A plugin for Hermes Agent
Do it three times.
Approve it once.
Kata watches the tool calls your agent makes, finds the multi-step routines it keeps rediscovering, and, only after you review and approve them, compiles each one into a single deterministic tool. No model calls between steps. Every run traced.
hermes plugins install kata
Agents rediscover the same workflow every single time.
Hermes remembers facts and grows skills. But when it searches, reads and checks the same way for the fortieth time, it still asks the model what to do after every step. That costs tokens, time and, occasionally, a step done differently from last time.
Cost
Each step between tool calls is a full model request carrying the whole context.
Latency
A three-step routine waits on the model twice before it can finish.
Drift
A prompt or skill describes the routine. Nothing guarantees the agent follows it the same way.
From observed behaviour to an audited tool, with you in the middle.
Every stage uses documented Hermes plugin interfaces: lifecycle hooks, tool registration and in-process dispatch.
- 01Observe
Record real tool calls
The
post_tool_callhook stores each call with its turn and conversation. Secrets are masked before anything touches disk. Model requests are timed frompost_api_request. - 02Discover
Find routines, not coincidences
Only contiguous, successful calls inside one turn count. A routine must recur in separate conversations, and a template built without one example must reproduce that example exactly.
- 03Validate
Prove it offline
Twelve checks run against recorded history with a stub dispatcher: exact replay, call-for-call execution, schemas, injected failures and timeouts, secrets, tool availability.
- 04Approve
Nothing activates on its own
You see the steps, the data flow, permissions, schemas, side effects and evidence. Approve it in
/kataor the dashboard tab. Rejections are final. - 05Run
One call, every step traced
The approved routine becomes a tool the agent calls once. It stops at the first failure, retries only read-only steps, and becomes stale if an underlying tool changes.
What you approve is exactly what runs.
This card is the unedited output of /kata review from the reproducible demo in the
repository.
- {pattern}
- An input. Kata found which part of the argument changed between runs and which stayed fixed.
- <step 1.matches.0.path>
- Data flow. The value comes from the previous step's result, as it did every time you did it by hand.
- [read: `wc` only reads]
- Side effects are classified per step. Anything external or unknown asks you on every call.
## kata_search_read_terminal (candidate, v2) Routine observed in 4 separate conversations: `search_files`, then `read_file`, then `terminal`. ### Why Kata proposed this - Seen in 4 separate conversations (4 matching runs) - Held-out fit 100%, confidence 0.87 - By hand it took 3 tool calls, 2.0 model round-trips ### Steps (executed in this order, no model calls in between) 1. `search_files`(path="src", pattern="TODO({pattern})") [read: `search_files` only reads] 2. `read_file`(path=<step 1.matches.0.path>) [read: `read_file` only reads] 3. `terminal`(command="wc -l <step 2.path>") [read: `wc` only reads] ### Permissions - May call only: read_file, search_files, terminal - Highest effect: read ### Validation (passed) - [x] replay_matches_recorded: 4/4 examples reproduced exactly - [x] holdout_fit: held-out fit 100% (minimum 90%) - [x] executor_replay: reproduced 4 recorded runs call-for-call - [x] failure_handling: injected failure at step 2 stopped the run - [x] timeout_handling: a hung step is not re-issued - [x] no_secrets: no credentials embedded - [x] tools_available: all tools available, schemas unchanged ... 5 more checks Approve with `/kata approve 1` (optionally `as <name>`)
The round-trips you remove are the ones spent deciding the next step.
One TODO triage from scripts/demo.py, before and after approval. Run it yourself; it needs
no model and no API key.
| Per run | By hand | With Kata |
|---|---|---|
| Tool calls the model makes | 3 | 1 |
| Model requests in the turn | 4 | 2 |
| Steps executed | 3 | 3 |
Tool calls and model requests are counted by the demo host. Token and latency savings depend on
your model and context size; Kata measures them on your machine from post_api_request and shows
them in the dashboard. We do not publish projected numbers.
Built to be trusted with your tools.
Kata only ever replays what you already did, only after you say yes, and only through Hermes.
Explicit approval, always
Observed behaviour never becomes an active tool on its own. Approval re-runs validation and is written to an audit log.
No silent side effects
Steps that reach outside the machine, or that Kata cannot classify, ask you on every invocation with a fresh approval key. They are never retried.
Least privilege
A kata can call only the tools in its own steps, through Hermes's dispatcher, with Hermes's own checks.
No secrets in tools
Credentials are masked at record time. A routine whose fixed arguments contain a secret is never compiled.
Drift aware
Tool schemas are fingerprinted at approval. A change marks the kata stale and unregisters it. Repeated failures suspend it.
Local only
History lives in one SQLite file in your Hermes profile. Kata makes no network calls of its own.
Install it and keep working.
Kata stays quiet until a routine has really repeated. Then it asks.
# install from the Hermes plugin catalog hermes plugins install kata hermes plugins enable kata # later, inside any session /kata # what Kata has found /kata review 1 # full proposal /kata approve 1 as triage_todo