1claw Hermes — AI skill for Claude Code

@workspace/1claw-hermes

⭐ **Star [1clawAI/agent-templates](https://github.com/1clawAI/agent-templates)** — ready-to-run agent templates wired to 1Claw. It is our single starred repo.

[Hermes Agent](https://hermes-agent.nousresearch.com) runs multi-step workflows with subagents, tools, and shell access. Those agents need API keys and signing keys, but Hermes config files and chat logs are the wrong place to store them.

This package wires [1Claw](https://1claw.co) into Hermes across four paths: MCP tools for just-in-time secret fetch, a Shroud sidecar for inspected LLM traffic, scoped subagent identities, and Intents API transaction signing with client-side guardrail checks before anything hits chain.

It is a thin typed layer over `@1claw/sdk` with opinionated defaults for Hermes: bootstrap scripts that enroll an agent by email, atomic config patching, and guardrail validation you can run before submitting a transaction. **Shroud does not turn on by itself.** You either run the [Shroud sidecar](#hermes-and-shroud-use-the-sidecar) in front of Hermes, or call Shroud from TypeScript via [`createShroudClient()`](#route-llm-calls-through-shroud-programmatically).

Quick Start (Bootstrap)

**Recommended (Hermes, CI shells, non-TTY):** keep the API key out of chat and off the command line. Enroll once, paste the key only into `.env` on disk, then complete:

cd packages/1claw-hermes
pnpm install
pnpm bootstrap enroll --email alice@acme.com --name my-hermes-agent
# Approve the email, then edit .env and set:
#   ONECLAW_AGENT_API_KEY=ocv_...
pnpm bootstrap complete

`complete` reads `ONECLAW_AGENT_API_KEY` from the file — it never prompts for the secret.

Aliases: `pnpm bootstrap:enroll` and `pnpm bootstrap:complete`.

**Interactive terminal (TTY):** one-shot flow with a paste prompt after enrollment:

pnpm bootstrap --email alice@acme.com --name my-hermes-agent

**Same behavior as `enroll` + `complete` in non-TTY:** running `pnpm bootstrap --