Hermes "tirith security scanner enabled but not available"
This warning means Tirith is switched on but its binary was never installed, so Hermes falls back to pattern matching and your command scanning is weaker than configured. On Windows under MSYS or git-bash, platform detection returned unsupported_platform and the auto-install failed silently. Update Hermes — Windows support landed in PR #23050 (May 2026) — then restart so the binary is fetched.
Likely cause
Tirith is enabled in your config but its binary was never installed, so Hermes silently downgrades to pattern matching — weaker command scanning than you think you have. On Windows under MSYS or git-bash this was a platform-detection bug: `_detect_target()` in tools/tirith_security.py only handled Darwin and Linux/Android and returned None for Windows, so auto-install failed with "unsupported_platform" and never reported it (issue #26044). PR #23050, merged 10 May 2026, added Windows detection and now auto-installs the binary to ~\AppData\Local\hermes\bin\tirith.exe on first run.
The fix
- 1 Update Hermes. Windows auto-install support landed in PR #23050 (May 2026); anything older than that will never install the binary on Windows.
- 2 After updating, restart Hermes and confirm the warning is gone. The binary is fetched on first run, not during the update itself.
- 3 Check that ~\AppData\Local\hermes\bin\tirith.exe exists on Windows, or ~/.hermes/bin/tirith on macOS and Linux.
- 4 If you are on an older Hermes and cannot update, run Hermes under WSL — the Linux install path works and the Windows one does not.
- 5 Treat the warning as real until fixed: with Tirith unavailable, command scanning is pattern matching only, so risky commands your policy expects to be caught may not be.
Hit a different error?
Paste any agent error and get the cause and fix in seconds.
Frequently asked questions
Is Hermes still safe to use with this warning?
It still scans commands, but with pattern matching instead of the Tirith engine. That is a genuine reduction in coverage, so do not treat the warning as cosmetic if you rely on command approval.
Why did it fail silently instead of erroring?
The auto-installer returned unsupported_platform and Hermes carried on with the fallback scanner. The only signal was this warning line, which is easy to miss in startup output.
Tirith is installed but the agent hangs for 20 minutes. Same bug?
No, that is a different failure — a Tirith SIGSEGV crash that hangs the agent with no response delivered (issue #41400). This warning means the binary is absent, not crashing.
Stop firefighting agent errors
Decoding errors one at a time is the manual version of what BetterClaw automates. Run your OpenClaw agents hosted with managed models, retries and config validation built in.
Free plan available · Pro $49/mo · BYOK · 7-day money-back guarantee