One knowledge vault, served to every AI surface over MCP, curated nightly by an autonomous librarian.
The problem Hermes solves: every AI surface (claude.ai, Claude Code, Desktop) used to hold its own partial memory. Hermes makes one canonical Obsidian vault the single source — 535+ atomic notes woven into Maps of Content — and serves it to all surfaces over MCP.
The serving path is hardened: the vault lives on a VPS that accepts no inbound connections; a Cloudflare Tunnel dials out, and Cloudflare Access gates identity at the edge before anything reaches the filesystem server.
Privacy is structural, not procedural: three tiers (Open / git-crypt Private / gocryptfs Confidential) with tier-scoped write tools, so work data gets filtered, never firehosed. The Librarian — a scheduled headless Claude Code agent under systemd — runs nightly: routes new material to the right tier, shelves atomic notes, weaves the link graph, and maintains the maps. The design principle, in the vault's own words: the brain should be a librarian, not a desk clerk.