Operator request: Pantheon uses openbao for secrets but has little defense against malicious code injected via third-party packages (npm/PyPI/Docker supply-chain attack class — Canister Sprawl, pg-serve, x-inference, TanStack, Vercel-OAuth-token chain). Hades-domain initiative built on Cerberus daemon (or sibling Hades daemon). Hermes research, Hades implementation.
3 parallel sub-agent tracks → 366 lines of backing detail. This brief is the synthesis layer.
Sibling files:
- attack-surface.md (84 lines) — 16 entry-point classes mapped
- defense-tools.md (169 lines) — verified candidate matrix per ecosystem
- cerberus-integration.md (113 lines) — daemon-shape options + 3 loops
MCP servers are the #1 unmitigated attack surface in Pantheon today. 10 of 10 constellation repos load MCP servers via npx -y @vendor/package with zero release-age gating, zero signature verification, zero install-script blocking, zero pinning — and the global ~/.claude.json has @mauricio.wolff/mcp-obsidian@latest (unpinned @latest tag → every session-start downloads whatever the registry serves). A Canister-Sprawl-class npm worm landing on any MCP package in our fleet would compromise every Pantheon session that touches it.
The fleet's runtime-isolation layer is gone. Kernel sandbox (Seatbelt sandbox-exec) was removed 2026-04-02 (per OPS.md §1). Sole runtime guard today is hades-vault-guard.sh — a 3-second bash regex hook that blocks credential exfil paths. It does not stop a malicious package from reading non-credential files, spawning network connections, or pivoting laterally. 28 of 29 launchd daemons launch raw bash/python with no nono profile.
Two confirmed OSS gaps with no mature solution today — MCP-server install-time isolation (closest fits: cisco-ai-defense/mcp-scanner 947★ static-only; declaw-ai/mcp-sandbox 3★ unproven) and OAuth-grant audit (zero relevant OSS for GH/Google/npm/Vercel grant inventories). Both must be built or fleet-vendored, not adopted.
High-leverage adoption surface exists for everything else. Multi-ecosystem scanners (OSV-Scanner 10.4k★ Apache, Trivy 35k★ Apache) + per-eco picks (pip-audit, cargo-audit/deny/vet, npq + LavaMoat allow-scripts + lockfile-lint) + SBOM/sign (syft + cosign) → 80%+ of the seven-control posture from the Better Stack video lands inside a couple weeks of Hades-led work.
| Class | Count today | Current verification | Risk |
|---|---|---|---|
MCP servers (npx -y @vendor/pkg) |
~14 unique pkgs across 10 repos | NONE (no pinning, no scripts-off, no audit) | CRITICAL |
| Claude Code plugins | 28 from 4 marketplaces | Marketplace trust only | high |
| Claude Code skills | 328 per-repo | Author-vendored, mixed provenance | medium |
| npm prod deps | ~32 across 9 repos | 1 of 9 has package-lock.json; 0 .npmrc |
high |
| Python manifests | 5 repos | 0 lockfiles | medium |
| Rust manifests | (none confirmed in fleet) | n/a | n/a |
| Homebrew | 0 Brewfiles | brew-manual | medium |
| launchd daemons | 29 plists, ~25 unique scripts | 28 of 29 launch raw bash/python, no nono profile | high |
| Cerberus daemon stack | binding-rot diagnosed yesterday | install scripts unpinned | high |
| PreToolUse hooks | 17 scripts | hades-vault-guard.sh = sole regex gate | n/a (defense layer) |
| openbao plugins | not enumerated (vault-guard blocks read) | unknown | flagged |
| Docker | 0 stacks running locally | n/a | n/a |
| Self-hosted CI runners | 0 | n/a | n/a |
Full inventory + uncertainty markers: attack-surface.md.
All star/license/last-push verified via gh api. Vendor-eval discounted per 2026-05-22 lesson.
| Slot | Pick | License | Stars | Score |
|---|---|---|---|---|
| Multi-eco scanner (CI gate) | OSV-Scanner (google/osv-scanner) | Apache-2 | 10.4k | 10/10 |
| Container + filesystem scan | Trivy (aquasecurity/trivy) | Apache-2 | 35k | 10/10 |
| Python audit | pip-audit (pypa/pip-audit) | Apache-2 | — | primary; pair with GuardDog for pre-install malware-pattern check |
| Rust audit + policy | cargo-audit + cargo-deny + cargo-vet | Apache-2 / Apache-2 / Apache-2 | — | rustsec baseline + policy gate + peer attestation |
| Brew | config-only: brew bundle pin + brew analytics off + Trivy filesystem scan of /opt/homebrew |
— | — | no dedicated tool exists |
| SBOM + sign+verify | syft + cosign (anchore + sigstore) | Apache-2 | — | canonical pair; DependencyTrack if server-side aggregation wanted |
| npm hardening | npq (the "mpq" from Better Stack video — verified) + LavaMoat @lavamoat/allow-scripts + lockfile-lint + native npm audit signatures |
mixed OSS | — | drop-in stack |
| MCP-server install isolation | CONFIRMED GAP — build internally | — | — | nono-pattern sandbox-exec wrapper around npx-spawned servers |
| OAuth-grant audit | CONFIRMED GAP — build internally | — | — | per-surface (GH/Google/npm/Vercel) GraphQL crawler |
Rejected: Endor Labs (closed-source SaaS), Snyk (per-seat paid wall), Socket Firewall (vendor-managed, free tier has rate-limit issues), semgrep/mcp (archived 2025-10).
