MuninnDB Integration for Hermes Agent

ReviewAudited by ClawScan on May 14, 2026.

Overview

This appears to be a coherent local MuninnDB memory integration, but users should review its API key use and any periodic memory snapshot workflow before enabling it.

Install or use this only if you intend Hermes to connect to a local MuninnDB memory system. Before enabling it, verify the localhost MuninnDB/MCP services, protect the bearer key, inspect any cron snapshot script or related auto-memory skill, and decide what information Hermes is allowed to remember.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone with access to the configured key may be able to use the local MuninnDB MCP tools available to Hermes.

Why it was flagged

The integration expects Hermes to authenticate to the local MuninnDB MCP server with a bearer key. This is purpose-aligned, but the key should be treated as a credential.

Skill content
Authorization: "Bearer <api-key>"
Recommendation

Use a least-privileged/local-only key if available, keep the config private, and rotate the key if it is exposed.

What this means

Information saved into MuninnDB may persist beyond the current conversation and could influence later Hermes behavior.

Why it was flagged

The skill is designed to persist and recall memory, including periodic snapshots. That is central to the purpose, but persistent memory can retain sensitive or incorrect context across sessions.

Skill content
This skill integrates MuninnDB as cognitive memory system. ... Periodischer Memory-Snapshot (alle 30 Min)
Recommendation

Review what data is remembered, configure retention or cleanup where possible, and avoid storing secrets or untrusted instructions as reusable memory.

What this means

A scheduled snapshot job could keep running outside the immediate setup task and continue writing memory snapshots.

Why it was flagged

The artifact documents a scheduled background memory snapshot process. It is disclosed and purpose-aligned, but the referenced script/workflow is not included here, so users should verify what it does.

Skill content
Cron-Job ... Periodischer Memory-Snapshot (alle 30 Min) via `~/.hermes/scripts/muninndb-memory-snapshot.sh`. `no_agent=true`, silent on success.
Recommendation

Only enable the cron job intentionally, inspect the referenced script or related skill first, and make sure you know how to pause or remove it.

What this means

Manual setup may fail or behave differently than expected if local dependencies such as the MuninnDB CLI are missing.

Why it was flagged

The package includes helper scripts even though no install mechanism or required binaries are declared. The scripts are short and local, but setup expectations are not fully captured in metadata.

Skill content
No install spec — this is an instruction-only skill. ... Code file presence: 2 code file(s): scripts/activate.sh, scripts/setup.sh
Recommendation

Review the helper scripts before running them and confirm required local tools and services are installed.