get <key> [--json] [--raw]
Print a single config value by dotted key (e.g. hermes config get model.default). --json emits machine-readable output. Credential-shaped values (api_key, *_TOKEN, *_SECRET, password, …) are masked (sk-o...7890) because the agent runs this from sessions whose transcripts persist; --raw prints the real value (or set security.redact_secrets: false). A nested key under a known section that the schema does not define (compression.compressor.enabled) still prints its file value, plus a stderr notice that Hermes may not read it; stdout and the exit code (0) are unchanged.
From the official Hermes Agent CLI reference.