CanopiiCanopiiAll serversEnterprise →
io.github.hermoso-ai/hermoso

io.github.hermoso-ai/hermoso v0.1.43

Security Trust Score
Grade F · Serious issues
Tier 1 · Public sourceHigh confidence · 99%
Declared MCP capabilities
ResourcesPrompts

This server scored F. Run it behind runtime policy enforcement so one bad tool call can't become an incident.

3 issues capping this score
  • highTool descriptions free of injection markers — 6 marker(s) across 6 tool(s)
  • highNo risky post-publish tool changes (rug-pull) — 3 risky tool-definition change(s) in version history (0.1.15 → 0.1.25, 0.1.25 → 0.1.43)
  • mediumNo over-broad / destructive tools — 10 over-broad tool(s)
Reputation0stars1forks5.6kdownloads/mo2open issues28d agolast commit<1yage

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Fail
    Indirect Prompt Injection (IPI) Defensesguard6 marker(s) across 6 tool(s)

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent. How many servers fail this?

    update_pinterest_board — pre-action injectionset_meta_campaign_status — imperative overrideset_google_ads_status — imperative overrideset_microsoft_ads_status — imperative override

    Fix: Remove hidden directives, HTML/comment instructions, and override phrasing from descriptions.

  • Fail
    Tool Definition Integrityguard3 risky tool-definition change(s) in version history (0.1.15 → 0.1.25, 0.1.25 → 0.1.43)

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns. How many servers fail this?

    make_template_adpost_to_metapost_to_pinterest

    Fix: Never add hidden directives or destructive scope to an already-published tool; document description changes in release notes.

  • Fail
    User-in-the-Loop / Approval Scopeguard10 over-broad tool(s)

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval. How many servers fail this?

    create_branddelete_brandpost_to_metapost_to_pinterest

    Fix: Scope tools narrowly; avoid arbitrary command execution and destructive defaults.

  • Warn
    Strict JSON Schema Enforcementschemas not strict

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

    Fix: Set additionalProperties:false and require explicit parameters on every tool.

Application Security Checks

  • Warn
    No path traversalguard4 occurrences

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

    bin/hermoso.mjs:37bin/hermoso.mjs:40bin/hermoso.mjs:90mcp/http.mjs:121

    Fix: Resolve to a canonical path and verify containment; reject ../ and symlinks.

  • Warn
    No SSRF sinksguard8 occurrences

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

    bin/hermoso.mjs:159mcp/client.mjs:68mcp/client.mjs:73mcp/client.mjs:81

    Fix: Allow-list destinations; reject arbitrary/loopback/link-local URLs.

  • Warn
    Dependencies pinned (lockfile)no lockfile found

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

    Fix: Commit a lockfile (package-lock.json / pnpm-lock.yaml / poetry.lock).

  • Warn
    Published with provenanceno provenance attestation

    Build provenance attests the artifact was built from the claimed source by CI.

    Fix: Publish with npm provenance (--provenance) from a trusted CI.

  • Warn
    Established maintainersingle maintainer

    Brand-new / single anonymous maintainers raise takeover and malware risk.

    Fix: Publish under an established account/org; add multiple maintainers.

  • Warn
    Has a security policyno security policy

    A SECURITY.md gives a private path to report vulnerabilities.

    Fix: Add SECURITY.md with a disclosure contact and process.

  • Pass
    No command-injection sinksguardno sinks found

    Untrusted tool input reaching a shell yields remote code execution.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    No known-vulnerable dependencies1 runtime deps, no known CVEs

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Pass
    No install/post-install scriptsguardno install scripts

    install hooks run arbitrary code on every consumer at install time.

  • Pass
    Package name not typosquattingguarddistinct package name

    Names mimicking popular packages are a common malware delivery vector.

  • Pass
    Actively maintainedrecent commits

    Unmaintained servers don't receive security fixes.

  • Pass
    Repository not archivedguardactive

    Archived repositories will never be patched.

  • Pass
    Declares a licenseMIT

    A clear license is required for legal enterprise use.

  • Pass
    Adoption & popularityestablished adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

Transport & Trust Model

  • Warn
    Execution Sandboxingruns natively (no container image)

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

    Fix: Ship a Dockerfile/Containerfile (or document a sandboxed run) so the server runs isolated.

