Hermes Safe Mode for Isolated Troubleshooting

Safe mode helps answer a basic debugging question: is the failure in Hermes core or in this installation’s customization? It disables user configuration and injected rules, plus plugins, shell hooks, and MCP servers for one isolated run.

Official documentation: https://hermes-agent.nousresearch.com/docs/reference/cli-commands

Start with the smallest reproduction

Use hermes chat --safe-mode -q "<minimal reproduction>" for a bounded test. If the problem disappears, add layers back deliberately: provider configuration, project context, skills, plugins, hooks, then MCP servers. If it remains, collect the exact command, version, operating system, and error without dumping secrets.

Related flags such as --ignore-user-config and --ignore-rules isolate narrower layers. Safe mode combines them with plugin, hook, and MCP suppression, making it the stronger first bisect for customization-related failures.

Reproduction checklist

Reduce the failure to one command or prompt.
Record Hermes version and platform.
Run the same test normally and in safe mode.
Keep provider and model differences visible.
Avoid production mutations during diagnosis.
Add customization layers back one at a time.
Capture only redacted logs and stable error text.
Confirm the final fix outside safe mode.

Pitfalls

Calling safe mode a fix rather than a diagnostic control.
Comparing runs that use different providers or working directories.
Re-enabling several extensions at once and losing the signal.
Testing a destructive production flow merely because customization is disabled.
Sharing a debug bundle without reviewing it for private paths and credentials.

Verification steps

Reproduce the issue in the ordinary session.
Repeat the minimal case with --safe-mode.
If it clears, test --ignore-user-config and --ignore-rules separately.
Re-enable plugins, hooks, and MCP servers in controlled groups.
Identify the first layer that restores the failure.
Correct or remove that layer and restart normally.
Re-run the original user path and its verification checks.