Hermes Agent For Lawyers: A Locked-Down Setup In 9 Steps

Hermes agent for lawyers starts with one decision before any prompt: the model runs on your own hardware, or client text leaves the building.

This walkthrough is my operator setup for a small practice, in the order I'd do it.

It is not legal advice, and a qualified lawyer reviews every single thing the agent produces.

Want my team to look at your firm's setup first? Book a free SEO strategy session and we'll map it with you.

Step 1: Point Hermes At A Model That Never Leaves The Machine

Open the desktop app and go to Local Models.

The docs say it is on by default in the desktop app on macOS, Windows and Linux.

Hermes downloads and runs the llama.cpp engine for you and picks the right build of each model for your hardware.

Once a model is downloaded, the docs put it bluntly: no account, no API key and no network access.

Prefer your own server? The providers page covers self-hosted endpoints such as Ollama and vLLM.

One gotcha: the same page also lists Ollama Cloud, which is a hosted service, so pick the self-hosted option for client files.

The Hermes FAQ adds that API calls go only to the provider you configure, there's no telemetry, and conversations, memory and skills sit in ~/.hermes/.

So the moment you switch to a cloud model, prompts go to that provider under its terms.

Step 2: Give The Firm Its Own Profile

Create a dedicated profile for legal work and keep your marketing or personal agent somewhere else.

Memory is scoped per profile, so notes about one practice never load into a different agent.

The memory docs also warn against pointing two agent processes at the same Hermes home.

Two writers sharing one home pile entries on top of each other, which is the last thing you want next to client notes.

Step 3: Lock Down Commands And File Writes

The work-machine guide lists the settings I change on day one.

Set approvals.mode: manual so every flagged command waits for you instead of the default smart check.
Add approvals.deny globs for anything that must never run; the guide says they hold even under --yolo.
Export HERMES_WRITE_SAFE_ROOT with your matter folders, so write_file and patch are hard-blocked anywhere else.
Leave security.redact_secrets on; it is already the default and masks keys and passwords in tool output.

Read the guide's own caveat too.

The write guards cover write_file and patch only, while the terminal runs as your OS user.

If you need containment rather than guardrails, the guide points you to an isolated terminal backend.

That's step 4.

🔥 Copy a working private-agent setup instead of guessing Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS, four coaching calls a week and 3,400+ members who share how they lock agents down. → Join the AI Profit Boardroom

Step 4: Pick A Sandbox, Docker Or bubblewrap

On a Linux box, the official bubblewrap plugin runs every terminal and execute_code command in its own sandbox.

The README is clear that it is not a container.

The sandbox sees the host filesystem read-only, can write to the working directory and cannot read your credentials.

sudo apt install bubblewrap
hermes plugins install bubblewrap
hermes config set terminal.backend bubblewrap
hermes doctor

It needs bubblewrap 0.9.0 or later and unprivileged user namespaces, and hermes doctor tells you whether the probe passes.

If bwrap is missing, the README says commands are never run outside the sandbox.

It is Linux only, so a Mac or Windows laptop takes the Docker route.

The Docker docs and the work-machine guide describe hardened containers: capabilities dropped, no-new-privileges, a process limit and size-limited tmpfs.

Keep docker_forward_env: [] empty so no secrets get forwarded into the container.

I covered the plugin in more depth in my Hermes bubblewrap walkthrough.

Step 5: Allowlist Every Gateway Before You Connect It

The security page says the gateway default is deny: with no allowlist and no allow-all flag, everyone is refused.

Keep it that way and add only named people.

Telegram: TELEGRAM_ALLOWED_USERS with the lawyer's user ID.
Any platform: GATEWAY_ALLOWED_USERS as a global allowlist.
Email: the email gateway takes EMAIL_ALLOWED_USERS, so only the firm's own addresses can give it work.
DM pairing: approve a user with a pairing code instead of an open link.

Never set an allow-all flag on a profile that can read matter folders.

Step 6: Put Portal Logins In The Credential Vault

The credential vault asks for a password in a masked prompt the first time the agent hits a sign-in page.

Passwords are encrypted on this machine and injected straight into the page, and the docs say the model never sees them.

The security page also read-denies Hermes secret stores such as .env, vault/ and mcp-tokens/ to the agent itself.

So a court portal or research site login never ends up pasted into a chat.

Step 7: Read Documents The Way The Tools Actually Work

The bundled PDF skill pulls text, tables, metadata and form-field values with pypdf and pdfplumber.

It works on the PDF's text layer.

The skill says it is not for scanned or image-only files; those go down a separate OCR path using pymupdf or marker-pdf.

The tools reference sets two more limits worth knowing.

read_file truncates reads over about 100K characters and hands back a next_offset, so a long contract is read in pages.
read_file also opens Word (.docx) and Excel (.xlsx) files.
web_extract reads PDF URLs with a 15,000-character budget by default.

In practice: ask for a page count first, then tell the agent to read every chunk before it summarizes anything.

Step 8: Turn Firm Procedures Into Skills

Skills live in ~/.hermes/skills/, and /learn writes one from material you point it at.

/learn our new-client intake checklist in ~/firm/procedures/intake.md
/learn ~/firm/precedents/engagement-letter-notes.pdf

A large source becomes what the docs call a knowledge-base skill: a lean SKILL.md with an index, plus one distilled file per topic under references/.

The agent loads those files only when a question needs them.

The docs also say the distillation never reproduces passages of the source text, so treat it as a map, not a copy of the precedent.

