Hermes Pkm Toolkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Hermes Pkm Toolkit (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Native skills and MCP primitives for agents that operate local Markdown/Obsidian PKM vaults.
This repository does not replace Hermes Agent or OpenClaw. It gives them a small, installable operating layer for personal knowledge management: safe Markdown file access, delta tracking, and protocol skills for GTD, PARA, and Johnny.Decimal.
The database is the local filesystem. Git is the audit trail. Markdown is the interface.
.hermes.md, AGENTS.md, MCP stdio server, and SKILL.md skills.skills/<slug>/SKILL.md workspace/project skills with short descriptions and hyphen-case names.CLAUDE.md, AGENTS.md, and .mcp.json.AGENTS.md Shared agent instructions
.hermes.md Hermes-native project context
CLAUDE.md Claude Code compatibility context
.mcp.json MCP server example for compatible clients
skills.sh.json Skill grouping metadata
skills/
hermes-pkm/SKILL.md Main PKM operating skill
gtd-capture/SKILL.md GTD inbox and task capture
para-router/SKILL.md PARA routing workflow
johnny-decimal-router/SKILL.md Johnny.Decimal routing workflow
00_CORE/
hermes_mcp_server.py Local stdio MCP server for Markdown vaults
delta_tracker.py Hash/timestamp delta tracking for `.md` filesLegacy human guides and protocol notes remain under 01_JOHNNY_DECIMAL, 02_GTD, and 03_PARA.
Hermes supports project context files and external skill directories. From a local clone:
export HERMES_VAULT_ROOT="$HOME/Documents/MyVault"
python3 -m pip install mcp
python3 00_CORE/hermes_mcp_server.pyRecommended Hermes config shape:
mcp_servers:
hermes-pkm-vault:
command: "python3"
args: ["/absolute/path/hermes-pkm-toolkit/00_CORE/hermes_mcp_server.py"]
env:
HERMES_VAULT_ROOT: "/absolute/path/to/vault"
skills:
external_dirs:
- /absolute/path/hermes-pkm-toolkit/skillsThen invoke /hermes-pkm or let Hermes select the skill naturally.
OpenClaw loads workspace skills from <workspace>/skills and project/personal skill roots. Copy or symlink the skill directories:
mkdir -p ~/.openclaw/workspace/skills
ln -s /absolute/path/hermes-pkm-toolkit/skills/hermes-pkm ~/.openclaw/workspace/skills/hermes-pkm
ln -s /absolute/path/hermes-pkm-toolkit/skills/gtd-capture ~/.openclaw/workspace/skills/gtd-capture
ln -s /absolute/path/hermes-pkm-toolkit/skills/para-router ~/.openclaw/workspace/skills/para-router
ln -s /absolute/path/hermes-pkm-toolkit/skills/johnny-decimal-router ~/.openclaw/workspace/skills/johnny-decimal-router
openclaw skills listUse openclaw gateway restart or start a new session if the skills watcher has not refreshed.
00_CORE/hermes_mcp_server.py exposes:
list_resources: list Markdown files in the vault.read_resource: read a Markdown file.append_to_file: append Markdown safely.create_file: create a new Markdown file without overwriting.All paths are relative to HERMES_VAULT_ROOT. The server blocks path traversal and rejects non-Markdown writes.
python3 00_CORE/delta_tracker.py "$HERMES_VAULT_ROOT"This writes:
<vault>/.hermes/delta_tracker.jsonThe tracker compares sha256, mtime_ns, and size for every .md file and reports added, modified, deleted, and unchanged_count.
.hermes/delta_tracker.json.create_file.MIT.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.