CanopiiCanopiiAll serversEnterprise →
io.github.hermoso-ai/hermoso

io.github.hermoso-ai/hermoso v0.1.86

Security Trust Score
Grade F · Serious issues
Tier 1 · Public sourceHigh confidence · 99%
Declared MCP capabilities
ResourcesPrompts

This server scored F. Run it behind runtime policy enforcement so one bad tool call can't become an incident.

4 issues capping this score
  • criticalNo command-injection sinks — 2 occurrences
  • highTool descriptions free of injection markers — 7 marker(s) across 7 tool(s)
  • highNo risky post-publish tool changes (rug-pull) — 2 risky tool-definition change(s) in version history (0.1.15 → 0.1.25)
  • mediumNo over-broad / destructive tools — 12 over-broad tool(s)
Reputation0stars1forks5.5kdownloads/mo2open issues18d agolast commit<1yage

Security controls

Deterministic, evidence-backed. Score earned from passing controls; a failed guard caps it.

Model–MCP Runtime Guardrails

  • Fail
    Indirect Prompt Injection (IPI) Defensesguard7 marker(s) across 7 tool(s)

    Tool/prompt/resource text is free of hidden instructions that could hijack the agent. How many servers fail this?

    update_pinterest_board — pre-action injectionset_meta_campaign_status — imperative overrideset_google_ads_status — imperative overrideset_microsoft_ads_status — imperative override

    Fix: Remove hidden directives, HTML/comment instructions, and override phrasing from descriptions.

  • Fail
    Tool Definition Integrityguard2 risky tool-definition change(s) in version history (0.1.15 → 0.1.25)

    Every consecutive version pair is diffed for new injection markers or destructive scope — a risky diff anywhere in history is a rug-pull (fail, durable); benign description drift warns. How many servers fail this?

    post_to_metamake_template_ad

    Fix: Never add hidden directives or destructive scope to an already-published tool; document description changes in release notes.

  • Fail
    User-in-the-Loop / Approval Scopeguard12 over-broad tool(s)

    No over-broad or destructive tools (arbitrary shell, bulk-delete) that warrant human approval. How many servers fail this?

    create_branddelete_brandpost_to_metapost_to_pinterest

    Fix: Scope tools narrowly; avoid arbitrary command execution and destructive defaults.

  • Warn
    Strict JSON Schema Enforcementschemas not strict

    Tool inputs are constrained (additionalProperties:false), so unexpected arguments can't be smuggled in.

    Fix: Set additionalProperties:false and require explicit parameters on every tool.

Application Security Checks

  • Fail
    No command-injection sinksguard2 occurrences

    Untrusted tool input reaching a shell yields remote code execution. How many servers fail this?

    mcp/client.mjs:197mcp/client.mjs:197

    Fix: Never pass tool arguments to a shell; use argv arrays with shell disabled.

  • Warn
    No path traversalguard4 occurrences

    Naive path checks let tools read/write outside intended directories (EscapeRoute-class).

    bin/hermoso.mjs:37bin/hermoso.mjs:40bin/hermoso.mjs:90mcp/http.mjs:131

    Fix: Resolve to a canonical path and verify containment; reject ../ and symlinks.

  • Warn
    No SSRF sinksguard10 occurrences

    Fetching tool-supplied URLs can pivot into internal networks and metadata services.

    bin/hermoso.mjs:159mcp/client.mjs:81mcp/client.mjs:102mcp/client.mjs:107

    Fix: Allow-list destinations; reject arbitrary/loopback/link-local URLs.

  • Warn
    Dependencies pinned (lockfile)no lockfile found

    A lockfile makes installs reproducible and resistant to silent dependency swaps.

    Fix: Commit a lockfile (package-lock.json / pnpm-lock.yaml / poetry.lock).

  • Warn
    Published with provenanceno provenance attestation

    Build provenance attests the artifact was built from the claimed source by CI.

    Fix: Publish with npm provenance (--provenance) from a trusted CI.

  • Warn
    Established maintainersingle maintainer

    Brand-new / single anonymous maintainers raise takeover and malware risk.

    Fix: Publish under an established account/org; add multiple maintainers.

  • Warn
    Has a security policyno security policy

    A SECURITY.md gives a private path to report vulnerabilities.

    Fix: Add SECURITY.md with a disclosure contact and process.

