Operational safety
The canonical operational safety and threat-model page for Hermes Satellite. Bridge access is powerful operator-grade access to Hermes.
Threat model and boundary
Hermes Satellite exposes a private authenticated MCP bridge to a real Hermes executor. A client that can call the bridge can ask Hermes to use configured tools, files, network, skills, and budget. That is operator-grade access, not a harmless status API.
Bind only to localhost, VPN, tailnet, or controlled LAN unless a deliberate protected edge with equivalent controls is in front. Blind public interface exposure is unsafe.
Private network placement
The bridge should bind to localhost, VPN, tailnet, or controlled LAN. Do not blindly bind to all interfaces or publish an unprotected public URL.
Bearer tokens and rotation
Store bearer tokens in a secret manager or local secret file outside public docs and source control. Use ${HERMES_MCP_TOKEN} placeholders. Rotate tokens after suspected exposure, accidental sharing, or client decommissioning.
Authorization smoke test
Smoke-test from a separate private-network node: unauthenticated MCP initialize must fail, and authenticated MCP initialize must succeed with discovered hermes_* tools.
The health endpoint is liveness only. A healthy /healthz response does not prove MCP tool authorization.
Public documentation boundary
Public docs must not include private IPs, hostnames, secrets, channel IDs, launch paths, local usernames, token paths, service labels, or private URLs. Use 100.x.x.x, <bridge-host>, and ${HERMES_MCP_TOKEN}.
FAQ for powerful MCP access
| Question | Answer |
|---|---|
| Can I expose it publicly with a token? | Not blindly. Use a deliberate protected edge, rate controls, logging, and rotation. |
| Does health prove auth? | No. Health endpoint is liveness only; initialize must fail without a token and succeed with a bearer token. |
| What if a token leaked? | Rotate, restart or reload clients and bridge, invalidate old config, and audit task events. |