Ship Safe v10.0.0

Ship Safe v10.0.0

Ship Safe v10 adds evidence-backed security coverage for Hermes Agent and
expands the investigation layer across the AI agent boundary.

The scanner is designed to answer a more useful question than “did a pattern
match?”: can untrusted content actually reach a credential, privileged tool,
or external side effect? Findings remain deterministic, while verdicts are
derived from cited evidence. Unresolved citations do not decide a verdict, and
equal-rank disagreement is reported as unresolved rather than escalated into a
false confirmation.

Hermes Agent coverage

This release is calibrated against the immutable Hermes Agent v0.21.0
(v2026.8.31) source snapshot at commit
29112bef099274229cadff79cdff7bf7b99c4b77.

Ship Safe now traces security-relevant reachability across:

• Hermes plugin manifests and plugin operations
• Network adapter allowlists and dispatch paths
• Terminal backend posture and untrusted MCP reachability
• ACP and TUI gateway exposure
• Cron jobs and scheduled subprocesses
• Credential declarations, scopes, consumers, and external effects

The coverage matrix is intentionally explicit. These surfaces remain partial
when dynamic call targets, custom wrappers, external plugin installations,
third-party schedulers, or deployment behavior cannot be resolved statically.

Cron lifecycle analysis

Cron analysis now models the complete lifecycle rather than matching isolated
schedule strings:

• schedule definition and persistence
• execution identity and scheduled action
• cancellation and cleanup
• symmetry between guarded creation and later updates
• release of run-scoped authority on exception and retry paths

The pinned Hermes baseline exposed one update-path asymmetry for review: job
creation validates the effective prompt and script, while a lower-level update
path persists merged fields without repeating the same guard before the stored
job later reaches script execution. The scheduler’s normal, error, retry,
cancellation, and delivery cleanup paths are recognized as safe by the
retained-authority check.

Evidence-first investigation

Use the new investigation and capability commands to inspect an agent
deployment from outside the agent process:

npx ship-safe@10.0.0 audit /path/to/hermes-agent --hermes-only --no-ai --no-cache
npx ship-safe@10.0.0 investigate /path/to/hermes-agent --all
npx ship-safe@10.0.0 capabilities /path/to/hermes-agent
npx ship-safe@10.0.0 ci /path/to/hermes-agent --fail-on-verdict confirmed --sarif ship-safe.sarif

capabilities maps agent-readable instruction files, MCP servers and tools,
credentials, permissions, and privileged workflow triggers. investigate
separates confirmed, likely, unresolved, and refuted conclusions while
preserving the evidence and source locations behind each result.

MCP compatibility

The Ship Safe MCP server now:

• negotiates legacy MCP initialize protocol versions
• supports modern discovery requests
• preserves result envelopes and server metadata for current clients
• retains compatibility with existing clients and tool calls

This lets teams expose Ship Safe to MCP-capable clients while keeping the
deterministic scan and evidence output as the security source of truth.

CLI and machine-readable output fixes

This release also fixes several release-contract issues found during rendered
artifact QA:

• named plugin scaffolding now respects the requested plugin name
• doctor checks avoid shell-spawn deprecation and injection risk
• JSON and SARIF output stays parseable for red-team, benchmark, ABOM,
  environment-audit, skill, MCP, and diff commands
• diff output is restricted to the requested change scope
• empty-target and no-environment paths no longer pollute machine output
• Hermes lifecycle and credential-flow evidence is serialized consistently in
  JSON and SARIF

Verification

• 937 tests pass
• Node 18, 20, and 22 CI lanes pass
• Integration packaging and global-install checks pass
• Deterministic corpus: 13/13 vulnerable cases detected and 13/13 safe
  controls preserved
• Verdict benchmark: zero false refutations and zero unlabeled results
• Hermes release-evidence benchmark passes
• npm audit --audit-level=high: 0 vulnerabilities
• npm pack --dry-run: 146 intended files, no bundled dependencies

Important limitations

Ship Safe is an independent assessment layer, not a replacement for Hermes
runtime controls, OS isolation, least-privilege configuration, network egress
restrictions, short-lived credentials, or human review. It does not prove the
absence of a vulnerability, and a detected claim is not automatically a
confirmed exploit. Re-run the scan when Hermes changes and review the
Hermes coverage matrix
for the current baseline and known gaps.

See the full changelog
and comparison with specialist scanners.

Community contributors

Special thanks to everyone who has helped shape Ship Safe across its release history:

@AlvaroBalbin @Vermitrude @snowyukitty @SetraTheXX
@Gambit-Checkmate @happykawayigt @syf2211 @xianjianlf2
@Dessalines39394 @Radityaaa27 @slegarraga @Trighap52
@darlenepolek @alertxsto