What Is Hermes AI Agent? Inside Nous Research's Open-Source Agent Harness

Hermes AI Agent is Nous Research's open-source personal agent, MIT-licensed and marketed on a single line: the agent that grows with you. The traction behind that line is not modest. The GitHub repository carries roughly 250,000 stars and 53,000 forks across more than 27,000 commits, and NVIDIA has published a partner post on running it against local models on DGX Spark hardware.

A dozen pages already explain what it does. They restate the same six feature panels, and the ones that go further usually end by recommending a different product. None open the harness, that's where I want to focus.

We build agent systems for clients at Width.ai, which means gateways, memory strategies, tool routers, sandboxed execution, schedulers and subagent delegation are the things we spend our weeks inside. Two of those builds are public: a sales search framework over HubSpot, Gmail and Google Docs and a tax-law system over 30,000 pages of IRS code and internal memos. So the read below is architectural: what each part of Hermes is at the file and process level, which choices are good, which are thin, and when a business should run it rather than build.

Key Takeaways

• What it is. An open-source, self-hosted, MIT-licensed personal agent from Nous Research. It is a harness, not a model: it runs on Nous Portal, OpenRouter, OpenAI or a local endpoint, and you switch with one command.
• The harness is the product. One gateway process serving 20+ messaging platforms, bounded memory, self-written skills on an open standard, native cron, isolated subagents, and seven terminal backends.
• What the learning loop really is. The agent curates two small markdown files, and after repeated tasks it drafts a reusable skill. Real, useful, and smaller than the tagline suggests.
• Against OpenClaw. Broader gateway, native scheduling, more sandbox choice and an open skills standard. Nous ships a migration command that imports OpenClaw memories, skills and settings directly.
• What it costs. The software is free. Your bill is model tokens plus a server plus the hours you spend maintaining it, and the last one is the one people underestimate.
• When to build instead. Hermes is excellent for personal and internal work. Customer-facing agents need an automatic review gate on every answer, a confidence score to route on, citations, and a decision-level audit trail, and those are the four you add yourself.

What Is Hermes AI Agent?

Put plainly: Hermes is an agentic harness, not a single model. It supplies everything around a language model that turns a chat interface into something that runs on its own, and stays neutral about which model sits under it.

Hermes vs Hermes Agent: Not the Same Thing

This trips people up often enough that Google surfaces it as a People Also Ask question, and the confusion is reasonable because Nous uses the name twice. Hermes is their open-weight model family, trained alongside Nomos and Psyche. Hermes Agent is the software in this article. The agent can run on a Hermes model, and it can just as easily run on a frontier model from another lab or a local endpoint on your own GPU. The two names share a lab and nothing else architecturally.

Nous Research is the lab behind the software. Installation is a desktop app for macOS 12+ and Windows 10/11, a one-line terminal install on Linux, macOS and WSL2, a PowerShell one-liner for native Windows, and a documented path for Android through Termux. There is also a hosted option through Nous Portal for people who would rather not run a server. The license is MIT, which matters more than usual here: an agent with terminal access on your own hardware is a thing you want to read the source of.

Inside the Harness: An Architecture Walkthrough

Eight parts do the work, and none of them is specifically a model. Hermes supplies the scaffolding; the intelligence is rented from whichever provider you point it at.

1. The Gateway

One background process holds connections to more than twenty messaging platforms at once. Telegram, Discord, Slack, WhatsApp, Signal, Matrix, Microsoft Teams, Google Chat, email, SMS, Home Assistant and a long tail of China-market apps all reach the same agent with the same memory behind it.

A chat on a messaging platform is one continuous session that survives restarts and reboots, so the next morning's message picks up where you left off. The docs are honest about the cost: a session that never ends grows expensive, and the memory machinery barely fires because nothing is ever forgotten enough to need recalling.

Our read: the gateway is the strongest thing in the harness. Building a multi-platform gateway for a client is weeks of work that nobody enjoys, and this one is free and better than most in-house versions.

