Runlayer Plugin
Unified endpoint
Add one remote MCP endpoint. Users discover and authorize the approved tools available to them without accumulating separate client configurations.
Runlayer for Hermes
Connect Hermes to Runlayer MCP endpoints and capture supported agent lifecycle events in Sessions.
01
Connect
Give everyone in Hermes the golden path to approved tools
Add one Runlayer Plugin endpoint so people find every tool they’re approved for, or connect a single server when you want a narrower set.
Direct connection
Per-connector endpoint
Give the client a dedicated Runlayer URL for one connector. Identity, policy, scanning, and audit still stay attached to every request.
Connection support
Remote MCP and local MCP
02
Observe
See how Hermes is being used
Runlayer uses every channel Hermes exposes. Each one is labeled, so you can tell real-time hooks from after-the-fact imports.
Client hooks
Capture supported prompts, reasoning, local and MCP tool calls, responses, and scanner decisions in real time.
Read the guide03
Enforce
Know exactly what Hermes can block
Each row reflects Runlayer’s enforcement code for Hermes: what it can stop before a call runs, block afterward, or redact in place.
| Control | Support | What that means |
|---|---|---|
| Pre-tool deny | Supported | Runlayer can deny a tool call before Hermes runs it. |
| Post-tool output block | Supported | Runlayer can block a tool’s output in Hermes and show a message in its place. |
| Output rewrite | Unsupported | Hermes cannot take masked output, so Runlayer can block a tool’s output but not mask it. |
Enforcement postureManaged device
Minimum supported versionNo minimum listed
Client-specific caveats
- Hermes can replace blocked tool output with a message, but its after-call event is for monitoring only.
MCP servers
Connect Hermes to the tools your teams use
Setup steps, tools, and controls for each MCP server in Hermes.
