# NousResearch/hermes-agent · Bounding unbounded HTTP response body reads

## Open now

- 6 issues, 5 PRs open on GitHub.
- #54735: Bound provider model catalog response reads
- #54786: Anthropic provider model fetch reads response bodies without a cap
- #54838: Bound live model catalog response reads
- #54949: Account usage helpers parse provider JSON responses without a body cap
- #55211: Account usage fetches read unbounded JSON response bodies
- #68739: \[Bug\]: Ollama metadata probes buffer unbounded JSON responses
- PR #54737: fix(cli): bound generic model catalog response reads
- PR #54787: fix(anthropic): bound model list response reads
- PR #54840: Bound model catalog response reads
- PR #54952: Bound account usage JSON response reads
- PR #68740: fix(ollama): bound metadata probe responses

These issues and pull requests address multiple places across providers, CLI, and integrations where JSON response bodies were read without a size cap. The work spans model catalog fetches, metadata probes, account usage helpers, and third-party integrations such as Ollama, Anthropic, and Mem0.

## TL;DR

- 19 member(s): 6 open issue(s), 2 closed issue(s), 5 open PR(s), 0 merged PR(s), 6 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.09`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #54735: Bound provider model catalog response reads
- #54786: Anthropic provider model fetch reads response bodies without a cap
- #54838: Bound live model catalog response reads
- #54949: Account usage helpers parse provider JSON responses without a body cap
- #55211: Account usage fetches read unbounded JSON response bodies
- #68739: \[Bug\]: Ollama metadata probes buffer unbounded JSON responses

## Closed / duplicate issues

- #54826: Mem0 setup reads Ollama tags responses without a cap
- #56494: Provider live model catalog fetch buffers unbounded response bodies

## Prior & competing PRs

- **#54765: fix(providers): bound model-catalog response reads (#54735)**. closed without merge · fix tier `suggested`
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#42930`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#56495: fix(providers): bound live model catalog reads**. closed without merge · fix tier `suggested`
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `#54737`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#54737: fix(cli): bound generic model catalog response reads**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `hermes_cli/models.py`, `hermes_cli/urllib_security.py`, `tests/hermes_cli/test_custom_provider_extra_headers.py`, `tests/hermes_cli/test_model_validation.py`, `tests/hermes_cli/test_model_validation_response_size.py`, `tests/hermes_cli/test_urllib_security.py`
- **#54787: fix(anthropic): bound model list response reads**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `plugins/model-providers/anthropic/__init__.py`, `tests/plugins/model_providers/test_anthropic_profile.py`
- **#54827: fix(mem0): bound Ollama tags response**. closed without merge
  - maintainer direction: category `uncategorized`; implication `needs_llm`
- **#54840: Bound model catalog response reads**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `6e75ba7fa`
  - files: `hermes_cli/models.py`, `tests/hermes_cli/test_api_key_providers.py`, `tests/hermes_cli/test_model_validation.py`, `tests/hermes_cli/test_models.py`
- **#54952: Bound account usage JSON response reads**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `agent/account_usage.py`, `agent/bounded_response.py`, `tests/agent/test_account_usage.py`, `tests/agent/test_account_usage_fetch.py`, `tests/agent/test_bounded_response.py`
- **#55213: fix(account-usage): stream bounded usage responses**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `44dab4ad4e`, `#54952`, `#54952`, `#54952`
- **#68740: fix(ollama): bound metadata probe responses**. open
  - maintainer direction: category `partial_fix`; implication `needs_llm`; refs `193ea756d8f1`, `#68739`, `#68740`, `#69438`, `#68740`, `#69438`, `#69438`, `#68740`, `#69438`, `#68740`, `#69438`, `#68740`, `#69438`, `#68740`, `#69438`, `#68740`, `#374151`, `#68739`, `#68740`, `#69438`
  - files: `agent/model_metadata.py`, `tests/agent/test_model_metadata_local_ctx.py`, `tests/agent/test_model_metadata_response_cap.py`
- **#69438: fix: bound Ollama metadata response size to prevent unbounded buffering (#68739)**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`
- **#124438: fix(account-usage): cap usage response body to bound memory from hostile endpoints (#54949)**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `5f48df20d3`

## Fix status

- No merged fix on record.
- Subsystem: `agent`