← Back to the comparison

Independent review · Full response

Herdr

Herdr · Claude Code · General question

2026-10-22a2008661c ↗Public-web access only

Exact prompt

Is there a security risk in installing this tool?
Pinned repository link supplied with the question ↗

The text below is the agent’s complete original response, with its original language identified. The introduction is editorial, not part of the original output or an independently verified conclusion. No installation or attack testing was performed.

Editorial introduction

No malicious behavior seen; ordinary installer/publisher trust and powerful local control. Flags unsigned checksums and optional plugins/SSH.

Reading scope: Installer, update code, local socket and agent integrations; plugins and remote code not audited.

Download the complete original English text · SHA-256 5546d4678e38cead688458ef3b8337fc36d7a36e544de3f4a3f5f0bf10e13913

Complete original response

I don’t see anything malicious or unusually risky in this tool. herdr is a popular open-source Rust project (about 45k stars, Apache-2.0). Installing it is about as risky as any developer tool installed from a vendor’s script, as long as you trust the herdr.dev maintainers. I checked the installer, the update code, the local socket and the agent integrations at that commit. I did not audit the whole codebase, the plugins or the remote/SSH code.

What looks fine

  • Installer (install.sh): It doesn’t use sudo, it installs only to ~/.local/bin/herdr, and it doesn’t edit your shell startup files. It checks the binary against a SHA-256 hash before installing.
  • Network: I found no tracking or data collection. It contacts only herdr.dev/latest.json (or preview.json) to check for updates, and formulae.brew.sh if you installed with Homebrew.
  • Updates: At startup it only checks whether a new version exists. It downloads a new binary only when you run herdr update.
  • Local socket: Agents and the client talk to herdr through files in ~/.config/herdr/. The socket file is set to owner-only permissions (0600), and nothing listens on a network port.

Real but modest risks

  1. No signatures. The installer and herdr update get the download link and its hash from the same file on herdr.dev. If herdr.dev or its release pipeline were compromised, an attacker could supply a bad binary with a matching hash. Homebrew (brew install herdr) gives you an independent check.
  2. Preview builds may skip verification. On the preview update channel the hash is optional, so a preview build can install without any check. Stable builds require one.
  3. The socket is a powerful control channel by design. No password or token is needed beyond the file permissions. Any program running as your user, including the AI agents inside herdr, can create panes, type into them and prompt other agents. That doesn’t cross a security boundary, since those programs already run as you. It does make it easier for one compromised or prompt-injected agent to affect your other sessions.
  4. Agent integrations change other tools’ settings. For example, it adds a SessionStart hook to Claude Code’s settings and adds blocks to the configs of OpenCode, Kimi and others. From what I read, it only adds its own hooks and doesn’t change Claude’s permissions. I couldn’t confirm whether this happens automatically or only when you ask, so check ~/.claude/settings.json after installing.
  5. Plugins and SSH remotes are extra trust you’d be taking on: plugins are third-party code that runs on your machine, and remotes use your SSH access. Both are optional.
  6. Windows: the PowerShell installer and updater turn off PowerShell’s script-signing check (-ExecutionPolicy Bypass). That’s common practice, but worth knowing.

Recommendations: Install with Homebrew, or download install.sh, read it, then run it. Stay on the stable channel. Treat herdr as a tool that can control every agent session you run in it.

Sources:

← Back to the comparison