Security: default-off, per-server allowlist
A plugin has no MCP access by default .
A plugin has no MCP access by default . The operator must grant each server explicitly in config.yaml : Calling a server not in the list raises PermissionError naming the exact config key to set. The grant is per-server and per-plugin - never ambient authority over every configured server, and "*" wildcards are not honored. Every call has an enforced timeout (default 30 s) so a hung MCP server cannot stall the hook or tool pipeline that invoked it. MCP servers return untrusted content. Treat result as data, not instructions - don't feed it into privileged decisions (approvals, command execution) without validation. warning Granting mcp_allowlist gives the plugin the same access to that MCP server as the model has - including any write-capable tools the server exposes (subject to the server's trust tier gates). Grant only servers the plugin genuinely needs. See the full guide for handler contracts, schema format, hook behavior, error handling, and common mistakes. Quick overview Minimal working example What plugins can do Plugin discovery Plugin sub-categories Plugins are opt-in (with a few exceptions) Installing from a private repository What the allow-list does NOT gate Approval t…
From the official Hermes Agent documentation.
plugins:
entries:
my-plugin:
mcp_allowlist: ["knowledge_rag", "github"]