Hermes Plant — Agent Commerce Assurance

by JesseGdotIO · remote · no sign-in to list tools · v2.0.2 · published by GitHub user JesseGdotIO

Preflight, approve, and prove consequential agent actions with signed evidence and x402 tools.

Final · 2Changes · 18

Compare Registry entry

25 tools: 2 do something that can't be undone, 18 change things and 5 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone2Claude Code: ask: see these tools
Changes things18Claude Code: ask: see these tools
Only reads5Claude Code: allow: see these tools

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http hermes-plant https://mcp.hermesplant.com/mcp

Findings

Matches of fixed checks, with the text they matched.

5 warn

Warndealanalyzer_analyze
The server marks "dealanalyzer_analyze" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dealanalyzer_analyze" says "analyze": a word for reading.
What this check looks for
Warncashflowlens_analyze
The server marks "cashflowlens_analyze" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "cashflowlens_analyze" says "analyze": a word for reading.
What this check looks for
Warnbond_analyze
The server marks "bond_analyze" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "bond_analyze" says "analyze": a word for reading.
What this check looks for
Warnemailguard_validate
The server marks "emailguard_validate" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "emailguard_validate" says "validate": a word for reading.
What this check looks for
Warnemailguard_validate_batch
The server marks "emailguard_validate_batch" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "emailguard_validate_batch" says "validate": a word for reading.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

25 tools

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

payment_policy_decidePayment Policy Decision (x402-paid, $0.05): deterministic allow / deny / needs_review before your agent signs an x402 payment — checks resource binding, amount vs expected price, n…Can send data outNo findings
Why it is in this group
- The name "payment_policy_decide" says "payment": a word that usually means money moves, which cannot be taken back.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Payment Policy Decision (x402-paid, $0.05): deterministic allow / deny / needs_review before your agent signs an x402 payment — checks resource binding, amount vs expected price, network, payTo, facilitator, replay readiness, PII leakage, and buyer spend limits, with evidence-backed findings. Loop it over every payment; pair with assurance_attest for a signed record.
Annotations the server declares
- title: Payment Policy — preflight an x402 payment
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
purchase_with_x402Purchase a one-time product via x402 (returns 402 challenge or fulfillment JSON).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "purchase_with_x402" says "purchase": a word that usually means money moves, which cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Purchase a one-time product via x402 (returns 402 challenge or fulfillment JSON). Call get_x402_manifest first, verify method/path/network/amount/payTo, then sign and retry with PAYMENT-SIGNATURE.
Annotations the server declares
- title: Purchase with x402
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 18Creates or changes something that can be changed back.Claude Code: ask