2. Session and Model

Nous Portal, OpenRouter, OpenAI or any local endpoint, switched with a single command and no code change. A harness that assumes one provider ages badly, and this one is designed so the expensive part stays replaceable.

3. Tools

‍

The tool registry covers web search and extraction, terminal execution, file editing, browser automation with vision, image generation, speech, and integrations including Home Assistant. The published tool counts disagree with each other, the docs saying 60+ and the README 40+, so the categories are the more durable description.

Any MCP server plugs in as another toolset. This is the integration path that actually matters for business use, and it is not theoretical: our sales framework calls the official HubSpot MCP server over JSON-RPC in production, so the same mechanism that lets Hermes read your smart home will let it read your CRM.

4. The Sandbox

Seven terminal backends: local, docker, ssh, singularity, modal, daytona and vercel_sandbox. Choosing among them is the single most consequential decision you make during setup, because it decides what the agent can destroy.

The container backends are hardened by default: every Linux capability dropped, no privilege escalation, a 256-process limit, namespace isolation, and a read-only root filesystem on Docker. The two that are not containers, local and SSH, get none of that. The docs still recommend SSH, on the different grounds that the agent then cannot modify its own code, which is sharper advice than most agent projects give.

The default is local, meaning the agent runs commands on your machine as you. That is correct for a developer poking at it on a laptop and wrong for anything you leave running, and it is the one setting we would change before connecting a messaging platform.

5. Memory

Two markdown files, and both are small on purpose. MEMORY.md holds the agent's own notes about your environment and conventions, capped at 2,200 characters. USER.md holds a profile of you, capped at 1,375. Together that is roughly 1,300 tokens, injected into the system prompt as a frozen snapshot at the start of each session.

Two design details are worth calling out because they are unusually well judged. When a write would exceed the cap, the tool returns an error rather than silently dropping the oldest entry, and the agent has to consolidate in the same turn before retrying. And memory entries get scanned for prompt injection and credential exfiltration patterns before they are accepted, which is the correct paranoia for text that goes into a system prompt.

There is more to the memory story than the two files, and anyone writing this section from the landing page misses it: the agent can also full-text search every past session it has ever had, and Nous ships seven optional external memory providers that add knowledge graphs and semantic search alongside the built-in files.

My read: the bounded files are right for what they are. A personal agent should have a small, curated, human-readable memory that you can open in an editor. It is the wrong shape when the thing to remember is a corpus rather than a person, which is the contrast our tax-law build makes concrete. That system carries 30,000-plus pages with effective dates and version relationships as first-class metadata, so the question "which version is current" is answered by a lookup rather than a hope. No number of markdown files gets you there.

6. Skills

After you have walked the agent through the same multi-step task a few times, /learn turns it into a SKILL.md file, and the skill refines itself as it gets used. These follow the open agentskills.io standard, which means a skill is a portable document rather than a proprietary blob, and it moves between tools and between people.

This is procedural memory as a file you can read, edit and delete, which is a better idea than most memory features shipping in agent products right now.

7. Cron

Scheduling is built in and described in plain language, with delivery to any connected platform. Ask for a daily briefing at seven and a weekly backup audit on Sundays, and both run unattended through the gateway.

One behaviour to know before trusting it unattended: a job that does not pin its own model runs on whatever your main model is set to when it fires, so changing the default quietly moves your whole scheduled fleet. Pin the model on any job whose output you will not read. Hermes does fail closed on other configuration problems, refusing to run and alerting once when an API key will not resolve or a delivery target is unknown.

8. Subagents

The delegate_task tool spawns isolated subagents with their own context and their own terminal, so a long piece of grunt work does not fill the parent's context window.

