hermes security Command — Complete Reference & Examples

Overview

hermes security audit runs a one-shot supply-chain vulnerability scan against the OSV.dev database. It checks the Hermes Python virtual environment, Python dependencies declared by plugins under ~/.hermes/plugins/, and pinned npx/uvx MCP servers configured in config.yaml.

hermes security audit

What it audits

It does not scan globally installed packages, editor extensions, or browser extensions.

Common Scenarios

Routine security check

hermes security audit

Run this weekly or after installing new plugins or MCP servers.

After installing a plugin

hermes plugins install some-plugin
hermes security audit

Verify that the new plugin does not introduce known vulnerabilities into your supply chain.

After adding an MCP server

hermes mcp add my-server --command "npx [email protected]"
hermes security audit

The audit evaluates the pinned server package against OSV.dev.

Pre-update verification

hermes update
hermes security audit

Confirm that the updated Hermes version and its dependencies are clean.

Tips

• The audit queries OSV.dev, the open-source vulnerability database maintained by Google.
• It is read-only and does not modify any files on your system.
• It requires an internet connection to query OSV.dev.
• Treat HIGH and CRITICAL findings first; update or remove the affected package/plugin.
• For production environments, schedule regular audits with hermes cron.