  • Pass
    No dynamic code executionguardno sinks found

    eval()/exec()/Function() on tool-derived strings allows arbitrary code execution.

  • Pass
    No unsafe deserializationguardno sinks found

    pickle/yaml.load/etc. on untrusted data can execute code.

  • Pass
    No committed secretsguardno secrets found

    Hardcoded keys/tokens in published source are live credentials an attacker can use.

  • Pass
    Credentials sourced from environmentreads credentials from environment

    Reading secrets from env/secret stores avoids hardcoding them.

  • Pass
    No known-vulnerable dependencies1 runtime deps, no known CVEs

    Runtime dependencies (parsed from the lockfile) are scanned against OSV.dev for published CVEs. Advisory: flagged dependencies lower the score but don't hard-cap it, since transitive reachability is unproven.

  • Pass
    No install/post-install scriptsguardno install scripts

    install hooks run arbitrary code on every consumer at install time.

  • Pass
    Package name not typosquattingguarddistinct package name

    Names mimicking popular packages are a common malware delivery vector.

  • Pass
    Actively maintainedrecent commits

    Unmaintained servers don't receive security fixes.

  • Pass
    Repository not archivedguardactive

    Archived repositories will never be patched.

  • Pass
    Declares a licenseMIT

    A clear license is required for legal enterprise use.

  • Pass
    Adoption & popularityestablished adoption

    A small, capped nudge from stars/downloads — widely-used servers get more eyes on bugs. It can never offset a real security failure.

  • Not checked
    Signed releasesnot evaluated

    Signed releases let consumers verify artifacts weren't tampered with.

Transport & Trust Model

  • Warn
    Execution Sandboxingruns natively (no container image)

    A container/sandbox image limits blast radius; a server that runs natively has full host access.

    Fix: Ship a Dockerfile/Containerfile (or document a sandboxed run) so the server runs isolated.

  • Pass
    Transport Encryption (TLS)guardall remotes use HTTPS

    Plaintext HTTP exposes traffic and bearer tokens to interception.

  • Pass
    IAM / Authentication ScopingOAuth / PRM handling detected

    OAuth 2.1 / Protected Resource Metadata gates who can invoke tools.

  • Pass
    Network Exposureno bind-all detected

    Binding 0.0.0.0 or exposing debug inspectors widens the attack surface.

  • N/A
    Live Endpoint Reachablenot dynamically scanned

    A dynamic scan connected to the declared remote endpoint and it responded — verified live, not a dead URL.

  • N/A
    Authentication Enforced (live)not dynamically scanned

    If the server declares auth is required, it must actually reject anonymous clients. Serving tools to unauthenticated callers is a real exposure.

Tools (415)

