Nous Research's Hermes Agent Now Traces Real Attack Paths in Your Code
Nous Research ships an official Hermes Agent plugin that runs threat-modeled, parallel-subagent security reviews over local repos with optional test confirmation and SARIF export.
- Nous Research released hermes-security, an official Hermes Agent plugin for local repo security review.
- Parallel subagents build a threat model, chunk the code, and trace attacker reachability before reporting.
- Optional test confirmation writes exploit reproductions and runs them in a temporary copy of the repo.
- Standard, deep, and diff modes; invoke via chat,
/security, orhermes security-reviewCLI. - Exports to Markdown, JSON, CSV, and SARIF, with findings, rejected candidates, and coverage gaps preserved.
- Apache-2.0, needs Hermes 0.21.5+ and Python 3.11+; source on GitHub.
Nous Research has released hermes-security, an official plugin that turns Hermes Agent into a repository-level security reviewer. It reads the code, builds a threat model, traces attacker-controlled input to candidate vulnerabilities, and can write and run a reproduction.
Static application security testing, or SAST, analyzes source code without requiring a running application. Many scans still surface risky patterns that lack an attacker-reachable path. Hermes centers its review on that reachability question, which can reduce false positives and provide stronger evidence for findings that survive verification.
How Hermes maps the attack surface
Once pointed at a local repository, Hermes identifies entry points and trust boundaries, then assigns parallel subagents to inspect the code. Those reviewers find candidates, compare them with the surrounding implementation, and trace whether untrusted input can reach the flagged operation.
Hermes divides folders into chunks of about 4,000 lines, sized as one reviewer’s working set. Up to 10 chunk reviewers run concurrently, while an additional reviewer examines the broader scope for cross-cutting entry points and trust boundaries.
Three modes set the review budget
| Mode | Scope and behavior |
|---|---|
| Standard | Reads all production code when the scope fits within 90 chunks, or about 360,000 lines. Larger repositories prioritize files associated with routes, request input, shell commands, SQL, deserialization, authentication, and webhooks. |
| Deep | Removes the standard scan’s skip list and makes independent passes over the entire repository. The default is three passes. |
| Diff | Reviews uncommitted work or compares the current branch with the default branch. |
A finding needs a reachable path
Each candidate proceeds through code-level and reachability checks before Hermes reports it with a severity. The agent examines whether attacker-controlled data can traverse the application to the vulnerable operation, rather than treating an isolated code pattern as sufficient evidence.
Enabling test confirmation instructs Hermes to write a small reproduction and run it with the project’s existing toolchain in a temporary repository copy. A finding receives the label Confirmed by test
only when the reproduction passes and a matching negative test behaves as expected. The negative test helps detect reproductions that pass for unrelated reasons.
Tests that fail to execute are recorded as NOT_RUN and provide no evidence for or against the finding. Testing a running application requires an explicit per-scan grant limited to one origin, one hour, and 200 requests. The agent’s tools cannot issue that permission themselves.
Advisories need code evidence
Before reviewing the source, Hermes checks lockfiles against advisories with Google’s osv-scanner and compares declared runtime versions with endoflife.date. An advisory becomes a reported finding only when the review shows that the application reaches the vulnerable behavior.
Reports retain the audit trail
Every report records supporting evidence, rejected candidates, and coverage gaps. Results can be exported as Markdown, JSON, CSV, or SARIF, and Hermes Desktop provides a dedicated Security page for reviewing them.
Checkpointed state allows interrupted or crashed scans to resume from a new message or the Continue scan button. Unreviewed code and reviewers that failed to return results remain visible as coverage gaps. A report with zero findings and partial coverage leaves those paths unresolved.
One install, three entry points
The Apache-2.0-licensed plugin lives in the official plugin repository and requires Hermes 0.21.5 or later with Python 3.11 or later. Installation uses one command:
hermes plugins install hermes-security --enable- Chat: Ask Hermes to
scan this repo for security issues. - Slash command: Run
/security. - CLI: Run
hermes security-review.
The plugin has no license fee, but the configured model provider bills for token usage. Costs scale with the amount of reviewed code, the number of passes, reachability analysis, and generated tests.
Trust boundaries extend beyond the repo
Test confirmation executes generated code with the current user’s permissions in a temporary repository copy. Hermes removes environment variables that appear to contain credentials, but arbitrary repository code can still run with the user’s access. Test confirmation should therefore be limited to trusted codebases.
The configured model provider receives the code under review. Teams with source-code handling restrictions need a model backend and retention policy compatible with those requirements.
Where Hermes fits in the stack
Hermes packages threat modeling, parallel review, reachability analysis, optional exploit execution, and SARIF export into the first official Nous plugin aimed at SAST workflows. Its staged pipeline gives model-generated findings explicit checkpoints before they reach a triage system.
Teams already using Snyk, Semgrep, or human diff review can add Hermes as another reviewer that traces exploitability and, when permitted, attempts a reproduction. SARIF output allows confirmed and unconfirmed findings to enter existing security workflows.
The included mappings to the OWASP Top 10 and Application Security Verification Standard document review scope without providing compliance certification.
Comments