action_safety_quick_gateAI agent action safety quick gate ($0.01 over x402 or free-tier quota).Can send data outNo findings
Why it is in this group
- The input takes a statement or command to run (input.command), which can change anything it can reach.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
AI agent action safety quick gate ($0.01 over x402 or free-tier quota). Deterministically scores a consequential action and returns the exact next call: proceed, request full DestructGuard evidence, or run the complete Action Safety workflow.
Annotations the server declares
- title: Action Safety - one-cent preflight
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
action_safety_runComplete AI agent action safety workflow ($0.25 over x402 or free-tier quota): DestructGuard evidence, conditional ReviewQueue triage for high or critical risk, an honest decision,…Can send data outNo findings
Why it is in this group
- The name "action_safety_run" says "run": a word for a change.
- The input takes a statement or command to run (input.command), which can change anything it can reach.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Complete AI agent action safety workflow ($0.25 over x402 or free-tier quota): DestructGuard evidence, conditional ReviewQueue triage for high or critical risk, an honest decision, signed receipt, and 30-day status record. Triage does not imply human approval.
Annotations the server declares
- title: Action Safety - complete workflow
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
assurance_attestAssurance Attest (x402-paid, $0.05): bind one x402 payment intent or MCP tool call to a canonical HMAC-signed record (binding hash, policy verdict, findings, optional settlement ou…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Assurance Attest (x402-paid, $0.05): bind one x402 payment intent or MCP tool call to a canonical HMAC-signed record (binding hash, policy verdict, findings, optional settlement outcome). Loop it after every payment or tool call to build a tamper-evident audit trail a third party can check at the free verify endpoint.
Annotations the server declares
- title: Assurance Attest — signed receipt for an agent action
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
assurance_verifyVerify a Hermes-signed assurance record for free: recomputes the canonical hash (hermes-stable-json-v1 + SHA-256) and HMAC signature server-side and reports recordHashValid / signa…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Verify a Hermes-signed assurance record for free: recomputes the canonical hash (hermes-stable-json-v1 + SHA-256) and HMAC signature server-side and reports recordHashValid / signatureValid. Use it to audit attestations produced by assurance_attest without trusting the agent that produced them.
Annotations the server declares
- title: Assurance Verify — check a signed record (free)
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
bond_analyzeBondLens (x402-paid, $0.25): deterministic fixed-income and loan analytics.Can send data out1 finding
Why it is in this group
- The name "bond_analyze" says "analyze": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Findings
- Warn
  The server marks "bond_analyze" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "bond_analyze" says "analyze": a word for reading.
  What this check looks for
Description, as the server wrote it
BondLens (x402-paid, $0.25): deterministic fixed-income and loan analytics. Bond mode solves price<->yield-to-maturity, duration, and convexity; loan mode (send principal+annualRate+termMonths) returns an amortization schedule.
Annotations the server declares
- title: BondLens — bond & loan analytics
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
cashflowlens_analyzeCashflowLens (x402-paid, $0.20): deterministic NPV, IRR, XIRR, DCF valuation, MOIC/DPI/TVPI, and payback period from a cashflow series.Can send data out1 finding
Why it is in this group
- The name "cashflowlens_analyze" says "analyze": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Findings
- Warn
  The server marks "cashflowlens_analyze" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "cashflowlens_analyze" says "analyze": a word for reading.
  What this check looks for
Description, as the server wrote it
CashflowLens (x402-paid, $0.20): deterministic NPV, IRR, XIRR, DCF valuation, MOIC/DPI/TVPI, and payback period from a cashflow series. Use for valuation and return analysis instead of letting the model estimate.
Annotations the server declares
- title: CashflowLens — DCF, IRR & cashflow returns
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dealanalyzer_analyzeDealAnalyzer (x402-paid, $2.00): the flagship.Can send data out1 finding
Why it is in this group
- The name "dealanalyzer_analyze" says "analyze": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Findings
- Warn
  The server marks "dealanalyzer_analyze" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dealanalyzer_analyze" says "analyze": a word for reading.
  What this check looks for
Description, as the server wrote it
DealAnalyzer (x402-paid, $2.00): the flagship. Deterministic full deal underwrite in a single call — DCF valuation (EV, equity value, implied share price), fund returns (IRR/MOIC), and the LP/GP distribution waterfall, plus sensitivity. Combines what CashflowLens + WaterfallLens do, cross-checked.
Annotations the server declares
- title: DealAnalyzer — full deal underwriting in one call
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
emailguard_validateEmailGuard (x402-paid, $0.02): deterministic email/contact quality scorer — validity, deliverability score, disposable/role/free classification, typo suggestion.Can send data out1 finding
Why it is in this group
- The name "emailguard_validate" says "validate": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Findings
- Warn
  The server marks "emailguard_validate" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "emailguard_validate" says "validate": a word for reading.
  What this check looks for
Description, as the server wrote it
EmailGuard (x402-paid, $0.02): deterministic email/contact quality scorer — validity, deliverability score, disposable/role/free classification, typo suggestion. Pure function, no DNS.
Annotations the server declares
- title: EmailGuard — email validation
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
emailguard_validate_batchValidate up to 20 emails in one tool call — one deterministic verdict per record (validity, deliverability score, disposable/role/free classification, typo suggestion, canonical no…Can send data out1 finding
Why it is in this group
- The name "emailguard_validate_batch" says "validate": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Findings
- Warn
  The server marks "emailguard_validate_batch" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "emailguard_validate_batch" says "validate": a word for reading.
  What this check looks for
Description, as the server wrote it
Validate up to 20 emails in one tool call — one deterministic verdict per record (validity, deliverability score, disposable/role/free classification, typo suggestion, canonical normalization). Pass your free apiKey (250 records/mo, no wallet — https://hermesplant.com/pricing) and each record serves from quota. Results preserve input order; the batch stops at the first 402 (quota exhausted) and marks the rest skipped so you can upgrade and resume.
Annotations the server declares
- title: EmailGuard — validate a whole contact list
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
evidence_verifyEvidence Verification (x402-paid, $0.05): verify an agent-commerce evidence bundle before trusting a paid result — x402 challenge/receipt/policy-decision/service-response artifacts…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Evidence Verification (x402-paid, $0.05): verify an agent-commerce evidence bundle before trusting a paid result — x402 challenge/receipt/policy-decision/service-response artifacts, endpoint and price binding, freshness, hashes, synthetic-proof leakage. Returns verified / needs_review / rejected / insufficient_evidence with per-rule evidence.
Annotations the server declares
- title: Evidence Verify — check a paid result's evidence bundle
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
mcp_risk_scoreMCP Server Risk Analyzer (x402-paid, $0.05): score an MCP server manifest for security risk before install — destructive tools, over-broad scopes, weak auth, egress — with per-tool…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
MCP Server Risk Analyzer (x402-paid, $0.05): score an MCP server manifest for security risk before install — destructive tools, over-broad scopes, weak auth, egress — with per-tool findings and fixes.
Annotations the server declares
- title: MCP Server Risk Analyzer
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
options_priceOptionLens (x402-paid, $0.30): deterministic Black-Scholes price and full Greeks (delta, gamma, vega, theta, rho) for European calls/puts, with dividend yield, intrinsic/time value…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
OptionLens (x402-paid, $0.30): deterministic Black-Scholes price and full Greeks (delta, gamma, vega, theta, rho) for European calls/puts, with dividend yield, intrinsic/time value, and moneyness.
Annotations the server declares
- title: OptionLens — Black-Scholes price & Greeks
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
portfolioguard_scorePortfolioGuard (x402-paid, $0.15): deterministic portfolio risk scoring from holdings — volatility, Sharpe, max drawdown, concentration (HHI), diversification, plus per-rule findin…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
PortfolioGuard (x402-paid, $0.15): deterministic portfolio risk scoring from holdings — volatility, Sharpe, max drawdown, concentration (HHI), diversification, plus per-rule findings.
Annotations the server declares
- title: PortfolioGuard — portfolio risk
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
score_destructguard_commandScore a command/action with the x402-paid DestructGuard service.Can send data outNo findings
Why it is in this group
- The input takes a statement or command to run (input.command), which can change anything it can reach.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Score a command/action with the x402-paid DestructGuard service. Call get_x402_manifest first, verify the DestructGuard price and buyer policy, then retry the 402 challenge with an x402 payment signature.
Annotations the server declares
- title: DestructGuard — score command risk
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
start_checkoutStart a Stripe checkout session for a product slugReads text others writeNo findings
Why it is in this group
- The name "start_checkout" says "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Start a Stripe checkout session for a product slug
Annotations the server declares
- title: Start checkout
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
submit_reviewqueue_requestSubmit a command/action to the x402-paid ReviewQueue agent service.Can send data outNo findings
Why it is in this group
- The name "submit_reviewqueue_request" says "submit": a word for a change.
- The input takes a statement or command to run (input.command), which can change anything it can reach.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
Submit a command/action to the x402-paid ReviewQueue agent service. Call get_x402_manifest first, verify the ReviewQueue price and buyer policy, then retry the 402 challenge with an x402 payment signature.
Annotations the server declares
- title: ReviewQueue — submit for risk triage
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
walletguard_scoreWalletGuard (x402-paid, $0.10): analyzes caller-provided sanctions, exposures, labels, and funding context.Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
WalletGuard (x402-paid, $0.10): analyzes caller-provided sanctions, exposures, labels, and funding context. Positive risk findings receive a score; no risk findings means unknown with a null score and review required. No chain lookup, independent sanctions screening, or compliance clearance.
Annotations the server declares
- title: WalletGuard — supplied wallet risk signals
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
waterfall_distributeWaterfallLens (x402-paid, $0.30): deterministic LP/GP distribution waterfall (return of capital, preferred, GP catch-up, carried-interest split) with the exact split, per-tier brea…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it
WaterfallLens (x402-paid, $0.30): deterministic LP/GP distribution waterfall (return of capital, preferred, GP catch-up, carried-interest split) with the exact split, per-tier breakdown, LP MOIC, and effective carry %.
Annotations the server declares
- title: WaterfallLens — LP/GP distribution waterfall
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 5Looks things up and changes nothing.Claude Code: allow

