▸ free_scanner · live now

Scan your AI agent. See its blast radius — in 2 minutes. Free.

Your agent can send, write files, run code and call APIs. This checks which of those a hijacked agent could reach — and shows you red, amber or blue.

$ pip install hermes-shield-scanner$ hermes-shield demo

Python 3.10+. Runs on your machine. Nothing is uploaded.

v0.8.2 · runs locally — a default scan sends nothing off your machine · PyPI · GitHub

▸ live on PyPI ▸ public on GitHub▸ install-verified Linux/macOS/Windows · Py 3.10–3.13▸ read-only by default

▸ what_youll_see

A plain answer: is there a problem?

We mapped 8,447 action surfaces across 12 popular agent frameworks — LangFlow, LlamaIndex, letta, agno and more. 596 were reachable from untrusted input. Here’s what yours looks like — graded like antivirus, against OWASP LLM06 · Excessive Agency.

●

🔴 RED — action needed

A risky action is reachable from untrusted input. Fix it before you ship.

●

🟠 AMBER — review before you ship

A surface worth a human look. Not proven live, but it’s in reach.

●

🔵 BLUE — no live threat proven

The surface is mapped; nothing was proven exploitable. Know your radius anyway.

The report leads with your action-surface count and install-liability (inherited risk) tier — the map, not a one-word verdict. “Proven-live” is the rare red flag from the opt-in --prove tier.

▸ scan_your_own_repo

Then point it at your agent

demo gives an instant canned result. To scan your own code, run it in your repo:

$ cd your-agent-repo$ hermes-shield scan

Report at ./shield-report/outputs/shield_customer_report.html · a default scan runs fully local and sends nothing to the network.

▸ for developers: opt-in tiers & language depth

Off by default (a plain scan sends nothing to the network):

--ai — uses your own local Claude CLI; the only mode that sends code text, and it goes to Anthropic’s API under your own account.
--semgrep, --deps — extra comparators.
--prove — opt-in sandboxed self-attack (Linux + bwrap only).

Language depth: Python = full engine; TypeScript/JavaScript and C# = detection only (via the [multilang] extra); everything else via the optional --semgrep comparator.

▸ every_command_explained

Every command, explained. Pick your line.

The whole surface, in plain English — the first-scan flow, how it runs, and every opt-in flag with what it does.

step 1 · install

Puts the scanner on your machine. One time. Python 3.10+, from PyPI.

$ pip install hermes-shield-scanner

step 2 · see the format

A ready-made sample report on a toy agent, ~10s. It does not scan your code — it’s a canned demonstration.

$ hermes-shield demo

step 3 · scan your own

The real thing, on your code. Auto-detects the git repo you’re in. Fully local, reads only — the HTML report opens itself.

$ cd your-agent-repo && hermes-shield scan

any codebase

Scan a repo that isn’t yours — a dependency, a framework, a repo you’re evaluating. Only reads; never writes to the code it scans.

$ hermes-shield scan ./path/to/any-repo

run it · live

The cinematic HUD — and it’s the default on a terminal. Watch the scan happen live.

$ hermes-shield scan --live

run it · quiet

Plain, pipeable output for CI or an AI agent. Parse hermes_shield_report.json — exit code is always 0 today, so gate on the JSON.

$ hermes-shield scan --quiet

▸ opt-in flags — add any to a scan (all off by default)

--aiPer-file AI-assist recall (fast). Uses your own local claude CLI → Anthropic’s API on your own account — the only mode that sends code text anywhere.

--ai-backendBring your own model for the --ai tier: Claude, Ollama (local, zero-egress), OpenAI, Anthropic, Venice, Gemini. Your own key, so it’s always free to us. A missing key fails loud; the deterministic core never needs it.

--ai-deepWhole-repo agentic AI finder — slower and deeper than --ai.

--semgrepAdds the Semgrep comparator for multi-language breadth.

--depsAlso scans the repo’s own pinned dependencies.

--allCore + --semgrep + --ai together.

--proveSandboxed self-attack to prove a candidate sink is actually live (consent-gated; Linux + bwrap).

hermes-shield diff ./repoScan and compare against a saved baseline — see what changed since last time.

▸ what_we_found_in_the_wild

We ran this scan on the frameworks you already use.

8,447 action surfaces mapped across the 12 frameworks we scan — LangFlow, LlamaIndex, letta, agno and more, with 361k+ combined GitHub stars between them. Your agent inherits its share the moment you pip install.

8,447action surfaces mapped▸ across 12 frameworks

542install-liability surfaces▸ inherited on install

596reachable in-repo▸ from untrusted input

596 reachable-in-repo and 542 install-liability are two distinct tiers, not a subset.

Figures from the benchmark of record, held stable across releases — higher recall + revised taxonomy.

See the public scans → Got a result? Discuss it on Telegram →

▸ SAMPLE FINDINGCVE-2023-39662

▸ not_self_graded

It catches a real CVE.

Not self-graded — the scan flags a real, published vulnerability (CVE-2023-39662), a CVSS 9.8 RCE in LlamaIndex’s PandasQueryEngine, at the exact line. Every verdict is rated against OWASP LLM06 · Excessive Agency.

Install from PyPI →

v0.8.2 · see a sample report · view the code on GitHub

▸ OPTIONAL

Get the Repairer when it ships

The scanner is free — just install it above. Leave your email only if you want the paid Repairer (it proposes fixes for what the scan finds, with your approval) when it lands.

▸ no spam — one launch email▸ the scanner needs no signup▸ live on PyPI · public code on GitHub