hermes-mcp

File operations are restricted to `ALLOWED_PATHS` configured by the user, which is good. The `run_powershell` and `run_git` commands use `asyncio.create_subprocess_exec` with `stdin=asyncio.subprocess.DEVNULL` to prevent stdin inheritance issues, which is a critical security and stability fix. Arbitrary commands can be run via `run_powershell` and `run_git` within specified working directories, but inputs are passed as arguments, not via `shell=True`, reducing direct shell injection risk. The `fetch_url` and `http_request` tools allow unrestricted network access to any URL, which is explicitly noted as 'intentional for development' and 'local use only' in the README. This capability means the LLM can make arbitrary network requests from the host machine, which should be considered when assessing overall system security. No hardcoded secrets or 'eval' statements were found.