diff --git a/scripts/hermes-reachability-check.sh b/scripts/hermes-reachability-check.sh
new file mode 100755
index 0000000..9842ccf
--- /dev/null
+++ b/scripts/hermes-reachability-check.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+# Shared helper for Hermes contract reachability checks
+# Separates SSH exit status from remote command result
+# Pattern: remote side always succeeds, so ssh status = connection status only
+
+hermes_check_host() {
+    local host=$1
+    local pattern=$2
+    local path=$3
+    
+    # Remote side always succeeds (grep ...; true), so ssh exit code = connection status only
+    local out
+    out=$(ssh -o BatchMode=yes -o ConnectTimeout=3 root@"$host" "grep -RIn '$pattern' '$path' 2>/dev/null; true" 2>/dev/null)
+    local status=$?
+    
+    if [ $status -ne 0 ]; then
+        echo "$host: UNREACHABLE (ssh exit $status)"
+    elif [ -n "$out" ]; then
+        echo "$host: VIOLATION: $out"
+    else
+        echo "$host: COMPLIANT (no matches found)"
+    fi
+}