What a child inherits is halfway, and worth being precise about. It gets the parent's tool access, provider configuration and credentials, but not the conversation, so the parent must state the entire goal on every call and a vague delegation produces a child confidently solving the wrong problem. Hermes ships controls around this: an orchestrator role, nested-delegation depth limits and iteration caps. Our sales framework goes further for a narrower job: a plan builder decomposes the question into typed steps with declared tools and dependencies, a dependency-aware executor runs the independent ones in parallel, and each step is a bounded loop with its own allow-listed toolset. Same family of idea, specialised to one domain and expressed in code that can be tested.

What the "Learning Loop" Actually Is

The tagline is that the agent grows with you. Here is the mechanism, stated plainly, because this is the part every explainer gestures at and none of them opens.

• You run a task. The agent does the work and, along the way, writes facts it judges durable into its two memory files.
• You run similar multi-step tasks a few times. The agent notices the repetition.

A skill gets drafted. Either you ask with /learn or a background review does it after a turn, and the procedure becomes a file.

• The skill improves as it is used, edited by the agent when reality disagrees with what it wrote down.

That is the whole loop. It is real, more than most agent products ship, and smaller than the marketing implies in two ways.

The first is scale. The memory travelling into every prompt is about 3,500 characters, or eight to fifteen entries plus a short profile of you. That is a sticky note, not a database. The agent can also search its own past conversations for anything older, which closes part of the gap, but what it carries by default is deliberately tiny.

The second is what "learning" means. Nothing is trained. No weights move, and switching providers tomorrow carries all of it across unchanged, because it was only ever text on disk. A skill is a procedure the agent wrote for itself in markdown.

Neither point is a criticism. For a personal agent, curated notes and written procedures are right: you can read them, fix them, and delete the one that is wrong. It is the wrong design the moment what needs remembering is ten thousand customers or a corpus with versions, and knowing which you have is most of the value of understanding the mechanism.

Hermes Agent vs OpenClaw

This is the comparison people actually search for, and most of the published versions are written by someone selling a third thing. A neutral read, layer by layer:

‍

The last row is the most telling thing in the table. Nous ships hermes claw migrate, which imports an OpenClaw installation's persona file, memories, user-created skills, command allowlist, messaging configuration and allowlisted API keys, with a dry-run flag. The setup wizard detects an existing OpenClaw directory and offers to do it unprompted. You do not build that unless you have decided exactly who your user is.

The honest summary: Hermes is the more capable harness, OpenClaw the shorter runway. Want a large library of things that already work, and OpenClaw gets you there faster. Want a system whose memory, skills and execution environment you can reason about and move elsewhere, and Hermes is built for it. If you do not want to host anything at all, neither is right, because both assume you keep a process alive somewhere.

What Hermes Agent Really Costs

The software is free under the MIT license. That is the beginning of the cost conversation, not the end of it.

If you would rather not assemble five API keys, Nous Portal bundles a model plus hosted web search, image generation, speech and a cloud browser under one subscription. Free covers free models only; Plus is $20 a month for $22 in credits, Super $100 for $110, Ultra $200 for $220, each with a rollover cap.

Self-hosting is where the real number lives, and it is three line items rather than one:

• Model tokens. Driven by how chatty the agent is and how often its background review runs. Hermes can point that review at a cheaper model, which is a real lever on a busy install.
• A server. A small VPS is enough to start. The serverless backends hibernate when idle, which is the better option if the agent works in bursts.
• Your hours. The line item people zero out and should not. This is software you maintain.

There is a zero-API-spend path: point Hermes at a local endpoint and run the model on your own hardware. NVIDIA's partner post covers doing exactly that on DGX Spark and RTX machines, which is also the answer for teams whose data cannot leave the building. If that constraint is yours, our guide to self-hosted AI chatbots covers the same tradeoff in more depth.

How Safe Is Hermes Agent?

Start with what it is: an autonomous agent with file access, terminal access, API credentials and a standing invitation to act while nobody is watching. That is real trust, however well built the software is.

Hermes ships more safety machinery than it usually gets credit for. Command approval and DM pairing gate what runs and who can talk to it. Container backends are hardened by default, memory entries are scanned for injection and exfiltration patterns before storage, secrets are redacted from captured output, and both memory and skill writes can sit behind an approval queue.