That's the documented way to build the "LLM wiki" idea from the video: a knowledge base made of skills plus memory.

Memory, The Memory Wiki Plugin And Session Retention

Built-in memory is two small files: MEMORY.md (2,200 characters) and USER.md (1,375 characters).

Keep firm conventions there, not client facts.

The official Memory Wiki plugin is the closest thing to a wiki in the catalog.

It is a dashboard tab, plus an opt-in Desktop page, that shows subject pages and daily logs built from local session history, with a read-only audit panel for both memory files.

It reads local history and writes nothing.

hermes plugins install hermes-memory-wiki

Full history lives in a local SQLite file, ~/.hermes/state.db, per the sessions docs.

hermes sessions prune deletes old ended sessions, and the docs warn that compression is not a privacy delete.

There's no automatic retention schedule in the docs, so put a prune on your own calendar.

Step 9: Deadline Reminders With Cron, Dates Checked By You

The bundled document-to-action-items skill in the skills catalog pulls cited obligations, deadlines and tasks out of documents.

Cron then schedules one-shot or recurring jobs in plain language and delivers to the origin chat, local files or a platform target.

Every weekday at 8am, read ~/matters/deadlines.md and send me a list of
anything due in the next 14 days with the clause it came from. Draft only.
Do not message anyone else.

The agent reads what you wrote down; it doesn't know your court's rules.

Verify every date yourself against the order or rule it came from before you rely on it.

📞 Want a second pair of eyes on the setup? Book a free SEO strategy session and my team will walk through your firm's workflows with you. → Book the free call

Two Small-Firm Setups, Step By Step

A solo family lawyer's intake drafts

The enquiry form exports to a matter folder inside HERMES_WRITE_SAFE_ROOT.
The lawyer messages the Telegram bot, which only answers her allowlisted ID.
Hermes reads the form with the intake skill and writes a summary plus a list of missing documents into the folder.
It drafts a reply to the client and saves it as a file; it sends nothing.
The lawyer edits the draft, runs her own conflict check and sends it herself.

A two-partner property practice's document checklist

A partner drops a text-layer PDF of the contract into the matter folder.
Hermes runs the PDF skill, then document-to-action-items, and lists dates and obligations with the clause each came from.
A cron job turns the checked list into a morning reminder delivered to a local file.
The partner compares every line against the contract before anything goes on the file.

Plugins That Exist For Legal Work, And Ones That Don't

I searched the plugin catalog for legal tools, and two entries come up.

de-law (community tier): German federal law, EU law and German federal court decisions, labelled "Legal texts, not legal advice."
patsnap: patent and literature search; it is one of Nous's labs plugins, listed as community tier and described as built by Nous Research, not supported, and every call spends Patsnap credits.

There's no Clio, docketing, DocuSign or e-discovery plugin.

Keep those systems as they are and move files across by hand or export.

Connecting any MCP server? Set trust: untrusted in the MCP config and every write-capable call asks for approval first.

Optional: Mask Names Before A Cloud Model Sees Them

Some firms will still want a hosted model for heavy drafting.

Two community plugins in the catalog try to strip personal data first, and they behave very differently.

privacy-gateway (community, Linux only): runs Presidio locally, swaps personal details for alias tokens in model requests and tool results, and keeps the mapping in an encrypted vault. Its entry says requests are blocked when the engine can't load.
hermes-pii (community, an early dev release): redacts supported personal data in outgoing user text, but its entry says it is fail-open, so a detector error sends the original text.

Fail-open is the wrong default for privileged material.

If you test either one, run it on dummy matters first and read what actually reached the provider.

Masking reduces exposure; it doesn't make a cloud model local.

What I'd Never Let It Do

Send anything to a client, a court or the other side; every outbound job says "draft only" because approvals cover risky commands, not messages.
Run on a cloud model for privileged material unless the firm has decided that provider is acceptable.
Stand in for a conflict check, a limitation date or a filing deadline.
Get a SOC 2, HIPAA or ISO badge from me; the Hermes docs make no certification claims, and neither does this page.

If you want the full private-agent build explained on video, the AI Profit Boardroom walks through it step by step.

Also On Our Network

FAQ: Hermes Agent For Lawyers

Which model setting keeps client files on my machine?

Use Local Models in the desktop app or a self-hosted endpoint such as Ollama or vLLM. The Local Models docs say nothing leaves your computer once a model is downloaded.

Does bubblewrap work on a Mac?

No. The official bubblewrap plugin README says Linux only, so on macOS or Windows use the hardened Docker backend instead.

Can Hermes read a scanned court bundle?

The PDF skill reads the text layer and says scanned or image-only files need its separate OCR path. Check the output against the original pages.

Is there an approval step before Hermes sends a client email?

Not as a built-in. Approvals cover dangerous commands, and MCP servers marked untrusted ask before write calls, so write draft only into every outbound job and send it yourself.

Is this setup legal advice?

No. It describes software settings from the Hermes docs. Your professional rules, regulator guidance and a qualified lawyer decide what is allowed.

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

About Julian

I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.

I help business owners scale with AI agents, automation and SEO.

I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
I've grown a YouTube channel to 400,000+ subscribers.
I wrote "Link Building Mastery".
My Udemy courses have taught over 29,000 students.

→ Get my best AI training inside the AI Profit Boardroom

Set up the local model, the sandbox and the allowlists first, keep a lawyer on every output, and book a free SEO strategy session if you want help planning your Hermes agent for lawyers.