freetier_statusCheck a free API key's remaining monthly quota, reset date, and upgrade path.No findings
Why it is in this group
- The name "freetier_status" says "status": a word for reading.
Description, as the server wrote it
Check a free API key's remaining monthly quota, reset date, and upgrade path. Pass your hp_free_ key as apiKey. No key yet? POST an email to https://hermesplant.com/api/keys/free (250 calls/mo, no wallet).
Annotations the server declares
- title: Free-tier key status
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
get_checkout_policiesReturn legal policy URLs required before checkoutNo findings
Why it is in this group
- The name "get_checkout_policies" says "get": a word for reading.
Description, as the server wrote it
Return legal policy URLs required before checkout
Annotations the server declares
- title: Get checkout policies
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
get_productGet a single product by slugNo findings
Why it is in this group
- The name "get_product" says "get": a word for reading.
Description, as the server wrote it
Get a single product by slug
Annotations the server declares
- title: Get product
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
get_x402_manifestReturn the live x402 manifest with paid endpoint prices, Bazaar metadata, and buyer policy checksNo findings
Why it is in this group
- The name "get_x402_manifest" says "get": a word for reading.
Description, as the server wrote it
Return the live x402 manifest with paid endpoint prices, Bazaar metadata, and buyer policy checks
Annotations the server declares
- title: Get x402 manifest
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
list_productsList active products from the Hermes Plant catalogNo findings
Why it is in this group
- The name "list_products" says "list": a word for reading.
Description, as the server wrote it
List active products from the Hermes Plant catalog
Annotations the server declares
- title: List products
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; purchase_with_x402
start_checkout
Can send data out18: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; action_safety_quick_gate
action_safety_run
assurance_attest
bond_analyze
cashflowlens_analyze
dealanalyzer_analyze
emailguard_validate
emailguard_validate_batch
evidence_verify
mcp_risk_score
options_price
payment_policy_decide
and 6 more

