Hermes Knowledge Graph Architecture

1. Architectural Philosophy: Static-First & Git-Versioned

Hermes operates as an autonomous research laboratory deployed statically to the edge. Phase 2A explicitly rejects reliance on runtime graph databases (e.g., Neo4j) or real-time LLM query generation:

External Disclosures / Feeds
            │
            ▼
   AI Intelligence Pipeline
(Extraction, Resolution, Critique)
            │
            ▼
 Canonical JSON Knowledge Graph
 (data/graph/entities & relationships)
            │
            ▼
    Git Commit & Audit Trail
            │
            ▼
 Build-Time Pre-Indexing & Integrity
(Static AST, Reverse Indexes, Stats)
            │
            ▼
    Static Vercel Deployment

Why JSON as the Source of Truth?

Auditable Intelligence: Every entity addition, relationship inference, or confidence modification is captured in Git diffs.
Deterministic Reproducibility: The entire state of Hermes’ intelligence at any given date can be re-compiled from historical commits.
Database Portability: Canonical schemas match property-graph standards, enabling migration to Neo4j or PostgreSQL in future phases without schema restructuring.

2. Interactive Global Graph Architecture

The visualization below demonstrates the live topological relationships linking vulnerabilities, products, agentic attack patterns, MITRE techniques, forensic artifacts, and threat actors:

HERMES KNOWLEDGE GRAPH v2026.09.08.670 • 656 Entities • 670 Links

🔍

API ↗

Outgoing Relationships (0)

Incoming Relationships (0)

 Drag nodes • Scroll to Zoom • Click node to inspect intelligence 

3. Supported Entity Taxonomy

Hermes recognizes 12 primary cybersecurity entity classes:

Entity Type	Description	Canonical ID Pattern	Example
`vulnerability`	Disclosed flaw or weakness	`CVE-YYYY-NNNN`	`CVE-2026-59822`
`product`	Affected software or model framework	`PROD-[NAME]`	`PROD-LITELLM`
`vendor`	Producing entity or organization	`VENDOR-[NAME]`	`VENDOR-BERRIAI`
`agentic_attack_pattern`	Autonomous AI attack vector	`AAP-NNN`	`AAP-003`
`attack_technique`	MITRE ATT&CK technique	`TNNNN`	`T1059`
`forensic_artifact`	Disk, memory, or log footprint	`ART-[NAME]`	`ART-BASH-ENV`
`detection`	Sigma, YARA, or Osquery rule	`DET-[NAME]`	`DET-SIGMA-042`
`exploit`	Proof of concept or weaponized script	`EXP-[NAME]`	`EXP-2026-59822-POC`
`malware`	Malicious payload or toolkit	`MAL-[NAME]`	`MAL-SHADOWAGENT`
`threat_actor`	Adversary group or cluster	`ACTOR-[NAME]`	`ACTOR-VOID-ARACHNE`
`campaign`	Coordinated operational wave	`CAMP-[NAME]`	`CAMP-MCP-RECON-2026`
`source`	Primary or secondary intelligence origin	`SRC-NNN`	`SRC-001`

4. Multi-Hop Intelligence Traversal

The principal advantage of the Knowledge Graph is uncovering multi-hop attack chains that isolated CVE databases fail to correlate.

For example, when evaluating CVE-2026-59822:

[ACTOR-VOID-ARACHNE] ──(uses)──► [EXP-2026-59822-POC]
                                          │
                                     (exploits)
                                          ▼
[PROD-LITELLM] ◄──(affects)─── [CVE-2026-59822] ───(exploits)──► [AAP-003]
                                   │           │                     │
                             (uses)│           │(leaves_artifact)    │(mitigated_by)
                                   ▼           ▼                     ▼
                                [T1552]   [ART-MCP-HEADER]      [DET-SIGMA-042]

Through this chain, security operations centers can instantly pivot from an alert on a suspicious HTTP Bearer header (ART-MCP-HEADER) directly to the threat actor cluster (ACTOR-VOID-ARACHNE), the affected LLM proxy (PROD-LITELLM), and the Sigma detection rule (DET-SIGMA-042).