Local agent · CLI skill or MCP
Secure Your Data With Hermes Agent
PortEden gives the local Hermes agent clean, redacted data on every tool call. Wrap the porteden CLI in a Hermes skill, or add PortEden as an MCP server, and your agent reads Gmail, Outlook, Drive, and Calendar with PII redaction, least-privilege scope, and a full audit log — no raw tokens.
Connect as a Hermes skill or over MCP · 8-minute setup · Free to start
Works With What You Already Use
Gmail
Outlook
Google Calendar
Google Drive
Google Docs
OneDrive
SharePoint
Teams
Slack
Notion
Asana
Monday
Linear
Jira
Confluence
Entra ID
Better Together
What PortEden Adds to Hermes Agent
- Hermes runs locally and shells out to tools through its skills system. PortEden enforces a consistent redaction and policy layer in front of every tool call, so the data the model reasons over is already minimized, whichever model Hermes is running.
- You choose the transport. A short SKILL.md in ~/.hermes/skills/ has the agent call the porteden CLI directly, fully local with no bridge. Or add PortEden's remote MCP server to ~/.hermes/config.yaml — Hermes registers the tools at startup. Either way Gmail, Outlook, Drive, and Calendar become scoped, audited tools.
- The agent never holds a raw credential. The Google or Microsoft OAuth token stays inside PortEden; the CLI keeps only a PortEden API key in your OS keyring. Revoke the agent with porteden auth logout without touching your human sign-in.
- Hermes is built to be fast and local. PortEden returns -jc compact JSON sized for the agent's reasoning loop, keeping token use predictable while still applying full redaction, policy evaluation, and logging on every call.
Capability Matrix
Hermes Agent With PortEden: What You Get
Capability
Hermes Agent
Hermes Agent + PortEden
PII redaction before the model reasons over data
50+ identifier types stripped or tokenized in the CLI output
No
Yes
Per-tool, per-action least-privilege scope
No
Yes
Per-contact / per-domain / per-folder firewall rules
No
Yes
Exportable, per-action audit log
No
Yes
No raw OAuth token held by the agent
The provider token stays inside PortEden; the agent only runs a local command
No
Yes
Token-efficient JSON output (-jc compact mode)
Filters noise, truncates long fields — sized for the reasoning loop
N/A
Yes
Auto-pagination for large result sets
N/A
Yes
Confirm-before-write on destructive actions
The recommended skill treats send / delete / share as confirm-first
Partial
Yes
One-command revocation
porteden auth logout clears the keyring; revoke the token in PortEden to be sure
No
Yes
Two ways to connect: CLI skill or MCP server
Run the porteden CLI as a Hermes skill, or add PortEden to ~/.hermes/config.yaml over MCP
N/A
Yes
PII redaction before the model reasons over data
50+ identifier types stripped or tokenized in the CLI output
Hermes AgentNo
+ PortEdenYes
Per-tool, per-action least-privilege scope
Hermes AgentNo
+ PortEdenYes
Per-contact / per-domain / per-folder firewall rules
Hermes AgentNo
+ PortEdenYes
Exportable, per-action audit log
Hermes AgentNo
+ PortEdenYes
No raw OAuth token held by the agent
The provider token stays inside PortEden; the agent only runs a local command
Hermes AgentNo
+ PortEdenYes
Token-efficient JSON output (-jc compact mode)
Filters noise, truncates long fields — sized for the reasoning loop
Hermes AgentN/A
+ PortEdenYes
Auto-pagination for large result sets
Hermes AgentN/A
+ PortEdenYes
Confirm-before-write on destructive actions
The recommended skill treats send / delete / share as confirm-first
Hermes AgentPartial
+ PortEdenYes
One-command revocation
porteden auth logout clears the keyring; revoke the token in PortEden to be sure
Hermes AgentNo
+ PortEdenYes
Two ways to connect: CLI skill or MCP server
Run the porteden CLI as a Hermes skill, or add PortEden to ~/.hermes/config.yaml over MCP
Hermes AgentN/A
+ PortEdenYes
Skill, CLI & MCP Coverage
A Hermes Skill or an MCP Server, Same Firewall as Claude and ChatGPT
Connection: porteden CLI skill (~/.hermes/skills/) or PortEden MCP server (~/.hermes/config.yaml)
Email skill (Gmail + Outlook)
A SKILL.md documents the porteden email commands. The agent reads and triages mail with redaction and audit; send, reply, and forward stay confirm-first.
