Can Hermes Agent Audit a Live Website? Testing VibeLeak MCP End to End

Most AI security demos begin inside a repository. That is useful, but production truth lives somewhere else too. A deployment can publish a missing security header, a stale cloud reference, an exposed AI key pattern, or a route that does not behave the way the source code suggests. If the agent never looks at the live site, it starts with an incomplete map.

So we tested a more practical question: can Hermes Agent connect to the VibeLeak MCP, inspect a real public website signal, and receive output that is ready for the next security action?

Hermes Agent is an open agent from Nous Research with persistent memory, reusable skills, multiple messaging surfaces, and support for external tools through MCP. Its MCP client supports remote HTTP servers, tool discovery, per-server filtering, and OAuth. That makes it a natural operator for VibeLeak: the agent handles the workflow while VibeLeak supplies current public-surface evidence.

The VibeLeak server is a production Streamable HTTP MCP endpoint. Hermes only needs one server entry:

mcp_servers:
  vibeleak:
    url: "https://www.vibeleak.app/api/mcp"
    auth: oauth

From there, hermes mcp test vibeleak checks the server registration and transport. The important detail is that an agent run has four separate layers: the model provider, the Hermes runtime, the MCP transport, and VibeLeak authorization. A provider quota can stop a model response while the MCP server is still healthy. Likewise, a working transport does not grant private access. Treating those layers separately makes debugging faster and keeps security claims honest.

Tool discovery returned 17 capabilities. Five are public and twelve are owner-scoped. We then called get_connection_status and get_vibesignal_and_export for Cloudflare.com. Both completed. The session was correctly identified as anonymous, and VibeSignal returned 58 out of 100 with the label Partial Signal. All 17 public checks completed, the three underlying improvement details stayed redacted, and vibesignal-report-cloudflare.com.md was ready for an agent to consume.

The 58 is an AI-visibility signal, not a security grade and not a claim that Cloudflare is vulnerable. It measures public discoverability, content access, bot control, protocol discovery, and commerce signals. The more important result was the state boundary: public evidence was useful enough to begin triage, while scanDomain remained false. The server did not confuse tool discovery with authorization or leak private details into an anonymous conversation.

This is the trust loop in concrete terms. Anyone can ask for a redacted public grade, a VibeSignal, or Trust Index visibility because those describe the outward-facing site. An authenticated owner can run a fresh domain scan, retrieve private findings, request remediation actions, export the complete Markdown report, run VibeRank, or enable Score Watch.

• Vibe-coded apps where AI-generated routes, environment handling, and cloud configuration changed faster than the security checklist.
• Solo founders who need a repeatable website security scanner workflow without pretending an agent is a full security team.
• Agencies that want an agent-ready handoff from live-site evidence to the developer responsible for the fix.
• Teams using several AI models that want one model-agnostic MCP security tool instead of rebuilding integrations for every agent.
• Operators who need continuous checks for public drift after a clean launch or migration.

VibeLeak is useful here because its signals map to mistakes fast-moving teams actually ship. AIGuard looks for exposed AI key patterns. CloudLeak surfaces risky cloud references and public configuration. Security-header checks show browser protections that are absent or weak. VibeSignal gives an instant public score, while the complete Markdown export gives Hermes structured evidence instead of a screenshot or a vague instruction to make the site secure.

This is not a penetration test, and the public walkthrough did not run a private owner scan against Cloudflare. It verified server reachability, tool discovery, connection status, a live public VibeSignal assessment, redaction behavior, a Markdown handoff, and the owner gate. The authenticated flow adds deeper security findings and actions, but it should run only against assets you own or are authorized to test.

Also, neither side should claim victory from a proposed patch. VibeLeak shows the outside symptom. Hermes can help trace and change the inside cause. Your tests, review process, deployment controls, and final live rescan remain part of the job.