MCP Server Security Validator (hermes_cli/mcp_security.py)

Performs security checks and blocklist validation on user-configured Model Context Protocol server entries. Reuse when securing tool execution environments against malicious injections.

# Source: https://github.com/fathah/hermes-agent | License: MIT | Copyright 2025 Nous Research
# Provided via justclaw.it.com; keep this notice with the code.
"""Security checks for user-configured MCP server entries.

Blocks three narrow shapes (see ``validate_mcp_server_entry``), including a hardcoded IOC blocklist
for the June 2026 hermes-0day campaign. Runs BOTH at save time (``_save_mcp_server`` — dashboard API +
CLI) and at spawn time (``tools.mcp_tool._filter_suspicious_mcp_servers``), so a hand-edited or
pre-planted ``config.yaml`` entry is caught before it can execute.
"""
from __future__ import annotations

import os
import re
import shlex
from typing import Any

_SHELL_INTERPRETERS = frozenset({
    "bash", "sh", "zsh", "dash", "fish", "cmd", "cmd.exe", "powershell", "powershell

... (truncated -- full source via MCP)