Hermes Paperclip Adapter
@marketintellabs/hermes-paperclip-adapter · by justinltodd
MarketIntelLabs fork of the Paperclip adapter for Hermes Agent — with adapter-owned status transitions, an in-process MCP tool server (paperclip-mcp) that replaces curl-in-prompt with structured tool calls, MIL heartbeat prompt templates, and OpenRouter m
2 open CVEs
MIT license
Maintained
Last commit 44d ago
Works with most clients
Transport: stdio
1 tool · ~79 tok
Grade A · 0.0% of 200K ctx
MCPpedia last refreshed this data
This server has been archived and is no longer actively maintained.
Hermes Paperclip Adapter is an MCP server that MarketIntelLabs fork of the Paperclip adapter for Hermes Agent — with adapter-owned status transitions, an in-process MCP tool server (paperclip-mcp) that replaces curl-in-prompt with structured tool calls, MIL heartbeat prompt templates, and OpenRouter m. Its tool list has not been published yet over stdio, requires no API key, and scores 60/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"hermes-paperclip-adapter": {
"args": [
"-y",
"@marketintellabs/hermes-paperclip-adapter"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/hermes-paperclip-adapter)
Read me
What Hermes Paperclip Adapter does
Actively maintained by MarketIntelLabs. This > package is a MarketIntelLabs fork of the > upstream hermes-paperclip-adapter > by Nous Research, published to npm as > @marketintellabs/hermes-paperclip-adapter. > All production deploys at MarketIntelLabs consume this fork. Upstream credit > for the core adapter design goes to Nous Research; all fork-specific > behaviours (listed under MIL-specific features > below) are maintained here. See UPSTREAM.md for the fork > point, divergence list, and s
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@marketintellabs/hermes-paperclip-adapter' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
60/100across 5 weighted dimensions
0255075100
15
20
15
10
−40
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev2 open8 fixed
CVE-2026-10224mediumCVSS 5.3
hermes-agent has an Uncontrolled Resource Consumption issue
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_webhook_request of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected:
>= 0source →CVE-2026-10223medium · fixedCVSS 6.3
hermes-agent has an Injection issue
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_content of the file tools/memory_tool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-10221highCVSS 7.3
hermes-agent has an Injection issue
A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected:
>= 0source →CVE-2026-53869high · fixedCVSS 7.5
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.
CVE-2026-53870medium · fixedCVSS 5.5
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.
Inventory
Tools (1)
Click any tool to inspect its schema.
~79 tokens total
Inventory
Prompts (1)
builtin:mil-heartbeat-v3Prefers the new update_issue_status tool over the RESULT marker for issue status transitions
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is Hermes Paperclip Adapter safe to use?
- Hermes Paperclip Adapter has 4 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "@marketintellabs/hermes-paperclip-adapter". Review the Security section above for details before installing.
- How do I install Hermes Paperclip Adapter?
- Hermes Paperclip Adapter supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can Hermes Paperclip Adapter do?
- Hermes Paperclip Adapter provides 1 tool: update_issue_status. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with Hermes Paperclip Adapter?
- Hermes Paperclip Adapter is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
- Is Hermes Paperclip Adapter actively maintained?
- Hermes Paperclip Adapter is recently maintained — last commit was 44 days ago. It has 6 GitHub stars.
Related
Similar servers
Others in ai-ml / developer-tools
Dsh MCP Client97MCP client bridge: connects to MCP servers and registers their tools on ctx.tools
196.7k 4
Gpt Researcher97An autonomous agent that conducts deep research on any data using any LLM providers
29.2k 5
Context797Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
61.2k 2
Modelcontextprotocol96The official MCP server implementation for the Perplexity API Platform
2.5k 4
MCP Security Weekly
Get CVE alerts and security updates for Hermes Paperclip Adapter and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.