, and a dangerous verdict on an update disables the plugin until it is reviewed and re-enabled. The documentation says the scan was inspired by Claude Cowork's skill and plugin security scanning. METAL has reported on Claude Code packaging a team's setup into a single plugin for distribution, and Hermes now lets users bundle several plugins, each with a 40-character commit hash, into a shareable YAML file called a plugin pack. Packs carry no secrets, consent is never granted in bulk, and each plugin in a pack goes through its own capability consent.

There are three install paths. Users can search the catalog from the command line and install by name, browse the catalog as cards in the Capabilities menu of Hermes Desktop, or open the desktop app from a single link on a web page. According to the company, Desktop and the public catalog read the same CDN snapshot, browsing does not query GitHub live, and a link only opens a confirmation dialog and never installs automatically. Plugins can hook into 27 lifecycle events, and plugins come in four kinds: general plugins, memory providers, context engines, and model providers. METAL has reported on how Hermes Agent builds its own skills the more it is used. That agent now has a rulebook for the conditions under which it accepts code written by others, and that rulebook, more than the 105 entries on the catalog's first day, is the substance of this announcement.