Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Pie-ye
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
HERMES_WEBUI_TEST_NETWORK_BLOCKHERMES_HOMEyour config directly. It does not connect to an externalHERMES_BASE_HOMEHERMES_WEBUI_HOSTctl.sh start runs the bootstrap in foreground/no-browser mode behind the daemon wrapper, writes logs to ~/.hermes/webui.log, and respects .env plus inline overrides such as =0.0.0.0 ./ctl.sh start.HERMES_WEBUI_PORTHERMES_WEBUI_PORT env or first argument, default 8787HERMES_WEBUI_PASSWORDEnable via env var or Settings panelHERMES_WEBUI_PRESERVE_ENVWSL_DISTRO_NAMEHERMES_WEBUI_AGENT_DIRHERMES_WEBUI_AGENT_DIR, then known checkout paths, the hermes launcher on PATH, and finally the installed run_agent module exposed by HERMES_WEBUI_PYTHONHERMES_WEBUI_PYTHONHERMES_WEBUI_AGENT_DIR, then known checkout paths, the hermes launcher on PATH, and finally the installed run_agent module exposed by HERMES_WEBUI_PYTHONHERMES_WEBUI_DISABLE_LOCAL_VENVHERMES_WEBUI_TLS_CERTHERMES_WEBUI_TLS_KEYHERMES_WEBUI_TLS_INSECURE_PROBEHERMES_WEBUI_FOREGROUNDHERMES_WEBUI_STATE_DIRHERMES_WEBUI_STATE_DIR env, then $HERMES_HOME/webui (Windows default %LOCALAPPDATA%\hermes\webui, POSIX default ~/.hermes/webui)HERMES_WEBUI_SERVER_CWDWorking directory for the server process. Defaults to the agent dir; point it at a writable workspace when the agent dir is read-only so fallback relative writes land somewhere writableAPI_SERVER_KEYHERMES_GATEWAY_API_KEYHERMES_WEBUI_GATEWAY_API_KEYGATEWAY_API_KEYHERMES_WEBUI_SESSION_TTLHERMES_WEBUI_COOKIE_NAMEHERMES_WEBUI_PASSKEYHERMES_WEBUI_SECUREHERMES_WEBUI_TRUST_FORWARDED_PROTOXDG_DATA_HOMEHERMES_CONFIG_PATHPath to Hermes config fileHERMES_WEBUI_DEFAULT_WORKSPACEHERMES_WEBUI_DEFAULT_WORKSPACE env, then ~/workspace, then state dirHERMES_WEBUI_DEFAULT_MODELOptional model override; leave unset to use the active Hermes provider defaultHERMES_MODELOPENAI_MODELLLM_MODELLM_API_KEYLMSTUDIO_API_KEYHERMES_WEBUI_MODELS_REBUILD_BUDGETHERMES_WEBUI_BUDGET_WARN_COOLDOWNCODEX_HOMEHERMES_DEBUG_SLOWHERMES_WEBUI_CSP_CONNECT_EXTRAOptional space-separated http(s):// or ws(s):// origins to append to the enforced and report-only CSP connect-src directives for trusted reverse-proxy, tunnel, or extension sidecar deploymentsHERMES_WEBUI_CSP_FRAME_EXTRAHERMES_WEBUI_STATE_DB_OVERRIDE_TOP_NHERMES_WEBUI_LINEAGE_TOP_NHERMES_WEBUI_CLAUDE_PROJECTS_DIRHERMES_WEBUI_TEST_STATE_DIRHERMES_WEBUI_SKIP_ONBOARDINGHERMES_WEBUI_PLUGINS_DIRHERMES_WEBUI_ISOLATED_PROFILEHERMES_WEBUI_SLOW_REQUEST_SECONDSHERMES_WEBUI_ALLOWED_ORIGINSHERMES_WEBUI_TRUST_FORWARDED_HOSTHERMES_WEBUI_TRUSTED_PROXY_CIDRSWIKI_PATHHERMES_WEBUI_TRUST_FORWARDED_FORELEVENLABS_API_KEYVOICE_TOOLS_OPENAI_KEYOPENAI_API_KEYMEDIA_ALLOWED_ROOTSHERMES_WEBUI_FOLDER_ZIP_MAX_MBHERMES_WEBUI_FOLDER_ZIP_MAX_FILESTERMINAL_CWDHERMES_EXEC_ASKHERMES_SESSION_KEYPROGRAMFILESHERMES_WEBUI_EXTERNAL_NOTES_SOURCESJOPLIN_URLJOPLIN_TOKENHERMES_WEBUI_PREFILL_MESSAGES_SCRIPTHERMES_WEBUI_SSE_CHUNKEDSet truthy (1/true/yes/on) to send SSE with Transfer-Encoding: chunked. Needed behind buffering reverse proxies (e.g. jupyter-server-proxy) that otherwise buffer the whole stream; harmless but unnecessary for directly-served deploymentsHERMES_SKIP_CHMODSet HERMES_SKIP_CHMOD=1 in .envHERMES_HOME_MODEHERMES_WEBUI_AUTO_INSTALLHERMES_WEBUI_PREFILL_CONTEXT_MAX_CHARSHERMES_PREFILL_MESSAGES_FILEHERMES_WEBUI_PREFILL_MESSAGES_SCRIPT_TIMEOUTHERMES_WEBUI_STALE_COMPLETION_MAX_AGE_SECONDSHERMES_WEBUI_SSE_WRITE_DEADLINEHERMES_SSE_WRITE_DEADLINEHERMES_SESSION_IDHERMES_SESSION_PLATFORMHERMES_SESSION_CHAT_IDSHELLGATEWAY_HEALTH_URLHERMES_GATEWAY_HEALTH_URLHERMES_WEBUI_MAX_EXTRACTED_MBHERMES_WEBUI_ATTACHMENT_DIRFile attachments persist across page reloads and are stored outside the active workspace by default (~/.hermes/webui/attachments/<session_id>/, or /<session_id>/ when configured)Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
7/7 tools missing one or more hints — list_projects (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); rename_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +4 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Readable source code
2 files are minified or bundled, which is usually build output rather than concealment
Ship unminified, readable source.
Secrets stay with their owner
2 secrets sent to a request target we could not resolve (API_SERVER_KEY → dynamic, API_SERVER_KEY → dynamic) — often a configured endpoint, not necessarily third-party
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/pie-ye/hermes-webui)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check