Tools, toolsets, and terminal backends
> Tools are functions the agent can call — toolsets and backends decide how powerful (and risky) that is.
Canonical: https://www.brainyxai.co.za/education/hermes/tools-and-backends
Markdown: https://www.brainyxai.co.za/md/education/hermes/tools-and-backends.md
Course: Hermes Agent Operator Track
Lesson: 5 of 9
Minutes: 16
Author: Brainyx AI
What you will be able to do
- Define tools vs toolsets in Hermes vocabulary
- List major terminal backend options
- Decide when to constrain tools for safety
Tools are the agent’s hands
In Hermes, tools are callable capabilities (terminal, browser, web search, code execution, MCP-backed APIs, etc.). Toolsets group them so you can enable a coherent bundle rather than an unstructured free-for-all.
Read the overview: [Tools & Toolsets](https://hermes-agent.nousresearch.com/docs/user-guide/features/tools). Related: [Tool Gateway](https://hermes-agent.nousresearch.com/docs/user-guide/features/tool-gateway), [Tool Search](https://hermes-agent.nousresearch.com/docs/user-guide/features/tool-search).
Terminal backends — where commands run
Hermes can execute terminal work on different backends (docs highlight local, Docker, SSH, Daytona, Singularity, Modal). Implications:
| Backend | Good for | Watch-outs |
| --- | --- | --- |
| Local | Fast iteration on your laptop | Full access to your user account |
| Docker | Isolation / reproducible env | Image + mount configuration |
| SSH | Remote VPS agent | Key management, blast radius |
| Serverless (Daytona/Modal) | Idle-cheap persistence | Cold starts, billing model |
Media & web tools
Portal / Tool Gateway commonly bundles search, browser, image generation, and TTS. Enable only what your use case needs — every tool is also an attack surface when the agent is reachable from messaging.
Delegation & code execution
Advanced tracks (skim for later):
- [Delegation](https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation) / Kanban multi-agent
- [Code Execution](https://hermes-agent.nousresearch.com/docs/user-guide/features/code-execution) / programmatic tool calling
- [Cron](https://hermes-agent.nousresearch.com/docs/user-guide/features/cron) for scheduled automations
Brainyx AI rule for client systems: narrow tools first, widen after you have approval flows and logging.
Tools lab
1. Ask Hermes which tools are currently available in your session.
2. Run one safe filesystem listing and one web/search (if configured) task.
3. Write a one-line policy for yourself: which tools are forbidden until security lesson is done.
Checkpoints
- I can name my terminal backend
- I understand tools increase capability and risk together
Blast radius, not capability
The useful way to think about tools is not what they let the agent do, but what they let the agent break. Sort every tool you enable into one of three tiers.
Read-only — searches, lookups, file reads. Worst case is a wrong answer or unintended disclosure of what it read.
Reversible writes — creating a draft, adding a note, writing a file under version control. Worst case is cleanup.
Irreversible actions — sending messages to customers, deleting data, moving money, shell commands on production. Worst case is an incident.
Grant tier one freely, tier two once you have watched it work, and gate tier three behind human approval indefinitely. This is not a beginner's caution to grow out of; it is how production agents are run.
Terminal backends deserve specific caution
A terminal backend is the most powerful thing you can hand an agent and the least bounded. A shell tool is not one capability — it is every capability the running user has.
If you enable it, constrain the surroundings rather than trusting the agent: run under a user with limited permissions, work in a directory that is disposable or version-controlled, and never on a machine with production credentials in the environment. "It has been fine so far" is not a control.
Constraining without crippling
Over-restriction produces its own failure: an agent that cannot complete anything and hands everything back. The goal is the smallest tool set that makes the task achievable.
Work backwards from the task. List the steps, identify what each genuinely requires, enable exactly that, and add more only when a real task fails for a real reason. Enabling everything up front because it might be needed is how people end up with an agent that can email customers while summarising a spreadsheet.
SA operational note
Many small South African teams run everything on one machine that is also the accounting workstation, the file server, and the place client credentials live. That is the worst possible host for an agent with shell access.
If you want an agent with real system reach, give it its own environment — a separate VM or container with only what it needs. The isolation costs an hour to set up and removes the entire category of "it touched something it should never have seen".
Mini-FAQ
A: The most constrained one that completes your actual task. Escalate on evidence, not anticipation.
A: Yes, and you should for anything irreversible. Approval fatigue is real, so reserve gates for actions that genuinely warrant them.
A: Logging. If you cannot reconstruct which tools ran with which arguments, you cannot operate this safely — fix that before expanding access.
Next lesson
Continue to [skills and memory](https://www.brainyxai.co.za/education/hermes/skills-and-memory).
Official reference: https://hermes-agent.nousresearch.com/docs/user-guide/features/tools
Course hub: https://www.brainyxai.co.za/education/hermes · Previous: https://www.brainyxai.co.za/education/hermes/cli-and-daily-use · Next: https://www.brainyxai.co.za/education/hermes/skills-and-memory
Return to the course hub, or explore Brainyx AI services to put the skill into a live system. Markdown: /md/education/hermes/tools-and-backends.md
Book a consultation · joshua@brainyxai.co.za · Markdown mirrors