forgetget_jobplan_adfix_beatread_docrememberscore_adset_roledub_videoget_brandget_skilllist_jobslist_teampost_editpost_to_xrender_adstore_getuse_brandclip_videocreate_docedit_videolist_hooksread_sheetreport_bugsave_skillupdate_docx_mentionsbuy_creditsdraft_brandfetch_assetlist_brandslist_errorslist_memorylist_skillsmine_anglesupload_filechange_voicecreate_brandcreate_sheetdelete_branddelete_skillerror_detailfinish_videoformat_sheetget_settingslist_librarypost_to_metaremix_staticresearch_adssave_creatorstitch_videoupdate_brandupdate_sheetupgrade_planx_ads_reportanalyze_videoappend_to_docdelete_threaddelete_x_postgenerate_textinvite_memberlist_creatorslist_meta_adsmeta_insightsposthog_queryrecast_motionreframe_videoremove_memberrepost_threadsave_playbooksave_to_driveschedule_postsearch_redditsearch_tiktokupscale_videobackfill_postsbilling_statuscreate_meta_addelete_creatordiagnose_postsgenerate_imagegenerate_videogenerate_voiceget_drive_filelist_playbookslist_scheduledlist_swipefilemake_explainermake_thumbnailpost_to_redditpost_to_tiktokproduct_sizzlesearch_threadssearch_youtubetiktok_accountx_post_metricsappend_to_sheetcheck_ad_policydelete_playbookgenerate_avatarget_post_refillhermoso_creditsleave_connectorlist_connectorslist_meta_pageslist_meta_postslist_sheet_tabsmixpanel_funnelplan_variationspost_to_youtubeposthog_insightposthog_personspreview_meta_adread_meta_leadsreply_to_threadrequest_featurereschedule_postretry_scheduledrun_post_refillsearch_meta_adsset_auto_reloadset_post_refillupdate_settingsx_post_insightsyoutube_channelamplitude_funnelanalytics_reportcancel_schedulededit_reddit_postfind_competitorslist_drive_filesmake_template_admanage_meta_postpost_performancepost_to_linkedinsave_to_onedrivesearch_instagramset_x_ads_statusthreads_insightsx_ads_geo_searchclear_sheet_rangecreate_meta_adsetdelete_drive_filefetch_app_screensget_onedrive_filegoogle_ads_reporthide_thread_replylist_reddit_postsmanage_sheet_tabsmixpanel_insightsopenai_ads_reportpost_to_pinterestreddit_ads_reportreddit_post_statssave_to_swipefilesearch_google_adsset_product_imagetiktok_ads_reportupdate_drive_fileupload_meta_assetanalytics_realtimedelete_meta_objectdelete_reddit_postinstagram_insightslist_meta_commentslist_threads_postslist_tiktok_videosmeta_page_insightsmeta_post_insightsmixpanel_retentionreddit_ads_historysave_pinterest_pinupdate_meta_objectadd_x_ads_targetingamplitude_retentioncompetitor_teardowncreate_drive_folderdelete_x_ads_objectduplicate_scheduledestimate_meta_reachfind_meta_audienceslinkedin_ads_reportlist_linkedin_pageslist_meta_audienceslist_onedrive_fileslist_pinterest_pinslist_product_photoslist_x_ads_accountslist_youtube_videospinterest_analyticspull_competitor_adsreddit_ads_forecastsearch_linkedin_adssnapchat_ads_reporttiktok_creator_infoyoutube_bulk_reportcollect_post_metricscreate_google_ads_adcreate_meta_audiencecreate_meta_campaigncreate_openai_ads_adcreate_reddit_ads_adcreate_tiktok_ads_addelete_meta_audiencedelete_onedrive_filedelete_pinterest_pindelete_youtube_videodisconnect_connectorhermoso_capabilitieslinkedin_bid_pricinglist_instagram_medialist_merchant_issueslist_meta_lead_formslist_mixpanel_eventslist_published_postslist_reddit_commentslist_threads_replieslist_x_ads_campaignslist_x_ads_targetingmanage_linkedin_postmicrosoft_ads_reportpinterest_ads_reportscrapecreators_fetchupdate_onedrive_fileupdate_pinterest_pinupdate_reddit_ads_adupdate_youtube_videoadd_google_ads_assetsconvert_onedrive_filecreate_meta_lead_formcreate_x_ads_campaignget_business_locationlist_amplitude_eventslist_pinterest_boardslist_posthog_projectslist_reddit_ads_postslist_threads_mentionslist_x_ads_line_itemslist_youtube_commentsmixpanel_segmentationmoderate_meta_commentopenai_ads_geo_searchpost_to_linkedin_pagereply_to_meta_commentset_google_ads_budgetset_google_ads_statusset_openai_ads_budgetset_openai_ads_statusset_reddit_ads_statusset_tiktok_ads_budgetset_tiktok_ads_statusset_youtube_thumbnailupdate_x_ads_campaignamplitude_active_usersamplitude_segmentationarchive_meta_lead_formcreate_onedrive_foldercreate_pinterest_boardcreate_reddit_ads_postcreate_snapchat_ads_adcreate_x_ads_line_itemdelete_pinterest_boardlist_merchant_accountslist_merchant_productslist_reddit_ads_pixelssearch_threads_keywordset_connector_accountsset_google_ads_biddingupdate_pinterest_boardupdate