  • Pass
    Transport Encryption (TLS)guardall remotes use HTTPS

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • Pass
    IAM / Authentication ScopingOAuth / PRM handling detected

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

  • Pass
    Network Exposureno bind-all detected

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (360)

forgetget_jobplan_adfix_beatread_docrememberscore_adset_roledub_videoget_brandget_skilllist_jobslist_teampost_editpost_to_xrender_adstore_getuse_brandclip_videocreate_docedit_videolist_hooksread_sheetreport_bugsave_skillupdate_docx_mentionsbuy_creditsdraft_brandfetch_assetlist_brandslist_errorslist_memorylist_skillsmine_anglesupload_filechange_voicecreate_brandcreate_sheetdelete_branddelete_skillerror_detailfinish_videoformat_sheetget_settingslist_librarypost_to_metaremix_staticresearch_adssave_creatorstitch_videoupdate_brandupdate_sheetupgrade_planx_ads_reportanalyze_videoappend_to_docdelete_threaddelete_x_postgenerate_textinvite_memberlist_creatorslist_meta_adsmeta_insightsrecast_motionreframe_videoremove_memberrepost_threadsave_employeesave_playbooksave_to_driveschedule_postsearch_redditsearch_tiktokupscale_videobackfill_postsbilling_statuscreate_meta_addelete_creatorgenerate_imagegenerate_videogenerate_voiceget_drive_filelist_employeeslist_playbookslist_scheduledlist_swipefilemake_explainermake_thumbnailpost_to_redditpost_to_tiktokproduct_sizzlesearch_threadssearch_youtubetiktok_accountx_post_metricsappend_to_sheetcheck_ad_policydelete_playbookgenerate_avatarget_post_refillhermoso_creditslist_connectorslist_meta_pageslist_meta_postslist_sheet_tabsplan_variationspost_to_youtubepreview_meta_adreply_to_threadrequest_featurereschedule_postretry_scheduledrun_post_refillsearch_meta_adsset_auto_reloadset_post_refillupdate_settingsx_post_insightsyoutube_channelcancel_schedulededit_reddit_postfind_competitorslist_drive_filesmake_template_admanage_meta_postpost_performancepost_to_linkedinsave_to_onedrivesearch_instagramset_x_ads_statusthreads_insightsx_ads_geo_searchclear_sheet_rangecreate_meta_adsetdelete_drive_filefetch_app_screensget_onedrive_filegoogle_ads_reporthide_thread_replylist_reddit_postsmanage_sheet_tabsopenai_ads_reportpost_to_pinterestreddit_ads_reportreddit_post_statssave_to_swipefilesearch_google_adsset_product_imagetiktok_ads_reportupdate_drive_fileupload_meta_assetdelete_meta_objectdelete_reddit_postinstagram_insightslist_meta_commentslist_threads_postslist_tiktok_videosmeta_page_insightsmeta_post_insightsreddit_ads_historysave_pinterest_pinupdate_meta_objectadd_x_ads_targetingcompetitor_teardowncreate_drive_folderdelete_x_ads_objectduplicate_scheduledestimate_meta_reachfind_meta_audienceslinkedin_ads_reportlist_linkedin_pageslist_meta_audienceslist_onedrive_fileslist_pinterest_pinslist_product_photoslist_x_ads_accountslist_youtube_videospinterest_analyticspull_competitor_adsreddit_ads_forecastsearch_linkedin_adsset_active_employeetiktok_creator_infoyoutube_bulk_reportcollect_post_metricscreate_google_ads_adcreate_meta_audiencecreate_meta_campaigncreate_openai_ads_adcreate_reddit_ads_adcreate_tiktok_ads_addelete_meta_audiencedelete_onedrive_filedelete_pinterest_pindelete_youtube_videodisconnect_connectorhermoso_capabilitieslinkedin_bid_pricinglist_instagram_medialist_merchant_issueslist_published_postslist_reddit_commentslist_threads_replieslist_x_ads_campaignslist_x_ads_targetingmanage_linkedin_postmicrosoft_ads_reportpinterest_ads_reportscrapecreators_fetchupdate_onedrive_fileupdate_pinterest_pinupdate_reddit_ads_adupdate_youtube_videoadd_google_ads_assetsconvert_onedrive_filecreate_x_ads_campaignget_business_locationlist_pinterest_boardslist_reddit_ads_postslist_threads_mentionslist_x_ads_line_itemslist_youtube_commentsmoderate_meta_commentopenai_ads_geo_searchpost_to_linkedin_pagereply_to_meta_commentset_google_ads_budgetset_google_ads_statusset_openai_ads_budgetset_openai_ads_statusset_reddit_ads_statusset_tiktok_ads_budgetset_tiktok_ads_statusset_youtube_thumbnailupdate_x_ads_campaigncreate_onedrive_foldercreate_pinterest_boardcreate_reddit_ads_postcreate_x_ads_line_itemdelete_pinterest_boardlist_merchant_accountslist_merchant_productslist_reddit_ads_pixelssearch_threads_keywordset_connector_accountsset_google_ads_biddingupdate_pinterest_boardupdate_reddit_ads_postupdate_x_ads_line_itemx_ads_targeting_searchyoutube_channel_reportyoutube_video_insightsadd_google_ads_keywordscreate_microsoft_ads_adcreate_openai_ads_pixelcreate_pinterest_ads_adgoogle_business_accountlinkedin_audience_countlinkedin_page_analyticslist_business_locationslist_connector_accountspost_to_google_businessreply_to_reddit_commentset_linkedin_ads_budgetset_linkedin_ads_statusupload_google_ads_assetdelete_google_ads_objectdelete_openai_ads_objectdelete_reddit_ads_objectdelete_tiktok_ads_objectgoogle_ads_keyword_ideasgoogle_business_insightslist_reddit_ads_profileslist_tiktok_ads_accountslist_youtube_report_jobsmicrosoft_ads_geo_searchreply_to_youtube_commentsearch_threads_locationsset_google_ads_targetingset_meta_campaign_statusset_microsoft_ads_budgetset_microsoft_ads_statusset_pinterest_ads_budgetset_pinterest_ads_statusthreads_publishing_limitupdate_business_locationupdate_openai_ads_objectdelete_youtube_report_jobfind_google_ads_locationsgoogle_ads_change_historylist_google_ads_campaignslist_openai_ads_audienceslist_openai_ads_campaignslist_reddit_ads_audienceslist_reddit_ads_campaignslist_tiktok_ads_campaignsreddit_ads_bid_suggestionadd_microsoft_ads_keywordscreate_google_ads_ad_groupcreate_google_ads_campaigncreate_openai_ads_ad_groupcreate_openai_ads_audiencecreate_openai_ads_campaigncreate_reddit_ads_ad_groupcreate_reddit_ads_audiencecreate_reddit_ads_campaigncreate_tiktok_ads_ad_groupcreate_tiktok_ads_campaigndelete_linkedin_ads_objectdelete_reddit_ads_audiencelist_google_business_postslist_reddit_ads_lead_formslist_tiktok_ads_identitieslist_x_ads_promoted_tweetspinterest_ads_async_reportupdate_reddit_ads_ad_groupupdate_reddit_ads_campaignupload_tiktok_ads_creativex_post_insights_historicalcreate_reddit_ads_lead_formcreate_x_ads_promoted_tweetdelete_google_business_postdelete_microsoft_ads_objectdelete_pinterest_ads_objectlist_linkedin_ads_campaignsmicrosoft_ads_keyword_ideaspinterest_audience_insightsregister_merchant_developersearch_reddit_ads_targetingsearch_tiktok_ads_targetingsend_reddit_ads_conversionscreate_linkedin_ads_campaigncreate_linkedin_ads_creativelist_google_business_reviewslist_microsoft_ads_campaignslist_pinterest_ads_campaignscreate_microsoft_ads_ad_groupcreate_microsoft_ads_campaigncreate_pinterest_ads_ad_groupcreate_pinterest_ads_campaignpinterest_targeting_analyticssearch_linkedin_ads_targetinglist_google_business_questionslist_x_ads_funding_instrumentsanswer_google_business_questionlist_reddit_ads_saved_audiencesmicrosoft_ads_traffic_estimatesreply_to_google_business_reviewcreate_reddit_ads_saved_audiencedelete_reddit_ads_saved_audienceupdate_reddit_ads_audience_usersupdate_reddit_ads_saved_audiencelist_openai_ads_conversion_eventscreate_linkedin_ads_campaign_groupcreate_openai_ads_conversion_eventlist_google_ads_conversion_actionsmicrosoft_ads_budget_opportunitiescreate_google_ads_conversion_actioncreate_google_ads_performance_max_campaign

AI-flagged — for review

Observations from an AI review of tool descriptions. These are advisory only and do not affect the score — they can be noisy and need human judgement.

  • info
    Tool "billing_status" description changed after publish

    Benign definition drift: the description changed vs the prior version with no risk signals in the diff. Clients approve tools by name and don't re-review on update, so the change is invisible to existing grants.

  • info
    Tool "list_brands" description changed after publish

    Benign definition drift: the description changed vs the prior version with no risk signals in the diff. Clients approve tools by name and don't re-review on update, so the change is invisible to existing grants.

  • info
    Tool "use_brand" description changed after publish

    Benign definition drift: the description changed vs the prior version with no risk signals in the diff. Clients approve tools by name and don't re-review on update, so the change is invisible to existing grants.

Show 5 more