Hermes Security plugin details: three scan modes, SARIF export, explicit non-sandbox disclosure
NousResearch · x · 2026-11-09
Nous Research published marketplace details for the Hermes Agent security review plugin. It builds a threat model, chunks the repo for parallel subagent review, and traces attacker reachability for each candidate finding.
- Reports keep evidence, rejected candidates and coverage gaps; export to Markdown/JSON/CSV/SARIF. Standard, deep and diff modes plus a /security command and CLI
- Test confirmation runs small reproductions in a temporary repo copy; testing a running app needs a per-scan grant (one origin, one hour, 200 requests)
- Privacy disclosures: reviewed code goes to the configured model provider; the first scan downloads a SHA-256-pinned osv-scanner and dependency info is sent to osv.dev and deps.dev, disableable via env var
- Explicitly documented that test execution is not a sandbox
Apache-2.0, no Python dependencies.
Related event: Nous Research Launches Hermes Agent Security Plugin for Code Audits(3 posts)→
More from coding & agent
- Own your agent harness: why out-of-the-box frameworks cap what your agents can do — omarsar0 · 2026-11-09
- phoneuse: Open-source tool lets a Linux PC see and control an unmodified iPhone via AirPlay and Bluetooth — mobileraj · 2026-11-09
- Thinking Machines Launches Inkling 2 Small: 594B MoE, Apache 2.0 Weights Next Week — geoffwolfe · 2026-11-09
- 90% of Aggressive AI Critics Have Never Actually Used It, Dev Argues — brandon_galang · 2026-11-09
- Lattice: an open-source local LaTeX research workspace with notes, slides and an AI agent — LINJIEFUN · 2026-11-09
- Swarm agent training needs thousands of agents, ambitious problems and cost math — samiramanabi · 2026-11-09