Developers and help

Run the tests

Run Hermit's Swift tests on a Mac, the 29 security tests on their own, and two live checks.

You don’t have to take our word for what the docs say. The tests run the app’s real code, and you can run them yourself.

There are two ways in. The Python scripts need no Xcode and take a few minutes; they’re on Check it yourself. This page is the Swift tests, which need a Mac with Xcode 26.

The quick run

scripts/core-tests.sh copies HermitCore, HermitWallet and HermitCloud with their tests into a scratch package and runs swift test there. It skips MLX and SwiftUI, so it’s done in a few minutes.

Get the code.

git clone https://github.com/Hermit-Ai-Labs/hermit-app && cd hermit-app

Run the tests.
Terminal window
```
bash scripts/core-tests.sh
```

Read the last line. Ours, on 2026-11-11:

Executed 182 tests, with 13 tests skipped and 0 failures

The 13 skipped tests need the network or a Secure Enclave. They skip on purpose unless you ask for them (see below). Your counts can grow as we add tests. What matters is 0 failures.

Just the security tests

This runs the 29 tests behind the prompt-injection demo and the spending policy:

bash scripts/core-tests.sh --filter 'ToolLoopTests|testSpendPolicy|testNeutralize'

It should end in 0 failures. The one to read first is testPromptInjectionInToolResultCannotPrepareSend in Packages/HermitKit/Tests/HermitCoreTests/ToolLoopTests.swift. A tool result tells the model to send 5000 USDC to an attacker, the scripted model obeys, and the guard refuses because you never typed that address. Prompt injection walks through it step by step.

The model in these tests is scripted on purpose. It does whatever the attacker says, which is the worst a real model could do. So the tests show the guard and the spending policy hold whatever the model writes.

--filter takes any regular expression over Class/testName, so you can run one test the same way.

The live checks

Two tests call real services from the app’s own Swift code. Both are read-only and need no keys.

ONECLICK_LIVE=1 bash scripts/core-tests.sh --filter NearIntentsTests/testLiveDryQuote
HERMIT_LIVE=1 bash scripts/core-tests.sh --filter HermitCloudTests/testLiveAttestation

The first gets a dry NEAR Intents quote for 10 USDC on Base to NEAR and checks that 1Click signed it and that it has no deposit address. The second fetches NEAR AI Cloud’s attestation with a fresh nonce and runs every check the app runs before Private Cloud sends a message.

HERMIT_LIVE=1 also turns on the other live reads, like balances over RPC. HERMIT_LIVE_DAPP=1 loads real web apps and checks that their wallet list shows Hermit.

Everything, snapshots included

cd Packages/HermitKit && swift test

This builds MLX and the UI too, so it’s slower. It also renders the SwiftUI screens to PNG. Set SNAPSHOT_DIR to keep them, the way our CI does:

SNAPSHOT_DIR="$PWD/snapshots" swift test

No Mac?

Read the tests on GitHub, and the saved log from an earlier run, docs/logs/core-tests-2026-11-08.txt. That one is from an older tree with fewer tests and ends Executed 105 tests, with 8 tests skipped and 0 failures. Then run the Python steps on Check it yourself. They don’t need Xcode.