Skip to main content
Book a demo

Connect Scanner to Hermes

Give Hermes governed access to Scanner’s 3 tools through Runlayer, with identity, policy, scanning, and audit on every call.

Book a demo Hermes setup guide

Set up

Add Scanner to Hermes in four steps

Admins approve the server once. Everyone in Hermes then gets it through the same governed connection.

  1. 1

    Approve Scanner in Runlayer

    Add Scanner from the catalog and choose who can use it and which of its tools are allowed.

  2. 2

    Connect Hermes to Runlayer

    Install the Runlayer CLI so Hermes can reach Scanner, which runs on the user’s machine.

    Hermes setup guide
  3. 3

    Sign in to Scanner

    An admin adds Scanner credentials to Runlayer once. They never sit in the client’s configuration.

  4. 4

    Use Scanner from Hermes

    Scanner’s approved tools appear in Hermes. Every call is checked against policy and recorded.

Tools

3 Scanner tools in Hermes

Runlayer policy decides which of these Hermes users can call. 3 read data only.

  • Get Scanner context

    Get context about available Scanner indexes and data sources for investigation

  • Execute query

    Execute a search query against Scanner security data lake indexes

  • Fetch query results

    Fetch results from a previously executed Scanner query

Control

What Runlayer can see and stop in Hermes

Some controls apply to every client at the gateway. Others depend on what Hermes exposes to Runlayer.

  • Gateway policy (available)

    Every Scanner call from Hermes passes through Runlayer, where your policies can allow, alert, mask, or block it.

  • Audit trail (available)

    Each call is recorded with the user, Hermes as the client, the tool, and the policy and scanner decisions.

  • Client hooks (available)

    Capture supported prompts, reasoning, local and MCP tool calls, responses, and scanner decisions in real time.

  • Stop a call before it runs (available)

    Runlayer can deny a tool call before Hermes runs it.

  • Block output after it runs (available)

    Runlayer can block a tool’s output in Hermes and show a message in its place.

  • Redact output in place (not available)

    Hermes cannot take masked output, so Runlayer can block a tool’s output but not mask it. The gateway still applies policy to the call.

In Hermes

  • Hermes can replace blocked tool output with a message, but its after-call event is for monitoring only.

Frequently asked questions

Connect more

Find another combination