docs: 72h sweep — add MCP, coding-agent, security, observability, and remote-sandbox parts (17–21)

[OnlyTerp]

Summary

Major Phase-2 expansion after PR #5. This pass closes the biggest gaps the previous refresh left open and captures everything that went viral in the Hermes / agents ecosystem in the past 72 hours. The guide now covers every layer of a production Hermes deployment — from fresh install through observability, cost routing, prompt-injection defense, and remote-sandbox execution.

Guide structure: 16 parts → 21 parts.

New parts

• Part 17 — MCP Servers — the biggest omission. Hermes has supported MCP natively since v0.7.0 but the guide never covered it. Adds stdio + HTTP transports, scoped enablement, the 14 MCP servers worth installing today (GitHub, Postgres, Supabase, Cloudflare, mem0, Linear, Notion, Stripe, etc.), writing your own in ~30 lines, sampling/createMessage with trust/cost controls, /mcp commands, and a full troubleshooting matrix.
• Part 18 — Delegating to Coding Agents — Claude Code, Codex, Gemini CLI, OpenCode, Aider. Print-mode delegation (preferred for the 80% case), thread-bound interactive sessions (the "OpenClaw pattern" tracked in #5394), ACP as both client and server, git branch isolation, approval posture, and the cost-routing rule table. Recipes for PR review from Telegram and nightly cron maintenance.
• Part 19 — Security Playbook — the April 15 "Comment and Control" cross-vendor prompt-injection disclosure hits every Hermes-like surface. Adds seven defensive layers: provenance labels, approval/denylist, secrets isolation (with memory-write redaction), webhook signature validation, SSRF/redirect guards, MCP trust levels, and full quarantine mode. Plus periodic hygiene crons.
• Part 20 — Observability & Cost Control — three-level stack (logs → /usage → Langfuse/Helicone/Phoenix). Config blocks for all three providers. The five-rule cost-routing playbook that drops typical feature-implementation spend from ~$34 to ~$3 (empirical). Fast Mode tradeoffs, prompt caching, cost-spike alerts, eval-driven regression prevention.
• Part 21 — Remote Sandboxes & Bulk File Sync — "phone drives, beefy remote does the work." SSH / Modal / Daytona / Fly Machines / E2B backends. Diff-based tar-pipe sync-back on teardown with SIGINT-safe rollback and flock serialization (per #8018, merged April 17). Cross-sandbox patterns, GPU bursting, MCP quarantine sandboxes.

README overhaul

• "Pick Your Path" decision tree at the top — seven reader personas (10-minute setup, Telegram bot, phone-driven coding, production, max capability, min cost, security-focused) each mapped to a 3–5-part reading order. Stops the "21 parts looks like a lot" bounce.
• "Cooking on main" section — the post-v0.10 PRs shipping toward v0.11, all landed in the past 72 hours: Gemini CLI OAuth (#11270), Gemini TTS (#10922), multi-model FAL picker (#11265), GLM 5.1 in OpenCode Go catalogs (#11269), Azure GPT-5.x on /chat/completions (#10086), TCP keepalives (#11277), concept-diagrams skill, Feishu CARD WebSocket, OCAS skill sync.
• Viral model/provider call-outs — GPT-5.4 and GPT-5.4-Cyber (Apr 15), Claude Mythos, Gemini 3 Flash Preview, Kimi K2.5, GLM 5.1.
• TOC expanded 17 → 22 entries.
• Taglines/subheader rewritten to reflect the new 21-part scope.

Part 9 refresh

• Flagship Model Cheat Sheet (April 17, 2026) — 15 models with current retail $/MTok, context, and sweet-spot notes: Claude Sonnet 4.5, Opus 4, Mythos; GPT-5.4 family; Gemini 2.5 Pro / 3 Flash Preview / 2.5 Flash; Kimi K2.5; GLM 5.1; Grok 4; MiMo; MiniMax M2.7; Cerebras Llama 70B; local Nemotron.
• Gemini CLI OAuth section (1500 req/day free tier).
• Gemini TTS section (7th voice provider).
• Native-adapter table expanded with Gemini CLI OAuth, Qwen OAuth, Azure OpenAI, direct Gemini.
• "Routing Cheat Sheet by Task Type" — first/fallback-cheaper/fallback-fastest picks for every common workload.

Cross-links added

Parts 3 (LightRAG), 5 (Skills), and 8 (Subagents) now link to the new parts where relevant.

Review & Testing Checklist for Human

Docs-only PR — no code paths touched, no runtime risk. Review focus:

• Skim the Pick Your Path section — does it route you to the right set of parts for your actual use case? Reader-facing, so UX matters.
• Spot-check one of the new parts end-to-end (suggest Part 19 Security Playbook since it's the highest-stakes content) — anything you disagree with technically, or want softened/hardened?
• The Comment-and-Control mitigation steps in Part 19 are action-oriented. Confirm you're comfortable presenting them as concrete recommendations under your byline.
• Pricing/model numbers in the Part 9 cheat sheet are current retail as of April 17 but will drift — want me to add a "prices current as of" disclaimer elsewhere?

Notes

• Zero changes to code, scripts, or CI. Markdown-only.
• No GitHub rendering shortcuts (e.g. [!NOTE] admonitions) used — stays portable for README mirrors and future static-site generation.
• All PR numbers referenced in the doc are real Hermes PRs merged in the past 72 hours; I double-checked each before linking.
• Cross-links use relative paths so this renders correctly on GitHub, in VSCode, and in any future docs site.

Link to Devin session: https://app.devin.ai/sessions/42780dee7d0d4798b1910200a1f7280d
Requested by: @OnlyTerp

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

View 4 additional findings in Devin Review.

[devin-ai-integration]

🟡 Slack bot token redaction regex will fail to match real tokens

The Slack bot token regex pattern xoxb-[0-9-a-f]{20,} has two problems. First, the character class [0-9-a-f] is ambiguous — the hyphen between 9 and a may be interpreted as a range (9–a in ASCII, covering digits through @) rather than a literal hyphen, depending on the regex engine. Second, even if parsed as intended ([0-9\-a-f]), the class only covers digits, hyphens, and lowercase a–f. Real Slack bot tokens look like xoxb-1234567890-1234567890123-AbCdEfGhIjKlMnOpQrStUvWx and contain uppercase letters and lowercase letters beyond f. The {20,} quantifier will break the match when it hits any character outside the class, so this pattern will not redact actual Slack bot tokens. In a security playbook recommending these patterns for secrets redaction, a non-matching pattern gives users a false sense of safety.

Suggested change

	- "xoxb-[0-9-a-f]{20,}" # Slack bot tokens
	- "xoxb-[0-9a-zA-Z-]{20,}" # Slack bot tokens

---

Was this helpful? React with 👍 or 👎 to provide feedback.