Thesis
Prompt-level defences filter what an agent reads; they do nothing about what an agent does. Hermes Shield sits between the model and the world, gating actions — shell commands, file writes, network calls — rather than guessing at intent from text.
We built it after our own agent was prompt-injected in production: we are customer zero.
Threat model
An agent inherits the attack surface of every framework, plugin and dependency it runs on — across 12 popular agent frameworks we mapped 0 action surfaces. These split into two distinct tiers: 0 reachable in the repo we scanned, and a further 0 install-liability you inherit from dependencies (present, not yet proven reachable).
This is the risk the industry standard names OWASP LLM06 · Excessive Agency: an agent that can take real-world actions is only as safe as the actions it is allowed to reach.
The threats that matter are actions with blast radius:
Known CVEs such as CVE-2023-39662 show these are not hypothetical.
Action-control model
The loop is Map → Trace → Prove → Block → Patch: map the agent's reachable actions, trace what it actually attempts, prove which paths are dangerous, block them at the gate, and patch the surface.
Enforcement is local-first — Action Gates, a Threat Shield, a Kill Switch and a full Audit Trail run on your box, not ours (the Shield runtime is coming; the free scanner ships today). A default scan runs fully local and reads your code read-only — nothing is sent anywhere. The optional --ai tier uses your own local Claude CLI; that's the only mode that sends any code off your machine, and only to Anthropic's API under your own Claude account.
Proof coverage
Current published proof, in numbers you can check:
The 596 reachable-in-repo and 542 install-liability counts are two distinct tiers, not a subset of one another. Every finding on public scans is reproducible from the scan output. We publish the method alongside the numbers so you can check our work.
Assurances & limits
What we claim: reachable-surface mapping, a two-tier liability view, and an auditable trail of every decision. "Proven-live" is a rare red flag the scanner can surface on a dangerous path — a capability, never a promise that any agent is safe.
What we do not claim: that any tool makes an agent impossible to compromise, or that detection alone is enough. The scanner has been independently security-reviewed by an industry professional.
Language depth, honestly: Python is the full engine; TypeScript / JavaScript and C# are detection-only (via the [multilang] extra); everything else via the optional --semgrep comparator.
The free scanner is live and self-serve today. The paid Repairer and the Shield runtime are coming; coverage grows and we say so plainly.