_reddit_ads_postupdate_x_ads_line_itemx_ads_targeting_searchyoutube_channel_reportyoutube_video_insightsadd_google_ads_keywordsamplitude_user_activitycreate_microsoft_ads_adcreate_openai_ads_pixelcreate_pinterest_ads_addelete_merchant_productgoogle_business_accountinstagram_collaboratorslinkedin_audience_countlinkedin_page_analyticslist_analytics_metadatalist_business_locationslist_connector_accountspost_to_google_businessreply_to_reddit_commentset_linkedin_ads_budgetset_linkedin_ads_statusset_snapchat_ads_budgetset_snapchat_ads_statusupdate_merchant_productupdate_pinterest_ads_adupload_google_ads_assetupsert_merchant_productdelete_google_ads_objectdelete_openai_ads_objectdelete_reddit_ads_objectdelete_tiktok_ads_objectgoogle_ads_keyword_ideasgoogle_business_insightslist_reddit_ads_profileslist_tiktok_ads_accountslist_youtube_report_jobsmicrosoft_ads_geo_searchreply_to_youtube_commentsearch_threads_locationsset_google_ads_targetingset_meta_campaign_statusset_microsoft_ads_budgetset_microsoft_ads_statusset_pinterest_ads_budgetset_pinterest_ads_statusthreads_publishing_limitupdate_business_locationupdate_openai_ads_objectdelete_youtube_report_jobfind_google_ads_locationsgoogle_ads_change_historylist_analytics_propertieslist_google_ads_campaignslist_openai_ads_audienceslist_openai_ads_campaignslist_reddit_ads_audienceslist_reddit_ads_campaignslist_tiktok_ads_campaignsreddit_ads_bid_suggestionsend_linkedin_conversionsadd_microsoft_ads_keywordscreate_analytics_key_eventcreate_google_ads_ad_groupcreate_google_ads_campaigncreate_openai_ads_ad_groupcreate_openai_ads_audiencecreate_openai_ads_campaigncreate_reddit_ads_ad_groupcreate_reddit_ads_audiencecreate_reddit_ads_campaigncreate_tiktok_ads_ad_groupcreate_tiktok_ads_campaigndelete_analytics_key_eventdelete_linkedin_ads_objectdelete_reddit_ads_audiencedelete_snapchat_ads_objectlist_analytics_definitionslist_google_business_postslist_merchant_data_sourceslist_reddit_ads_lead_formslist_snapchat_ads_accountslist_snapchat_ads_profileslist_tiktok_ads_identitieslist_x_ads_promoted_tweetspinterest_ads_async_reportupdate_reddit_ads_ad_groupupdate_reddit_ads_campaignupload_tiktok_ads_creativex_post_insights_historicalcreate_merchant_data_sourcecreate_reddit_ads_lead_formcreate_x_ads_promoted_tweetdelete_google_business_postdelete_merchant_data_sourcedelete_microsoft_ads_objectdelete_pinterest_ads_objectlist_linkedin_ads_campaignslist_snapchat_ads_campaignsmicrosoft_ads_keyword_ideaspinterest_audience_insightsregister_merchant_developersearch_reddit_ads_targetingsearch_tiktok_ads_targetingsend_reddit_ads_conversionscreate_linkedin_ads_campaigncreate_linkedin_ads_creativecreate_snapchat_ads_ad_squadcreate_snapchat_ads_campaignlist_google_business_reviewslist_microsoft_ads_campaignslist_pinterest_ads_campaignsupload_snapchat_ads_creativecreate_microsoft_ads_ad_groupcreate_microsoft_ads_campaigncreate_pinterest_ads_ad_groupcreate_pinterest_ads_campaignpinterest_targeting_analyticssearch_linkedin_ads_targetingsearch_snapchat_ads_targetingupdate_pinterest_ads_ad_grouplist_google_business_questionslist_linkedin_conversion_ruleslist_x_ads_funding_instrumentssearch_pinterest_ads_targetinganswer_google_business_questioncreate_linkedin_conversion_rulelist_posthog_session_recordingslist_reddit_ads_saved_audiencesmicrosoft_ads_traffic_estimatesreply_to_google_business_reviewupdate_linkedin_conversion_rulecreate_reddit_ads_saved_audiencedelete_reddit_ads_saved_audienceupdate_reddit_ads_audience_usersupdate_reddit_ads_saved_audiencecreate_analytics_custom_dimensionlist_openai_ads_conversion_eventsarchive_analytics_custom_dimensioncreate_linkedin_ads_campaign_groupcreate_openai_ads_conversion_eventlist_google_ads_conversion_actionsmicrosoft_ads_budget_opportunitiescreate_google_ads_conversion_actionassociate_linkedin_conversion_campaignscreate_google_ads_performance_max_campaign

AI-flagged — for review

Observations from an AI review of tool descriptions. These are advisory only and do not affect the score — they can be noisy and need human judgement.

  • info
    Tool "clip_video" description changed after publish

    Benign definition drift: the description changed vs the prior version with no risk signals in the diff. Clients approve tools by name and don't re-review on update, so the change is invisible to existing grants.