The community has flagged rough edges, and a safety-minded reader will find them anyway: Hacker News threads have covered a sluggish startup, a flickery terminal interface, verbose model behavior, a privilege-escalation report and a set of plagiarism allegations. We point at those discussions rather than adjudicating them, which is the right posture for anyone who has not investigated themselves.

The configuration we would insist on before an agent like this runs unattended:

• Pick the sandbox first. Before any messaging platform, before the first cron job. SSH or a container, not local, for anything long-running.
• Allow-list tools per surface. The toolset your CLI gets and the one a Telegram bot gets should not match.
• Gate the writes. Turn on approval for memory and skills if the agent talks to anyone but you. An agent editing its own instructions unreviewed is a slow-moving incident.
• Keep a human on the irreversible. Anything that sends, pays, deletes or publishes gets a person, however good the agent gets.

Two further controls belong in front of anything customer-facing, and neither ships with Hermes. A deterministic deny-list in front of the agent, so the dangerous actions are impossible rather than discouraged. And confidence gating, where a fast classifier scores the decision and routes the uncertain ones to a human, which we covered in detail in our piece on what Jev AI is and where System One models fit.

What Production Looks Like: Two Builds

Two of our real Hermes builds.

A Sales Search Framework Over HubSpot, Gmail and Google Docs

One natural-language interface over three systems, delivered in Slack. The full build is written up here, and the pipeline runs in six stages: a session opens, a plan builder decomposes the question into typed steps with declared tools and dependencies, an executor runs the independent steps in parallel, results aggregate, a review agent judges the answer for completeness and consistency and can send it back for up to two more rounds, and a response agent returns the answer with its sources and a confidence score between zero and one.

Nine tools sit underneath: seven HubSpot operations through the official MCP server, plus Gmail and Google Docs. Every session, plan step, tool call and token count is logged.

Map that onto the harness. Slack is the gateway. The MCP server is the tool layer, running the same protocol Hermes uses. The typed agents are delegation. What is added on top is the part that matters commercially: a review step that runs on every answer rather than when somebody asks for it, a number saying how much to trust the result, and a per-decision record built for someone else to inspect.

A Tax-Law System Over 30,000 Pages of IRS Code

A tax firm came to us after a vendor proof of concept failed four ways: wrong answers, no way to tell current rules from superseded ones, nothing returned when a question did not share vocabulary with the source, and a web search tool that never actually fired. The replacement prepares documents page by page with descriptive names carrying code sections, entities, topics, effective dates and version relationships, so currency is decided by metadata rather than by hoping the newest document ranks highest.

An engine decides what to search, reviews a ranked shortlist, reads a handful of pages and refines. Answers cite the page they came from. Web search fires because tool selection is validated inside the loop rather than trusted to the model, which is precisely the failure the previous vendor shipped. Preparation costs about what a coffee does and questions cost pennies.

This is what memory means when the thing to remember is a corpus rather than a person. It is also the clearest illustration of why Hermes's two small files are the right call for a personal agent and the wrong one for a firm: the failure mode a person shrugs at is the failure mode a client sues over.

Hermes ships the harness. Production adds the gate, the score, the citation and the record.

Run It, Build On It, or Build Custom

Three honest rows. Most readers are in the first.

Run Hermes As It Ships

Personal agents, homelab automation, solo-founder operations, internal briefings and inbox triage. Work where you are the only person who sees the output and a mistake costs an afternoon. Hermes is excellent at this, it is free, and nothing we built for you would be better. Go to the docs and the Discord, pick a sandbox backend before you connect anything, and enjoy it.

Build On Its Layers

The gateway and the sandbox are the reusable parts, and both represent real engineering you would otherwise pay for. Teams with an internal use case and their own developers can wrap those layers with their own review logic and routing, and get most of the value for a fraction of a from-scratch build. The MIT license means this is a supported idea rather than a gray area.