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:52 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 20
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

HighThe whole server
The endpoint served tools/list without credentials, and the list has 20 tools that change things (2 irreversible, 18 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://mcp.hermesplant.com/mcp: tools/list returned 25 tools to an anonymous client, including purchase_with_x402 (irreversible), payment_policy_decide (irreversible), start_checkout (write), action_safety_quick_gate (write), action_safety_run (write) and 15 more
What this check looks for

Install

Pinned to version 2.0.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http hermes-plant https://mcp.hermesplant.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__hermes-plant__freetier_status",
      "mcp__hermes-plant__list_products",
      "mcp__hermes-plant__get_product",
      "mcp__hermes-plant__get_checkout_policies",
      "mcp__hermes-plant__get_x402_manifest"
    ],
    "ask": [
      "mcp__hermes-plant__start_checkout",
      "mcp__hermes-plant__purchase_with_x402",
      "mcp__hermes-plant__action_safety_quick_gate",
      "mcp__hermes-plant__action_safety_run",
      "mcp__hermes-plant__submit_reviewqueue_request",
      "mcp__hermes-plant__score_destructguard_command",
      "mcp__hermes-plant__dealanalyzer_analyze",
      "mcp__hermes-plant__cashflowlens_analyze",
      "mcp__hermes-plant__waterfall_distribute",
      "mcp__hermes-plant__options_price",
      "mcp__hermes-plant__bond_analyze",
      "mcp__hermes-plant__portfolioguard_score",
      "mcp__hermes-plant__walletguard_score",
      "mcp__hermes-plant__emailguard_validate",
      "mcp__hermes-plant__emailguard_validate_batch",
      "mcp__hermes-plant__mcp_risk_score",
      "mcp__hermes-plant__payment_policy_decide",
      "mcp__hermes-plant__evidence_verify",
      "mcp__hermes-plant__assurance_attest",
      "mcp__hermes-plant__assurance_verify"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hermes-plant. Review it before you use it.

Capability tags behind 19 rules

mcp__hermes-plant__start_checkout untrusted-input
mcp__hermes-plant__purchase_with_x402 untrusted-input, outbound
mcp__hermes-plant__action_safety_quick_gate outbound
mcp__hermes-plant__action_safety_run outbound
mcp__hermes-plant__submit_reviewqueue_request outbound
mcp__hermes-plant__score_destructguard_command outbound
mcp__hermes-plant__dealanalyzer_analyze outbound
mcp__hermes-plant__cashflowlens_analyze outbound
mcp__hermes-plant__waterfall_distribute outbound
mcp__hermes-plant__options_price outbound
mcp__hermes-plant__bond_analyze outbound
mcp__hermes-plant__portfolioguard_score outbound
mcp__hermes-plant__walletguard_score outbound
mcp__hermes-plant__emailguard_validate outbound
mcp__hermes-plant__emailguard_validate_batch outbound
mcp__hermes-plant__mcp_risk_score outbound
mcp__hermes-plant__payment_policy_decide outbound
mcp__hermes-plant__evidence_verify outbound
mcp__hermes-plant__assurance_attest outbound

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.JesseGdotIO/hermes-plant/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

20 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:17 UTC.

For agents: Markdown · JSON · report this listing