Hermes Security

What it is

An official Nous Research plugin for Hermes Agent, not a standalone scanner. It builds a threat model, reviews code with parallel subagents, checks each candidate against the code, and can write optional test reproductions.

What it helps with

- Reviewing a whole repository, one folder, or only your local changes
- Exporting findings as SARIF for code scanning dashboards, or as JSON, CSV, and Markdown reports

Who it's for

Developers and AppSec teams using Hermes Agent on code they own or are authorized to test.

Worth knowing

It needs Hermes 0.21.5 or later and Python 3.11 or later. The model provider set in Hermes receives the code, so treat reports as sensitive. Optional tests run as your user, not in a sandbox; use them only on trusted code, preferably in a disposable VM or container.

Can it apply the patches it suggests?
No, suggested patches are shown for reading only.

Can it test a running application?
Yes, after you grant access, and only to the address you allow.

How does it compare with Codex Security, Strix, and Semgrep?
In our view Codex Security is an AI review CLI, Strix tests apps and APIs with AI agents, and Semgrep is a rule-based static analyzer, while Hermes Security runs this review inside Hermes Agent.