Hermes Agent Community Reports Scheduled Tool Allowlist Mismatch That Could Broaden Tool Access

A new community report flags a limitation in Hermes Agent’s scheduled tool restrictions. An issue filed on October 19 says that when a task sets enabled_toolsets to mcp-<name>, the scheduler may also add tools from every enabled MCP service. This could expose write tools to an agent that only needs to read data. The reported environment was macOS with v0.22.2 installed from Git; the issue remains open, so it does not establish that all deployments are affected. Issue report

The reporter configured structured, which provides both read and write tools, and structured-read, which uses tools.include to retain only read tools. The reproduction shows that specifying mcp-structured-read brings in other services, while using structured-read without the prefix preserves the original list. The report says the validation layer accepts both names, but the scheduler’s merge logic compares only the original service name. It therefore mistakenly treats the task as having no MCP service specified and adds all services. Reproduction and explanation

The official documentation describes enabled_toolsets as a per-task mechanism for controlling tool access, taking precedence over cron platform settings. Each scheduled run executes in a new agent session. This gives the report practical deployment relevance: the restrictions engineers save may differ from the tool set made available to the model at runtime. The documentation also notes that carrying extra tools increases the tool-schema overhead for each model call. Scheduled tool configuration documentation

From a permissions-design perspective, this kind of name-normalization mismatch may undermine the expectation of least privilege for each task. However, a tool appearing in an agent’s available list does not by itself mean an unauthorized write occurred. Deployers can first compare the tool sets resolved from the two names in the report, then verify scheduled execution in an isolated environment. Follow-up should track whether a fix aligns the validation and merge rules, and whether existing tasks need adjustment. The public issue does not yet list a fix branch or official fixed version. Issue status