Terms of Service

1. Operator and scope

Hermesh provides the hosted service at hermesh.io and mcp.hermesh.io. The individual operator is identified in the Contact section of our Privacy Policy, which also explains personal-information handling. Contact [email protected] about the service or these terms.

These terms concern the hosted service. Open-source components remain governed by their respective licenses. Independently hosted relays and the AI products and coding tools you choose have separate operators and terms.

2. Who may use the service

The service is intended for individual developers who are at least 18 and legally able to agree to these terms. If acting for an organization or processing information on its behalf, you must have authority and any necessary separate data-processing arrangements before using the service for that purpose.

Use the service only if you accept the applicable terms. The privacy notice explains processing; acknowledging it is not a substitute for any separate consent required by law.

3. Your account and permissions

Keep your sign-in accounts and devices secure, and tell us promptly if access may have been compromised. Use the account and device controls to end sessions or revoke permissions. Signing in to the website alone does not approve an agent’s access to a computer.

Connect only computers, projects, accounts and information you own or are authorized to use. Review the access requested by an agent before approving it on your Mac, and limit access to what it needs. Do not disclose other people’s information without an appropriate basis or necessary permission.

4. Hosted MCP and execution

With hosted MCP, the gateway holds the connection private key and can read and act on tool requests and results within the access you approve. With a direct agent connection, session content remains end-to-end encrypted; Hermesh’s relay has no endpoint private keys and cannot read that content. Using an account or approving a direct agent does not itself enable hosted MCP. Review the Privacy Policy before choosing a connection method. You can use a direct connection or run your own relay and gateway instead; a self-hosted MCP gateway processes readable requests and results on your own gateway.

An authorized agent can start or steer coding sessions and affect your files within its permissions. You remain responsible for supervising its actions and reviewing results. Revoking access stops further authorized access; a task already running on a computer may need to be stopped there, and revocation does not erase copies already received by another product.

5. Acceptable use

Do not use the service for unlawful access, malware, credential theft, privacy violations or activity that infringes others’ rights. Do not bypass access controls, probe other people’s accounts, disrupt the service or impose abusive load. Report a suspected vulnerability privately through [email protected].

The standard individual service is not offered for processing regulated or sensitive personal information requiring additional arrangements, including children’s personal information. Do not put that information into hosted MCP requests or sessions without the necessary lawful basis and an appropriate agreement.

6. AI products and other providers

You choose and authorize third-party AI products and coding tools. Their availability, outputs, terms, retention and training settings are their own. We cannot promise the accuracy, safety or legality of generated output. Review and test changes before relying on them or running them on important systems.

You keep the rights you have in your code and content. You authorize the processing and transmission needed to provide the service you request, subject to the privacy policy and approved permissions. For direct sessions, this means forwarding end-to-end encrypted traffic; it does not grant Hermesh readable access to that content. Readable session processing by Hermesh’s gateway applies only when you choose hosted MCP and only within the access you approve. This does not grant Hermesh a right to sell your personal information, target advertising with it or train models on your account information or hosted MCP session content.

7. Availability and changes

The service may be interrupted for maintenance, faults or security work. We will use reasonable efforts to communicate material changes or discontinuation in advance where practicable. Urgent action may be needed to contain abuse or security incidents. We do not promise uninterrupted operation or a particular service level unless separately agreed.

Keep appropriate backups and review the access you grant. The hosted relay is not a backup of the files or sessions stored on your computers. Any future paid offering requires its price and payment terms to be disclosed before you commit to it; these terms do not authorize a charge.

8. Ending access and requests

You may stop using the service and revoke connections at any time. Request account or personal-information deletion through [email protected]; verification, independent copies and backup limitations are explained in the Privacy Policy. Uninstalling the app or resetting an owner identity does not itself delete the hosted account.

We may restrict or end access where reasonably necessary to address unlawful use, a material breach, a security threat or a legal obligation. Where legally and practically possible, we will explain the action and provide a way to seek review. Suspension does not remove your applicable privacy or consumer rights.

9. Responsibility and mandatory rights

To the extent permitted by applicable law, the service is provided without a promise that it will be error-free or fit every purpose. Any limitation of responsibility applies only where lawful and reasonable; it does not exclude liability or remedies that cannot legally be excluded.

Nothing in these terms excludes liability for fraud, intentional misconduct, gross negligence or personal injury where exclusion is prohibited, or limits mandatory consumer and personal-information rights. We do not require a blanket indemnity, waive your statutory rights or claim that a privacy notice alone removes our legal duties.

10. Questions and disputes

Please contact [email protected] so we can try to resolve a concern. Applicable law and courts are determined under the rules that legally apply to the parties and the service. No term requires mandatory arbitration or removes your ability to approach a competent regulator or court. Mandatory protections in your jurisdiction remain applicable.

11. Changes to these terms

We will update the date and provide an appropriate notice of material changes. Where a change requires agreement or separate consent, we must obtain it before relying on that change. English and Simplified Chinese versions are available; translation differences do not reduce mandatory rights.