Day 5 , Production, Security & Extension

Today is about making Hermes production-grade. You'll deploy it into isolated environments, lock down what it can and can't do, connect it to external tools through MCP servers, extend the Desktop app with custom UI plugins, and register your own tools. By the end of today, Hermes is not just a tool you use, it's infrastructure you maintain, secure, and extend.

What you'll have by the end of today

• Hermes running in a Docker container or on a remote backend with resource limits
• Command approval, secret redaction, and PII redaction configured
• At least one MCP server connected and its tools available to Hermes
• A custom desktop plugin or Python tool registered

Lessons

1. Terminal Backends , local, Docker, SSH, Daytona, Singularity, Modal, deploying Hermes where it needs to run, with the right isolation for the risk level
2. Security , command approval modes, secret redaction, PII redaction, shell hooks allowlist, and container isolation
3. MCP Servers , connecting external tool servers via the Model Context Protocol, filtering tools, and exposing Hermes itself as an MCP server
4. Desktop Plugins , writing statusbar items, panes, commands, and routes for the Desktop app using the JavaScript plugin SDK
5. Custom Tools & Python Plugins , registering a new tool in Hermes's tool registry, wiring it into a toolset, and writing backend plugins

Next: Capstone: The Operations Console