We were the victim first.
We run live AI agents. One got prompt-injected, and nothing in our stack could tell us what it was able to do. So we built the Shield to watch every action, then turned its mapping engine into the free scanner you can run today. One command shows your agent's blast radius.
pip install hermes-shield-scannerthen hermes-shield demo for an instant sample result · v0.8.2 · PyPI · GitHub
then run hermes-shield scan in your own repo
Our own agent was the first breach.
We run a live agent system — one that reads, writes, posts and messages on our behalf, every hour of every day. One day it got prompt-injected by untrusted content it was asked to read. The instructions weren't ours, but the agent followed them anyway.
What frightened us wasn't the injection. It was the silence around it. Nothing in our stack could tell us what the agent was capable of doing in that moment — and nothing stood between its intent and the real world to stop it. This is the risk OWASP names LLM06 · Excessive Agency.
Detection tools watch what an agent says. Nobody was watching what it could do. So we built the fix for ourselves: map every action the agent inherits, trace what's reachable, prove it with evidence, block what crosses the line, and patch the surface behind it. Map → Trace → Prove → Block → Patch.
Then we scanned the frameworks everyone else builds on — and realised every agent builder has exactly the same problem.
Injected
- Untrusted content carried instructions
- The agent followed them anyway
- Nothing said what it could do
Mapped
- 8,447 action surfaces across 12 frameworks
- 542 in the install-liability tier
- 596 in the reachable-in-repo tier
Blocked
- Action Gates on the boundary
- Kill Switch under your control
- Evidence for every decision
Shipped
- Guards the same live system today
- Map → Trace → Prove → Block → Patch
- Now scanning everyone's frameworks
Hermes. The messenger — now the watcher.
The god of messages, boundaries and safe passage. Our agents carry the messages. The Shield guards the boundary — every action, watched.
Four things we won't compromise on.
Local-first by design
A default scan runs fully local and reads your code read-only — nothing is sent anywhere. The optional --ai tier uses your own local Claude CLI; that's the only mode that sends any code off your machine, and only to Anthropic's API under your own Claude account.
Operator in control
You define the boundaries and approvals. In the coming Shield runtime, the Kill Switch and Action Gates answer to you, not to us.
Auditable and transparent
Evidence for every action. The coming Shield runtime's Audit Trail shows what happened, what was blocked, and why.
Pragmatic, not theoretical
Built from real agent workflows — the same live system that got injected is the one the Shield protects today.
We lead with the surface map, not a one-word verdict. The scan reports two distinct tiers — 542 install-liability and 596 reachable-in-repo — so you see exactly what your agent inherits and what's reachable in your code. Proven-live is a rare red flag the scanner can raise, never a promise we make. We document residual risk instead of hiding it, because a security company that overclaims is part of the problem.
▸ how we define, find and rate every surface · the full methodology →
See what your agents can actually do.
The free scanner is live. Local-first, read-only, honest by default. One command maps your agent's blast radius.
pip install hermes-shield-scannerthen hermes-shield demo for an instant sample result · v0.8.2 · PyPI · GitHub
then run hermes-shield scan in your own repo