▸ scanner

FREE SCANNER · LIVE

Every agent has a blast radius. See yours in one scan.

One command maps every place your agent can act: the tools, files, sends and API calls it can reach. The same engine that guards our own agents. Free, runs on your machine, installable right now.

8,447action surfaces mapped

12frameworks

542install-liability

596reachable-in-repo

Scan your repo — free → GitHub repo → Got a result to discuss? Join the founding cohort on Telegram →

pip install hermes-shield-scanner

then hermes-shield demo · v0.8.2 · PyPI · GitHub

instant sample result, no signup · then run hermes-shield scan in your own repo · Python 3.10+ · Linux / macOS / Windows

point at ANY repo: hermes-shield scan ./path/to/any-repo (reads only, never writes) · CI or an AI agent: hermes-shield scan ./repo --quiet → gate on ./shield-report/outputs/hermes_shield_report.json (exit code is always 0 today; --fail-on planned)

hermes-shield — scan

▸ mapping action surfaces… tools · files · sends · api_calls

▸ tracing reachability from live entry points…

⚠ UNGUARDED_CRITICAL_LIVE_SINK — computer-use exec path

BLAST RADIUS: 0

▸ A default scan runs fully local and reads your code read-only — nothing is sent anywhere. The optional --ai tier uses your own local Claude CLI; that's the only mode that sends any code off your machine, and only to Anthropic's API under your own Claude account.

▸ what_we_found_in_the_wild

The numbers behind the map.

Across twelve popular agent frameworks we mapped 8,447 action surfaces, surface by surface. Inheritance is the problem — install a framework and you inherit everything it can touch. This is OWASP LLM06 · Excessive Agency, mapped in full. Two distinct tiers below: what arrives with the install, and what we could reach inside a real repo.

▸ how we define and rate every surface · the full methodology →

0 action surfaces mapped ACROSS 12 FRAMEWORKS · 361K+ STARS ACROSS THE FRAMEWORKS WE SCAN

0 install-liability surfaces ARRIVE SILENTLY WITH THE INSTALL — LIABILITY YOU NEVER CHOSE

0 reachable-in-repo A SEPARATE TIER — TRACED TO A LIVE PATH IN A REAL REPO

▸ customer_zero

Our own agent got prompt-injected. We built the scanner we needed that day.

▸ verdict_on_each_surface

Not a score. A verdict on every surface.

Detection tells you something looked odd. Action-control tells you exactly what an agent can do, and whether anything stands in its way. Sample surfaces below (redacted) from a real scan.

▸_

Run subprocesses

Shell-out path reachable from the planner loop. No gate between the model's output and exec.

REACHABLE · UNGUARDED

▸⌁

Mutate the database

Write-capable connection inherited from a bundled tool. UPDATE and DELETE reachable without review.

REACHABLE · UNGUARDED

▸✉

Send email

Outbound send live from a default integration — a one-hop exfiltration channel if the agent is steered.

REACHABLE · LIVE SINK

▸⇄

Trigger API

Authenticated third-party calls reachable with stored credentials. Blast radius extends beyond your box.

REACHABLE · LIVE SINK

▸■

What a verdict gives you

Each surface is traced to a live path and proved reachable — so the fix is specific: gate it, block it, or patch it.

PROVE, DON'T GUESS

▸◦

Local-first, by design

The scan runs where your agents run. A default scan is fully local and read-only — nothing is sent anywhere. Only the optional --ai tier sends code text — via your own local Claude CLI, to Anthropic's API under your own account.

LOCAL-FIRST

▸ prove_dont_guess

Not self-graded.

▸ The scanner catches a real, documented CVE: CVE-2023-39662 — not a synthetic bug we planted for ourselves.

What it does

Maps every action surface — tools, files, sends, API calls
Traces reachability from live entry points
Returns a verdict on each surface, not a vague score

How your code is handled

Read-only — never writes to the code it scans
A default scan runs fully local — nothing leaves your machine
Only the optional --ai tier sends code, and only to your own local Claude CLI

What you get

A blast-radius number you can act on
Unguarded critical live sinks flagged first
A specific fix per surface: gate, block, or patch

DOCUMENTED CVE CAUGHTCVE-2023-39662

▸ scan_your_repo

Know your blast radius before an attacker does.

The scanner is free and self-serve. Install it, point it at your agent's codebase, and get an HTML report locally at ./shield-report/outputs/shield_customer_report.html.

Scan your repo — free → GitHub repo → Got a result to discuss? Join the founding cohort on Telegram →

pip install hermes-shield-scanner

then hermes-shield scan · PyPI

▸ The Repairer that fixes what the scanner finds is a paid tier, coming next — join the Repairer waitlist. Building a fund or partnership? Investor & design-partner enquiries.