Hermes Agent ships Security plugin for codebase vulnerability review
Security review as an agent workflow, with automated exploit tracing and SARIF export, means findings can slot straight into existing CI scanners rather than sitting in a report. Developers and security teams maintaining large repos can run it via CLI or desktop to triage vulnerabilities with reproduction steps attached. Compared with static analyzers, the ruled-out findings list reduces noise from false positives.
Nous Research released an official Security plugin for Hermes Agent that reviews codebases for security bugs. The agent maps attacker-reachable surfaces and trusted inputs, splits the code across parallel subagents, and verifies each candidate finding against the code and whether it is exploitable. With test confirmation enabled, Hermes writes a reproduction for each finding and runs it in a temporary copy of the repo. Reports record evidence, list ruled-out findings, and export to SARIF. The plugin runs from chat, the CLI, or the Security page in Hermes Desktop.
Hermes Agent can now review your codebase for security bugs with the new official Security plugin by @mark_s.
Hermes first maps what an attacker could reach and which inputs it trusts. It splits the code across parallel subagents, checks every candidate finding against the code, and traces whether an attacker can actually exploit it.
Turn on test confirmation and Hermes writes a small reproduction for each finding and runs it in a temporary copy of the repo. Each report records the evidence and the findings Hermes ruled out, and exports to SARIF for your existing tools.
Run it from chat, the CLI, or the Security page in Hermes Desktop.