Build Custom

Anything a customer sees. Anything touching regulated data. Anything needing an automatic review gate, confidence-based routing, citations or a decision-level audit trail, which is to say anything where somebody will eventually ask why the agent did what it did and "it seemed right at the time" is not an acceptable answer. That is the row the two builds above live in, and it is the row we work in: custom agent and chatbot development, with prompt engineering and NLP consulting where the work is narrower. If the agent is going near patients or claims, our write-up on agentic AI in healthcare covers what changes when the data is regulated.

‍

Not Sure Which Row You Are In?

Tell us what you want the agent to touch and who sees the output. We will tell you whether Hermes as it ships, Hermes with guardrails around it, or a custom build is the right shape, and we will say so even when the answer is that you do not need us.

‍

Getting Started With Hermes Agent

The install takes about two minutes. The setup decisions deserve more attention, in this order:

• Install. The desktop app on macOS 12+ or Windows 10/11, the one-line terminal install on Linux, macOS and WSL2, or the PowerShell one-liner on native Windows. Android runs through Termux with a documented path.
• Connect a model. Nous Portal in one OAuth step if you want the bundled tools, or bring your own OpenRouter, OpenAI or local endpoint.
• Pick the sandbox before anything else. People make this decision last and should make it first. Local is the default and the wrong choice for anything left running.
• Connect one channel. One platform, not five. Learn how it behaves while it is easy to watch.
• Set one cron job. A daily briefing, because a wrong answer there is obvious and harmless.

Then read the memory files. cat ~/.hermes/memories/MEMORY.md after a week of real use tells you more about whether this fits your work than any review will, including this one. What the agent chose to keep is the clearest signal of whether it understood the job.

Frequently Asked Questions

What is Hermes AI Agent?

An open-source, self-hosted AI agent from Nous Research, released under the MIT license. It runs as a background process that connects to messaging platforms, keeps memory and self-written skills across sessions, runs commands in a sandbox and executes scheduled tasks unattended, on whichever model you point it at.

What is the difference between Hermes and Hermes Agent?

Hermes is Nous Research's open-weight model family, alongside their Nomos and Psyche models. Hermes Agent is the agent software, and it runs on any model you choose, including models from other labs and local endpoints. Same lab, different products. The agent is a harness; the model is the intelligence you rent for it.

What can Hermes Agent do for me?

Reach it from Telegram or Slack, ask it to research something, have it run scheduled briefings and backups, let it execute code and browse the web inside a sandbox, and let it accumulate notes and reusable procedures about how you work. The realistic framing is a capable personal operator for your own work rather than a system you put in front of customers.

How safe is Hermes Agent?

As safe as you configure it, and the defaults favor convenience. It ships command approval, DM pairing, hardened containers, injection scanning on memory, and optional approval queues for memory and skill writes. The default terminal backend is your local machine, which is the setting to change first. Keep a human on anything irreversible.

Is Hermes Agent free?

The software is free and MIT-licensed, so you can read it, fork it and use it commercially. Running it is not free: you pay for model tokens, hosting, and your own maintenance time. Nous Portal starts at $20 a month if you want models and tools bundled, and a local model removes the token bill entirely.

Hermes Agent vs OpenClaw: which should I use?

OpenClaw for a faster start on a large library of prebuilt capability. Hermes for a broader messaging gateway, native scheduling, more sandbox choice and portable skills on an open standard. Hermes ships a migration command that imports an OpenClaw installation directly, so trying it is cheap and the switch is not a rewrite.

Can I use Hermes Agent for customer support?

Not as it ships, and we would tell you the same if you were paying us. Support needs a review gate firing on every answer, confidence-based escalation, citations to a source of truth and a per-decision audit trail. Hermes has a manual review command and logs its sessions, which is not the same as any of those. Its memory is also the wrong shape, because two small files cannot hold thousands of customers. Our piece on agentic AI in customer service covers what that architecture actually requires.

‍