Hermes Vault MCP
The Hermes Vault MCP server keeps keys encrypted and gives an agent access by policy, for a limited time, with an audit log.
- 282 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The vault hands an agent real service keys, and a policy mistake grants extra access.
- The passphrase sits in the client configuration or environment.
Install
- Works in
Manual install
uv tool install git+https://github.com/asimons81/hermes-vault.git@vX.Y.ZThe first README option: replace `vX.Y.Z` with a release tag, `v0.26.0` at the time of the README. pipx variant: `pipx install git+https://github.com/asimons81/hermes-vault.git@vX.Y.Z`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The vault hands an agent real service keys, and a policy mistake grants extra access.
- The passphrase sits in the client configuration or environment.
This is third-party code. Review the repository files before installing.
What it does
Hermes Vault, a local credential broker, scans files for plaintext secrets, moves them into an encrypted store and verifies working keys. An agent gets not a file of passwords but temporary access by policy: a lease with a term and an audit log entry. The server starts with `hermes-vault mcp` and plugs into Claude Desktop, Cursor and other clients. Tools list services, return key metadata without the secret, issue temporary environment variables, verify and rotate. The `hermes-vault run` command injects secrets only into a child process environment.
Who it is for. People running autonomous agents who do not want to leave them plaintext `.env` files with cloud and API keys.
Good fit when
- A `.env` holds keys that the agent could read in full.
- An agent needs API access for ten minutes for a single task.
- You want a log of who took each key and why.
- Before rotating keys you want a backup verified to decrypt.
Not a fit when
- You need a cloud secrets manager for a team with shared access and sync.
- The server must listen on a network: remote binding is not supported in the console.
- The agent and the vault share a machine with no separation of permissions.
Example request
Find plaintext secrets in `~/.hermes/.env`, show a report without values and move them into the vault. Then grant me `openai` access for ten minutes.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
`HERMES_VAULT_PASSPHRASE`required, secret- Passphrase that unlocks the encrypted store.
`HERMES_VAULT_MCP_ALLOWED_AGENTS`- Agents allowed to make calls, for example `hermes,claude-desktop`.
`HERMES_VAULT_MCP_DEFAULT_AGENT`- Default agent when the client omits `agent_id`.
Limitations
The store is local: there is no cloud sync, and backups and the passphrase stay on your side. The passphrase is passed through `HERMES_VAULT_PASSPHRASE` and must be protected like the secret itself. The `policy.yaml` policy decides what each agent sees, and mistakes there grant extra access. An agent on the same machine can bypass the vault. The project is young, with one author, under the MIT license.
How to disable. Remove the `hermes-vault` block from the MCP client configuration and stop the process. The store, keys and backups are removed separately, so export the secrets you need first.
FAQ
Where do I start after installing?
Run `hermes-vault bootstrap --from-env ~/.hermes/.env --agent hermes --dry-run`. The report lists keys to import without printing values and changes nothing.
How do I connect it to Claude Desktop or Cursor?
Add an `mcpServers` entry with `command` set to `hermes-vault` and `args` set to `["mcp"]`. Pass the passphrase through the `HERMES_VAULT_PASSPHRASE` environment variable.
Does the agent see the secrets?
It sees metadata, not values, until policy allows issuing environment variables for the lease term. `vault://` resources return metadata only.
How do I check the installation health?
`hermes-vault doctor` is read-only and checks store files, salt and key, the audit chain and MCP wiring. Output comes in human and JSON form.
How do I move secrets from `.env` into the vault?
Run `bootstrap` with `--dry-run` first, then without it. The `--redact-source` flag comments out only successfully imported lines in the source file.
Discussion
No questions or reviews yet.
Related
MCP serversOfficial HashiCorp Vault MCP server: mounts, KV secrets and PKI certificates from an agent
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
A Mac key vault for agents: Sallyport runs HTTP and SSH with your keys over MCP, and the agent never receives the key itself
Vahta lets an agent use your passwords and API keys from an encrypted vault without ever showing it the values
A utility keeps keys in the system keychain and injects them at the transport layer, so the agent never sees a value.
A CLI and MCP bridge over a KeePass-compatible vault: an agent gets one secret only after your answer, and every request lands in a log
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Hermes Vault (this card) | no | API key | 282 | |
| Vault MCP Server | yes | API key | 67 | the HashiCorp Vault MCP server for a cloud store; Hermes Vault is a local broker with policy and leases |
| SandVault | no | 454 | isolates an agent in a macOS sandbox; Hermes Vault hides keys and issues them for a term |
README in short
The description covers the store, per-agent policies, time-limited leases, a secret scanner, a console and an MCP server. Recent releases focus on safe recovery and backup verification.