Upgrading from 4.x? 5.x needs Node 22.14+ or 24+; Node 20 and 23 are unsupported. On Node 20, npm warns and still installs unless engine-strict is set; the database engine will not load. Read the guide.

Integration

ShieldCortex for Hermes

A Hermes-native pre_tool_call plugin. It asks the local ShieldCortex API before a tool runs, and it blocks out of the box.

Install

The plugin ships in the npm package. It talks to a local ShieldCortex API over REST.

1
npm install -g shieldcortex

Node 22.14+ or 24

2
shieldcortex hermes install

Copies the plugin to ~/.hermes/plugins/shieldcortex

3
hermes plugins enable shieldcortex

Enforces by default. Set SHIELDCORTEX_ENFORCE=0 for watch-only

4
shieldcortex api

The gate calls http://127.0.0.1:3001 unless SHIELDCORTEX_API_URL is set

shieldcortex hermes status reports whether the plugin copy is present, not whether it is enforcing.

How the gate works

Enforces by default

Since v4.47.2 the gate blocks out of the box. Watch-only is an explicit opt-out: SHIELDCORTEX_ENFORCE=0 (also false, no, off, advisory). You do not set SHIELDCORTEX_ENFORCE=1 to start blocking. Watch-only still blocks a call the guard recognises as changing its own config or disabling it. Hermes has no approval prompt, so that floor is a block.

Fail-closed on catastrophic shapes

If the local API is unreachable, a dependency-free fallback still denies unambiguous catastrophic shapes (recursive root deletes, pipe-to-shell, raw-disk writes, fork bombs). That tier ignores advisory mode. Anything the fallback does not recognise fails open, so a down scanner does not wedge ordinary work. Degraded decisions are logged.

Isolated

Installs under ~/.hermes/plugins/. It can sit next to an OpenClaw ShieldCortex on the same machine.

Also running OpenClaw? See the OpenClaw integration.