Plugin capabilities and consent
Plugins can declare the privileged host surfaces they want in their plugin.yaml : When a plugin declares capabilities, hermes plugins install (and hermes plugins enable ) shows the list with one-line risk descriptions and asks once. Consenting records the grant under plugins.entries.<id>.granted_capabilities together with a consent hash and timestamp. Declining leaves the plugin enabled with those capabilities off - a well-behaved plugin probes with ctx.has_capability() and degrades gracefully. Update re-consent: if a plugin update declares capabilities you haven't granted, hermes plugins update surfaces the additions and asks again. New capabilities stay off until you consent - a plugin update can never silently widen its access. Catalog re-pins go one step further: when the new pin adds tools, hooks, Python dependencies, host capabilities or a Desktop UI half the installed version did not have, the CLI shows the delta and asks y/N before anything moves, and the Desktop / dashboard Update button opens the same confirmation. Declining (or a non-interactive session) leaves the plugin at the old pin. Non-interactive sessions fail closed: installing or updating without a TTY completes…
From the official Hermes Agent documentation.
name: my-plugin
capabilities:
- tools.override # replace built-in tools
- llm.model_override # pick the model for host-owned LLM calls