Setup guideCalendar skill (Google Calendar)
The porteden calendar commands give the agent events and free/busy with attendee redaction. Create, update, and respond stay confirm-first.
Setup guideDrive skill (Google Drive)
The porteden drive commands give the agent file search and read with file-level rules. download returns links only, never raw bytes.
Setup guidePortEden MCP server (config.yaml)
Prefer MCP? Add PortEden's remote server to ~/.hermes/config.yaml via mcp-remote (e.g. mcp.porteden.com/email). Hermes registers the tools at startup; same redaction, scope, and audit.
Setup guideTooling Notes
- Two transports, one firewall: run the porteden CLI as a Hermes skill, or add PortEden to ~/.hermes/config.yaml as an MCP server (mcp-remote to mcp.porteden.com/{email,calendar,drive}). Both enforce the same policy and audit.
- Every command accepts -jc for compact JSON — filters noise, truncates long fields, and reduces token use in the Hermes reasoning loop.
- Use --all to auto-paginate large result sets (e.g. porteden email messages --week --all -jc).
- Set PE_API_KEY in the environment Hermes runs in for headless boxes; otherwise the CLI uses the OS keyring after porteden auth login.
- Per-token scope, per-contact and per-folder rules, and field-level redaction all apply — the agent gets redacted JSON, never raw payloads.
Add a Provider to Hermes in Under 10 Minutes
1
Install the porteden CLI
brew install porteden/tap/porteden — or use the install script / go install. Verify with porteden --help.
2
Authenticate and connect
porteden auth login stores a key in your OS keyring. Then npx @porteden/cli connect gmail (or outlook / drive / google) authorizes the provider.
3
Add the Hermes skill
Drop a SKILL.md in ~/.hermes/skills/porteden-gmail/ documenting the porteden commands. Confirm with hermes skills, then use it in hermes chat.
Hermes Agent + PortEden
Five-Minute Setup. Free While You Test.
Connect a data source, plug Hermes Agent into PortEden, and put Hermes Agent to work on the data your team actually needs to handle.
Frequently Asked Questions
Does the Hermes agent ever see my raw OAuth token?
No. The Google or Microsoft OAuth token lives inside PortEden, and the porteden CLI stores only a PortEden API key in your OS keyring. Hermes shells out to the porteden command and gets back redacted, scoped results. The agent never holds a provider credential it could leak or escalate.
Can I connect PortEden to Hermes over MCP instead of a skill?
Yes. Hermes supports MCP servers in ~/.hermes/config.yaml, and PortEden exposes remote MCP endpoints (mcp.porteden.com/email, /calendar, /drive) you can add via mcp-remote. The CLI skill keeps everything local with no bridge; MCP reuses PortEden's hosted server and is handy if you already run other MCP servers in Hermes. Both paths apply the same redaction, scope, and audit.
Which providers can the Hermes agent reach this way?
Email (Gmail and Outlook / Microsoft 365), Google Calendar, and Google Drive today, each via its own porteden CLI commands wrapped in a Hermes skill. Notion is currently MCP-only and not part of the CLI surface, so it is not covered by this skill-based setup.
Can one PortEden account back multiple Hermes skills or agents?
Yes. One PortEden login on a machine serves every skill and every Hermes agent on it. Use PE_PROFILE (or --profile) to isolate accounts so a task touches only the mailbox or drive it needs, and create separate PortEden API keys for different scopes or audit trails.
Can the agent send email or change files, or only read?
It can do whatever the token allows. The recommended skills keep the agent on read and search, and treat send, reply, forward, create, update, share, and delete as confirm-first actions. Keep the PortEden token read-only until the workflow is proven, then widen scope deliberately.
Does PortEden see my Hermes conversations?
PortEden sees the tool calls Hermes makes through the firewall — the command, the redacted result, and the access-rule decision. It does not see the user's chat with the agent, the model's full prompt, or anything that does not touch a PortEden tool.
Where is the audit log, and how do I revoke access?
Every porteden call is recorded in your PortEden audit trail at my.porteden.com. To cut the agent off, run porteden auth logout to clear the keyring on that machine, or revoke the token and disconnect the provider in PortEden. Revoking the PortEden token does not affect your human sign-in.
What does it cost?
The porteden CLI is free to install and start with. Higher tool-call quotas, SSO, and SIEM export are on paid plans. See pricing for details.
Keep Exploring
Get More From Hermes Agent With PortEden
Five-minute setup. Free tier for solo licensed practitioners. Same AI you already use — now ready for the work your team actually needs to do.
Rolling out to a whole team? Talk to sales →