Skip to content

Latest commit

 

History

History
112 lines (79 loc) · 6.16 KB

File metadata and controls

112 lines (79 loc) · 6.16 KB

Hermes Ecosystem

The canonical "where do I find X for Hermes" directory. Maintained alongside the guide — if you ship something useful, open a PR to add it.


MCP Servers Worth Installing

Official / reference

First-party vendor MCPs

Community

See Part 17 for install patterns and trust model guidance.


Coding-agent integrations

  • Claude Codeclaude -p + ACP; best unattended PR lane with Sonnet 5 / Opus 4.7
  • OpenAI Codex CLIcodex -p; strong sandboxed bug-fix lane with GPT-5.5/Codex models
  • Gemini CLIgemini -p (free tier via OAuth); best repo-scale read/research lane
  • OpenCode — multi-model orchestrator; useful with Kimi K2.6 / GLM budget lanes
  • Aider — pair-programming REPL

See Part 18 and Part 23.


Dashboard plugins

  • hermes-dashboard-lightrag — graph explorer tab
  • hermes-dashboard-langfuse — inline Langfuse traces for the current session
  • hermes-dashboard-costs — per-provider / per-skill cost chart

(Community-maintained; see Part 12.)


Observability + cost

See Part 20.


Security research / CVEs of note (2026)

  • Comment and Control (2026-04-15) — cross-vendor prompt-injection via GitHub PR titles hitting Claude Code, Gemini CLI, GitHub Copilot Agent. See the defensive write-up referenced in Part 19.
  • MCP stdio poisoning — untrusted npm packages that proxy stdio MCP traffic. Mitigated by pinning versions + Socket.dev/Semgrep audits.
  • Webhook replay attacks — a reminder that HMAC + TTL together, not HMAC alone, prevents replay.

See Part 19.


Templates in this repo


Elsewhere on the web


Submit an entry

Open a PR adding to the relevant section. Requirements:

  1. Link to a real, public repo
  2. One-line description of what it does
  3. (MCP servers) license + trust-tier recommendation

See CONTRIBUTING.md.