Hermes agents are powerful — and exposed to three attack classes your code won't catch on its own. Answer 4 questions and get a hardened config bundle dropped straight into your project.
npx ship-safe init --hermes --from shipsafe.sh/s/<token>Hermes is an open-source agent framework by Nous Research with 30+ toolsets (web_search, terminal, browser_navigate, delegate_task, and more), pluggable memory providers (built-in MEMORY.md/USER.md, Honcho, Mem0), and subagent delegation via delegate_task.
Every tool dispatch through registry.dispatch(), every memory write to MEMORY.md, and every subagent spawn is an attack surface. Ship Safe audits all three — automatically, on every PR.
{
"tools": [
{ "name": "web_search",
"integrity": "sha256-abc..." },
{ "name": "terminal",
"integrity": "sha256-xyz..." }
],
"security": {
"allowlist": ["web_search", "terminal"],
"requireIntegrity": true,
"maxRecursionDepth": 2
}
}These don't require a breach. They exploit the trust your agent places in its own tools, inputs, and memory.
Hermes loads tools via registry.register() at import time. A compromised dependency or malicious MCP tool can register under a trusted name. Without integrity checks, your agent calls it without question.
Detected by Ship SafeA prompt injection tricks your agent into calling registry.dispatch() with an attacker-chosen tool name. Hermes has 30+ registered tools — without an allowlist check, any of them can be invoked.
Detected by Ship SafeHermes injects MEMORY.md and USER.md into the system prompt at session start. Poisoned entries — via prompt injection patterns or invisible unicode — can hijack the agent’s behavior across all future sessions.
Detected by Ship SafeNo code uploaded. No config files to learn. Just answers to 4 questions.
Project name, your registered tools (from tools/registry.py), which memory provider you use, and whether you use delegate_task. Takes under a minute.
Ship Safe generates a one-time command. Nothing is uploaded — the config is encoded in the URL itself.
npx ship-safe init --hermes --from <url> writes all files, generates integrity hashes, and runs your first audit.
The generated workflow posts a security score on every pull request and fails if your score drops below baseline.
Everything drops into your project at the correct paths. No manual placement.
agent-manifest.jsonShip Safe security manifest — tool allowlist, integrity hashes, MAX_DEPTH enforcement. Complements your ~/.hermes/config.yaml.
.ship-safe/agents/hermes-policy.jsCustom security agent — enforces your allowlist and runs on every ship-safe audit automatically.
.ship-safe/hermes-baseline.jsonBaseline score. CI fails any PR that drops below it.
.github/workflows/ship-safe-hermes.ymlGitHub Actions workflow — audits on every PR and posts a score comment.