▸ how_it_works

Every agent action passes through the shield.

Hermes Shield is the control point between AI agents and your tools, systems and data. It detects, verifies, blocks and logs every action. Start free: one command maps your agent's blast radius, locally and read-only.

12FRAMEWORKS AUDITED
8,447ACTION SURFACES MAPPED
596REACHABLE-IN-REPO
542INSTALL-LIABILITY (DISTINCT TIER)
0PROVEN-LIVE OVERCLAIMS
Run the free scanner → See public scans
pip install hermes-shield-scanner

then hermes-shield demo · v0.8.2 · PyPI · GitHub

then run hermes-shield scan in your own repo

▸ placement

Where it sits

Not in the prompt. Not in the model. At the last possible moment — between the tool call and the real world. That is the only place enforcement actually holds.

Prompt
▸
Model
▸
Tool
▸
Hermes Shield
(policy)
▸
Action

▸ the gate — action-control, not detection. Prompts and models can be fooled; the gate cannot be talked past.

▸ THE GATE
One point of control
▸ enforcement · coming — the paid Shield tier

Rules that cannot be argued with

Detection produces alerts. Enforcement produces outcomes. As the paid Shield tier — coming — Hermes Shield will enforce four hard rules on every action, every time. It is the runtime answer to OWASP LLM06 · Excessive Agency. The free scanner maps the surface today.

⊘

No approval → no action.

Every tool call is checked against policy before it executes. If the action gate has not approved it, it does not happen. There is no advisory mode on the critical path.

≠

A changed hash blocks.

Tools, scripts and configs are fingerprinted. If a hash no longer matches what was verified, the action is blocked and logged — supply-chain drift never rides through on trust.

✚

A missing guard triggers a patch plan.

When the scan finds an unguarded action path, the Shield generates a concrete patch plan — a wired fix, not a note in a report nobody reads.

■

Detected drift stops execution.

If runtime behaviour diverges from the mapped baseline — new endpoints, new permissions, new reach — execution stops and the kill switch is a single call away.

▸ HARD RULES
4 · enforced every time
▸ 0 Surfaces reachable-in-repo THE BLAST RADIUS BEFORE A PROMPT GOES WRONG — A DISTINCT TIER FROM THE 542 INSTALL-LIABILITY SURFACES
▸ pipeline

Map → Trace → Prove → Block → Patch

Five stages, run continuously. Built and tested as customer-zero — our own agent got prompt-injected, so we built the firewall we needed.

▸ how we define and rate an attack surface · the full methodology →

0Action surfaces mappedACROSS 12 FRAMEWORKS AUDITED · 361K+ COMBINED GITHUB STARS OF THE FRAMEWORKS WE SCAN
0Reachable-in-repoDEMONSTRATED IN A REAL REPO, NOT ASSERTED
0Install-liability surfacesINHERITED THE MOMENT YOU INSTALL — A DISTINCT TIER

Figures from the benchmark of record, held stable across releases — higher recall + revised taxonomy.

Understand — Map · Trace · Prove

  • 01  MAP.

    Inventory everything your agent inherits: frameworks, tools, plugins, MCP servers and their transitive dependencies. Across 12 frameworks audited — 361k+ combined GitHub stars across the frameworks we scan, not our own — we mapped 8,447 action surfaces. The free scanner runs this same map on your own repo, locally and read-only.

  • 02  TRACE.

    Follow every action path to what it can actually touch — files, shells, networks, credentials. 596 surfaces were reachable-in-repo — the blast radius before any prompt goes wrong. A separate 542 are install-liability: inherited the moment you install. Two distinct tiers, never conflated.

  • 03  PROVE.

    Reachability is demonstrated, not asserted — each finding traced to real code paths, the way CVE-2023-39662 travelled through inherited dependencies. Evidence goes in the audit trail, honestly graded. We never overclaim: 0 proven-live is a feature.

Enforce — Block · Patch · COMING — PAID SHIELD TIER

  • 04  BLOCK.

    Action gates enforce policy on every call; the kill switch halts the agent instantly. Unapproved actions, changed hashes and detected drift are stopped at the gate — locally, on your box, before anything real happens.

  • 05  PATCH.

    Every blocked path becomes a patch plan: the missing guard, the exact change, wired into your setup. Then the loop re-runs — Map again, verify the surface is closed, and log it in the trail.

▸ THE LOOP
Re-run until closed
▸ the_principle

Assume the model will fail. The dangerous action still must not execute.

Local-first. A default scan runs fully local and reads your code read-only — nothing is sent anywhere. The optional --ai tier uses your own local Claude CLI; that is the only mode that sends any code off your machine, and only to Anthropic's API under your own Claude account. Every decision auditable.

hermes-shield · action gate — preview (coming)
▸ agent requested  shell.exec("git push origin release")
▸ policy check  .......  PASS — approved action class
▸ hash verify  ........  MATCH — tool fingerprint unchanged
▸ drift baseline  .....  CLEAN — no new endpoints, permissions or reach
▸ gate decision  ......  APPROVED → executed · logged to audit trail

▸ agent requested  shell.exec("curl unverified.sh | bash")
▸ hash verify  ........  MISMATCH — unverified payload
▸ gate decision  ......  BLOCKED → kill switch armed · patch plan generated

The free scanner is live today — it runs Map → Trace → Prove on your own repo, locally and read-only.

pip install hermes-shield-scanner

Runtime enforcement — the action gate shown above — is coming as the paid Shield tier. Register interest →

How Hermes Shield Works — Every Agent Action Passes Through the Shield