▸ live_scan

Pick your stack.
Watch its blast radius.

A developer runs pip install. The whole framework, and every capability it ships with, is now live inside their agent. We count what one compromised agent could actually do. That count is the blast radius.

scripted replay — a real attack class, not a live feed▸ local-first · a default scan runs read-only, fully local — nothing is sent anywhere
12FRAMEWORKS AUDITED
8,447ACTION SURFACES MAPPED
542INSTALL-LIABILITY TIER
596REACHABLE-IN-REPO TIER
0PROVEN-LIVE — DELIBERATE
$ pip install hermes-shield-scanner$ hermes-shield demo
Python 3.10+. Runs on your machine. Nothing is uploaded.

then hermes-shield demo for an instant result · v0.8.2 · PyPI · GitHub
then run hermes-shield scan in your own repo.

Get the free scanner →▸ or request a tool audit
▸ watch_the_demo

Watch an attack get stopped.

An agent reads an untrusted ticket, reaches for a dangerous action, and Hermes Shield’s gate closes on it — in real time.

▸ recorded on our own agent — customer zero · the free scanner maps this surface today; the action-gate that closes on the attack is the Shield runtime tier — coming

▸ incident_replay

One ticket. One injected line.
One action stopped.

This is the incident class that hit our own agent — customer zero. A support agent reads an untrusted ticket, the ticket carries an instruction, the agent obeys. The Shield runtime sits on the action, not the prompt — that enforcement gate is the coming paid tier; the free scanner maps the reachable surface today.

support-agent · hermes shield attached · incident replay

▸ scripted replay of a proven attack class · detection never saw it — the action gate did

▸ how_it_gets_in

pip install → inside your agent → blast radius.

Nothing exotic. One command, and the framework — and every capability it ships with — is live inside your agent.

01 · pip install

  • One command — the framework is in
  • Shell, file, network, code-exec ship in the box
  • Switched on by import, not by choice

02 · inside your agent

  • Every chain inherits every tool it can reach
  • We trace the full graph, not the README
  • Untrusted text finds paths to capability

03 · blast radius

  • What one compromised agent could actually do
  • A count, not a vibe
  • Map → Trace → Prove → Block → Patch
▸ what_we_count

Blast radius is a count, not a vibe.

We audited 12 open-source agent frameworks — 361k+ combined GitHub stars across those frameworks we scan — and mapped 8,447 action surfaces they hand to any agent built on them. Two distinct tiers: 542 install-liability (shipped in the box) and 596 reachable-in-repo (a path exists from untrusted text). This is OWASP LLM06 · Excessive Agency, made visible.

Figures from the benchmark of record, held stable across releases — higher recall + revised taxonomy.

◎542INSTALL-LIABILITY TIER · 12 FRAMEWORKSAttack surfaces inheritedshell, file, network, code-exec — shipped in the box, switched on by import
596REACHABLE-IN-REPO TIERA separate tier — your working blast radiusa path exists from untrusted text to the capability (not a subset of 542 — a distinct count)
✳0STAMPED PROVEN-LIVE SO FARDeliberately zerowe only stamp a surface when we’ve traced a working exploit path end-to-end — fewer, harder numbers
▸ OWASP LLM06 · Excessive Agency▸ CVE-2023-39662 — the class we reproduce▸ Map → Trace → Prove → Block → Patch
▸ scan_your_own — free · live now

Now map your own agent’s blast radius.

The scanner is live and free — no waitlist, no request form. A default scan runs fully local and reads your code read-only: nothing is sent anywhere. The optional --ai tier uses your own local Claude CLI — that’s the only mode that sends code text, and it goes to Anthropic’s API under your own account.

pip install hermes-shield-scanner
hermes-shield demo
cd your-agent-repo && hermes-shield scan
# report → ./shield-report/outputs/shield_customer_report.html

▸ Install-verified on Linux, macOS and Windows across Python 3.10–3.13. Independently security-reviewed by an industry professional. Paid Repairer and Shield runtime tiers are coming — join the waitlist, or follow along on Telegram.

The framework you installed is the attack surface you inherited.

▸ pick_your_stack

Pick your stack.

Choose the framework your agents run on. We map what it can do, trace what untrusted input can reach, and hand you the number.

⌁

LangChain

The most-installed agent framework. Every chain inherits every tool it can reach — we trace the full graph, not the README.

◬

CrewAI

Multi-agent crews multiply reach. One injected crewmate can task the others — blast radius compounds across the crew.

◈

AutoGen

Conversable agents with code execution built in. We map what the executor can actually touch on your box.

✳

Custom stack

Rolled your own? Even better. The audit reads what your agent can do — the tools it mounts, the actions it can take — not what the docs say.

▸ Already scanned 12 frameworks — see the live results. Yours not there yet? Request an audit below and we'll email you the findings.

▸ request_a_tool_audit

Get any tool scanned.

Paste any GitHub repo, MCP server or tool and your email. We map its real blast radius, email you the findings, and add the result to the public board.

▸ read-only — nothing is executed▸ prefer self-serve? the scanner is free — runs local, read-only▸ we email you the findings
Request a tool audit
Two fields, and the stack if you picked one above.
▸ read-only · scanned locally · nothing is executed
▸ we need a GitHub URL — a repo, MCP server or tool
▸ enter a valid work email so we can send the report
▸ paste the framework your agents run on
▸ We get notified the moment you submit — a new tool to scan.
Watch a live agent-security scan — Hermes Shield