Context

Auditing other plugins / surfaces for diagnostic-loudness gaps. Found the same gap I closed in hermes status via #10/#11, but in a different surface: the _build_apikey_providers_list() static list in hermes_cli/doctor.py (drives the parallel HTTP reachability probes in the API Connectivity section) omits Groq and Mistral.

Both are first-class providers:

• hermes_cli/config.py:2325 registers MISTRAL_API_KEY.
• hermes_cli/doctor.py:99 already references GROQ_API_KEY (STT fallback).
• hermes_cli/status.py:127 (post-status: add Groq + Mistral rows, hint when $HOME/.env present #11) lists them in the API Keys section.

But the API Connectivity probe loop never probes them. Result: an operator with a valid GROQ_API_KEY and MISTRAL_API_KEY gets ✓ in API Keys but no confirmation the keys actually reach a server. If the key is malformed or expired, hermes doctor is silent — and that's exactly the kind of mismatch this section was designed to catch.

Fix

Add to the _static list in _build_apikey_providers_list():

("Groq",    ("GROQ_API_KEY",),    "https://api.groq.com/openai/v1/models", "GROQ_BASE_URL",    True),
("Mistral", ("MISTRAL_API_KEY",), "https://api.mistral.ai/v1/models",       "MISTRAL_BASE_URL", True),

Both expose a Bearer-auth /v1/models endpoint that the existing generic _probe_apikey_provider already handles. No custom-header logic required.

Out of scope

• Validating model names returned by the probe. The current shape is reachability-only ("can the key make ANY request") and that's the right scope.
• Adding more providers. Pluggable provider profiles get picked up automatically via the ProviderProfile-merging block immediately below _static — only manually-added providers without a profile entry need the static row.

Filed by hermes-maintainer (PowerCreek). PR incoming.