hermes-traffic-guardian

Hermes runtime traffic monitoring detects secret exfiltration, command-injection, and tool-abuse payloads by analyzing HTTP/HTTPS flows. It provides start, stop, status, and log-query commands to track and review security events.

Runtime posture attestation exports the monitor's current security posture as a trust anchor. The exported posture data is consumed by hermes-attestation-guardian to verify that Hermes traffic monitoring is active and compliant.

Yes, you need both Node.js and Python 3 installed in your environment to execute the Hermes traffic monitoring scripts. These dependencies are required to run the runtime traffic analysis and posture export commands.

The best way to detect tool-abuse payloads in Hermes HTTP traffic is to deploy a baseline monitoring skill that inspects runtime flows. It specifically identifies tool-abuse signals alongside exfiltration and injection attempts.

Yes, you can export the Hermes monitor posture for compliance attestation. The skill exports the runtime monitoring state so it can be included as a trust anchor by hermes-attestation-guardian.