Full matrix + rejected with verified reasoning: defense-tools.md.
Daemon-shape options (Hades governance call):
| Option | Shape | Pros | Cons |
|---|---|---|---|
| A | Extend Cerberus itself | Single daemon, single Healthchecks endpoint | Mission-creep on health-only daemon; harder failure attribution |
| B | Sibling Hades daemon (e.g. "Heimdall") | Clean separation, separate failure mode | +1 daemon to keep alive |
| C | PreToolUse hook only (inline gate per session) | Cheap; catches active-session installs | Misses background installs; LLM-bypass risk (video lesson) |
| D | Hybrid B+C | Best coverage | Highest complexity; manage LLM-bypass attack surface |
Sub-agent C's tentative lean (if forced): B + C hybrid for cleanest separation + inline gate. Otherwise B alone. Genuine no-lean acceptable here — Hades has primary insight into daemon-count tradeoff.
Loop 1 — Periodic fleet-wide supply-chain audit (daily)
- Reads fleet repo list from fleet_repositories table (rule #10 — no hardcoded paths)
- Runs OSV-Scanner + Trivy + per-eco audits + syft SBOM diff vs prior run
- Findings → new fleet_supply_chain_findings table + Cerberus digest + Slack on high-severity
- Healthchecks.io meta-monitored (per 2026-05-06 fleet-adopted Healthchecks decision)
Loop 2 — Inline PreToolUse gate (per-session; Option C/D only)
- Modeled on hades-vault-guard.sh pattern
- Intercepts npm install / pip install / uv add / cargo build / poetry add / bundle install / gem install — including bash -c wrappers
- Three policy choices for Hades to pick: block / warn / graduated (block on critical-severity findings only, warn otherwise)
- Bypass attempts logged to Argus table for review
- Major caveat: video confirmed LLM agents will auto-append CLI flags to "fix" install failures — behavioral guardrail at hook-level required; vault-guard's ~0 false-positive rate may not generalize
Loop 3 — OAuth-grant + token-rotation audit (weekly; per 2026-04-24 Vercel breach lesson)
- Covers GH App installs / Google Workspace / npm publish tokens / CF / Slack / Discord
- Flags stale (>90d unused), over-scoped (read:* or *:write when narrower works), unknown (granted but no fleet record)
- Auto-revoke gated by ghapp-{agent}.sh wrapper (rule #24 — operator-PAT-no-agent-writes)
- OSS confirmed gap — Hades builds GraphQL crawler
Full sketch: cerberus-integration.md.
hades-vault-guard.sh — cited as precedent, not in scope| # | Question | Why it matters | Lean |
|---|---|---|---|
| Q1 | Daemon shape — A / B / C / D? | Defines build scope + failure-isolation posture | Sub-agent C lean: B+C hybrid; genuine no-lean acceptable |
| Q2 | Inline-gate policy — block / warn / graduated? | Trades false-positive friction against attack-window minimization | No lean |
| Q3 | MCP-sandbox build vs accept-risk-temporarily? | Confirmed OSS gap; nono-pattern wrapper is ~1-2 week build | Build (this is the #1 attack surface) |
| Q4 | OAuth-audit GraphQL crawler build vs defer? | Confirmed OSS gap; Vercel-breach class is the soft-entry-into-rest-of-fleet vector | Build (after MCP-sandbox) |
| Q5 | Findings-table location — Pantheon Supabase fleet_supply_chain_findings, Argus, or new project? |
SSOT placement; downstream consumers (dashboards / pages / Slack routes) depend on this | Pantheon fleet_* per existing convention |
| Q6 | Per-session vs per-machine cadence on Loop 1? | Mac Mini K20N0S vs MBP run different daemon sets; affects scheduling | Per-machine daily, fleet-aggregate weekly |
| Q7 | Pin all npx -y @vendor MCP entries to exact versions immediately, even before tooling lands? |
Trivial mitigation; one-line fix per repo | YES — operator-facing today's-action, not blocked on anything |
| Q8 | Reinstate Seatbelt sandbox (removed 2026-04-02) as part of this arc, or out-of-scope? | Restoring kernel-layer isolation would re-close the biggest gap left when sandbox was removed | Out-of-scope (separate arc); document in handoff |
Handoff filed: hermes → hades anchored on Hades vault-guard board (Project #6), Related to existing Cerberus issues #78 / #87 / #171 + yesterday's daemon-manager binding-fix handoff (in-flight; assumed-lands-first dependency).
Downstream agents Hades may pull in (Hades's call, not Hermes's):
- Athena — governance ruling on findings-table location (Q5) + revoke-policy ratification (Q4)
- Atlas / Proteus — Supabase schema for fleet_supply_chain_findings (Q5)
- Hephaistos — PR-review rule flagging lockfile-only diffs without package.json diff (sibling video idea worth adopting)
- Metis — Themis bridge for findings-file→table mirror if file-authored
- Mnemosyne — Aion entry capturing the architecture call once Hades rules
gh api repos/{owner}/{name} within sessionresearch/viska-autoresearch-2026-05-25/T6-hardening-hooks-gap.md) NOT duplicated — different domain (Viska trading product, Nous Research hermes-agent framework, not Pantheon-fleet)