Registers superagents-lab/hermes-search1api (v0.1.0) — five tools backed by
the Search1API API: search1api_search, search1api_news, search1api_crawl,
search1api_sitemap, search1api_trending. Vendored official Python SDK; only
third-party dependency is httpx (already a Hermes core dependency).
hermes plugins validate (main @ 6005aa1): all checks pass, security scan
safe; declared tools match registrations.
Submitted by the plugin repo owner (superagents-lab).
The pinned tree now carries an Agent Plugins v1 plugin.json at the repo
root, so 'hermes plugins validate' passes and the catalog installer
finds its manifest. Security scan clean (no cautions).
New pin: 347ce44a1e71173285b2943a7a97bbdece8327b2
Split out from drkpxl/drkpxl-skills so the entry matches the product:
one skill, one repo, name on the tin. The new repo contains only the
morning-briefing skill. Entry name, repo URL, SHA pin, description,
and category all updated.
Community skills collection by the repo owner (drkpxl). Anchor skill:
morning-briefing — a personal daily newspaper that gathers weather,
calendar, AQI, curated 36-hour news (Reddit RSS + X + web search with
per-story QR codes), and newsletter digests, renders a single 8.5x11
newsprint page, and prints it every morning.
Also bundles: Tiny Air (US AQI via MCP), Bro, Copywriting, Delegate to
pi, Prototype, Research, Requesting Code Review.
SKILL.md follows the HARDLINE authoring standards (validated: 54-char
description, modern section order, native tool references). SHA pinned
at d81a9b5ee427a378839828d4a8eab3925468b7ce.
Adopts the DNS-rebinding-pinned transport hardening (repo issues #2/#3,
PR #3) and the starter-feed/settings failure-surfacing + SSRF-gated icon
proxy fix (issue #6, PR #8). Full range in
tony-simons-aiowa/hermes-newswire deccdc4..e6b438e (13 commits):
Security-relevant highlights:
- All outbound fetches (feeds, redirects, icons) now go through a pinned
transport: the SSRF gate's validated address set is bound to the actual
connection — no second DNS lookup, so DNS rebinding/TOCTOU has no
window; the plugin fails closed if the pin seam changes.
- New GET /icon.json proxies favicons through the same gate and returns
base64 data URLs — the renderer's <img> no longer performs unpinned
DNS resolutions of feed-controlled hostnames. 64 KB cap enforced
mid-transfer; image content-type allowlist; bounded, normalized TTL
cache.
- Renderer surfaces backend failures (settings/sources banners,
starter-feed inline errors) instead of silent no-ops.
Capabilities unchanged (all empty — dashboard plugin, no tools/hooks/
env). Verification at the new pin: 129 pytest, 33 renderer interaction
checks, 26 ESM render smoke, hermes plugins validate clean.
Self-hosted Memobase (user profile + event timeline) as a MemoryProvider.
Hybrid BM25 + vector + entity RRF recall, temporal boost on time-window
queries, and a conditional cross-encoder rerank.
The reranker is opt-in with no default endpoint: it runs only when the
deployment sets both rerank_base_url and rerank_api_key, so a default
install talks only to the user's own Memobase server.
Pinned to 4e8e447 of fred0m/hermes-memobase-provider. Declares the two env
vars the install must prompt for.
Owner-submitted (anotherchu/billing). Desktop-half-only package: root
plugin.yaml + desktop/plugin.js, no __init__.py — the manifest-only path
home-dashboard also takes, so the capability probe is skipped.
At the pinned commit: scripts/validate_plugin_catalog.py passes;
`hermes plugins validate` passes (manifest fields, requires_hermes,
built-in collisions); the CI's pinned-source clone/checkout/validate
sequence was reproduced locally. Self-updater grep over every .js file:
clean. requires_hermes ">=0.19" — the desktop plugin SDK surface and the
billing.state gateway RPC both exist as of v2026.7.20 (0.19.0).
Kiro CLI (AWS) as a Hermes model provider via the external-process (ACP)
seam — a ProviderProfile spawning `kiro-cli acp` over stdio, extending the
in-tree copilot-acp shim. Pinned to v0.1.0 (fe95ccba), which is
E2E-verified: discovery via both install paths, live completion through
kiro-cli 2.22.0, plugin test suite 5/5 green at that commit.
Pins emadalsaba/hermes-session-styler at the commit that passes the pinned-source gate.
Capabilities declared empty: the plugin contributes no agent tools, hooks, middleware or env vars —
the whole implementation is the desktop half.
Serply web search provider, pinned at c6cab414. Registers a single
WebSearchProvider and reads SERPLY_API_KEY; no tools, hooks, or middleware.
Submitted as the owner of serply-inc/hermes-web-serply.
Junie driven over the Agent Client Protocol, shipped from the JetBrains/junie
repository as an out-of-tree model provider against the registration seam that
landed in #95679 and #101456.
Pinned at 296ea839b354956fbd22544687a88b944c18dc22, subdir hermes-plugin.
capabilities are empty by design: a model-provider plugin registers a
ProviderProfile at import and no tools, hooks or middleware, which the pinned
tree's capability probe confirms. requires_env is empty because no variable is
required — the CLI authenticates by JetBrains account login, a JUNIE_API_KEY
token, or BYOK, and the plugin forwards the token only when it is set.
Co-Authored-By: Junie <junie@jetbrains.com>
The Devs-Foundation/mnemosyne entry (created 2026-08-10, last push 2026-08-11, 0 stars) is
unrelated to the Mnemosyne project per its maintainers and registers the same memory-provider
name, which makes memory.provider: mnemosyne ambiguous. It is delisted (plain removal, not the
removed.yaml blocklist: nothing malicious) and welcome back under a distinct name. The official
mnemosyne-oss submission (#113581, wrapper shape validated end to end) takes the bare key.
requires_hermes floor set to the first release that carries #113851 (0.21.4 or later).
README gains the delist-vs-remove distinction and the provider-name collision rule.
subdir moves to integrations/hermes-catalog, the directory plugin shape
from #113851 (plugin.yaml kind exclusive, __init__.py shim, dependency
pyproject). sha 17abb10 is the merge of mnemosyne-oss/mnemosyne#974.
Tool list trimmed to the 37 tools register() exposes in an isolated
probe; requires_hermes >=0.22.
