UFO

Hermes Agent, accurately

Short answer: it is real, it is genuinely different from Claude Code and Codex in one specific way, and the thing most write-ups say makes it different is not that thing. The difference that holds up: it does not live on your laptop. It runs as a gateway process you talk to from Telegram or Discord while the work happens on a VM somewhere, with memory that survives the session and a cron scheduler built in.

The difference that does not hold up is the "self-evolving agent" story. That machinery is in a separate repository, one phase of five is built, and nobody has pushed to it in six weeks. What the shipped agent really does is more modest, more explicable, and on by default — which is the part worth your attention.

Written 2026-07-31 · Checked against the official docs, README and GitHub API that day · v0.19.1, tag v2026.7.30, published 2026-07-30 · This project changes weekly; treat every version-specific line below as perishable

On this page

  1. First, the name
  2. What it is
  3. Installing it
  4. Models, and the default that surprises people
  5. The self-improvement story, corrected
  6. Putting a gate in front of it
  7. Where it runs, and what protects your host
  8. Should you use it

First, the name

Hermes Agent is not Hermes 3 or Hermes 4. Same lab — Nous Research — same brand, no technical relationship. One is a family of open-weight models; the other is the Python agent client this page is about.

That matters because it produces a wrong assumption: that the agent runs on Nous's own models. It doesn't, and it doesn't default to them. As of 2026-07-31 the provider documentation lists roughly three dozen first-class inference providers and no Hermes-branded model appears among them, as an option or a default. If you arrived looking for model weights, you want a different part of nousresearch.com.

What it is

Python, MIT-licensed, at github.com/NousResearch/hermes-agent, tagline "The Agent That Grows With You". One install gives you four shapes:

The gateway is the reason to care. The README's own framing:

It's not tied to your laptop — talk to it from Telegram while it works on a cloud VM.

That places it closer to OpenClaw than to Claude Code: a long-lived process on a host you own, reachable from a messenger, rather than a terminal session that ends when you close the tab. Add cross-session memory and a built-in scheduler and you have the real product category.

On where the work runs, the README says: "Seven terminal backends — local, Docker, SSH, Singularity, Modal, Daytona, and Vercel Sandbox." The security docs agree. The marketing page still says five, omitting Daytona and Vercel Sandbox — so where you read five, you read a stale page.

Installing it

From the quickstart, verbatim:

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
source ~/.bashrc          # or ~/.zshrc
hermes                    # start chatting!

Windows, natively, in PowerShell — no WSL required:

iex (irm https://hermes-agent.nousresearch.com/install.ps1)

It brings its own runtime rather than using yours: uv, Python 3.11 under uv with no sudo, Node.js v22 for browser automation and the WhatsApp bridge, ripgrep, ffmpeg. The docs are explicit — "You do not need to install Python, Node.js, ripgrep, or ffmpeg manually." On Linux you supply git, curl and xz-utils. Everything lands in ~/.hermes/, with the binary symlinked to ~/.local/bin/hermes.

The requirement that stops local-model setups: "Hermes Agent requires a model with at least 64,000 tokens of context." Smaller models "will be rejected at startup" — not degraded, rejected. Ollama's 4,096 default fails outright, so a local setup needs --ctx-size 65536 or -c 65536 first, and the VRAM to mean it.

There is a free path with no API key at all: hermes setup --portal runs a Nous Portal OAuth login and, in the docs' words, "logs you in, sets Nous as your provider, and turns on the Tool Gateway in one command." Qwen, MiniMax and xAI Grok also authenticate by OAuth.

Models, and the default that surprises people

Anthropic, OpenAI, Copilot, Gemini, Vertex, Bedrock, Azure, OpenRouter, DeepSeek, xAI and Hugging Face are first-class, alongside self-hosted Ollama, vLLM, SGLang, llama.cpp, LM Studio and LiteLLM. Configuration is per-provider — Claude is provider: "anthropic", default: "claude-sonnet-4-6".

Two things before you budget. There is no global default model ID; the docs point new users at OpenRouter or Nous Portal, and call Portal "the recommended way to run Hermes Agent". And the "300+ models" figure is a vendor self-report scoped to Portal with no published catalogue behind it — quote it as a claim, not a count.

The self-improvement story, corrected

The shipped agent does not use DSPy or GEPA. Neither appears in pyproject.toml, the README, or the skills documentation. That machinery lives in a separate repository, NousResearch/hermes-agent-self-evolution, created 2026-03-09, and it is an external pipeline aimed at the agent rather than a part of it: it reads a skill, generates an eval set, lets GEPA optimise against execution traces, and then opens a pull request against hermes-agent for a human to review. Its own phase table marks Phase 1 (skill files) implemented and Phases 2 through 5 "🔲 Planned". Its last push was 2026-06-17 — six weeks of silence as of 2026-07-31. Anything describing the agent you install as evolving itself through genetic prompt search is describing a research prototype that runs outside it.

What actually ships is a file writer, and it is more useful to understand. A tool called skill_manage lets the agent create, patch, edit and delete its own skills — the docs call this "the agent's procedural memory". The output is not weights or hidden state. It is SKILL.md files in ~/.hermes/skills/, plain markdown with YAML front matter, readable and editable in any text editor. The documented triggers are sensible ones: a complex task of five or more tool calls, a dead end where it found the working path, a correction from you, a non-trivial workflow it discovered.

The default is the part people miss:

By default the agent writes skills freely — including from the background self-improvement review that runs after a turn.

So the honest version of "it learns" is: a background pass after your turn can write instructions to itself that shape every future session, and out of the box nothing asks you first. That is a real and genuinely differentiating mechanism. It is also a much smaller claim than self-evolution, and it fails in ordinary, inspectable ways — a wrong lesson recorded confidently in a file you can go and read.

Putting a gate in front of it

One setting turns free writes into a review queue:

skills:
  write_approval: true   # false = write freely (default)

Every skill_manage write is then staged rather than committed, surviving restarts under ~/.hermes/pending/skills/. You work the queue:

/skills pending          # list staged writes, one-line gist each
/skills diff <id>        # full unified diff
/skills approve <id>     # apply it (or 'all')
/skills reject <id>      # drop it (or 'all')
/skills approval on      # toggle the gate and persist it
The trap: skills.guard_agent_created looks like the same feature and is not. The docs are unambiguous — it "is a content scanner (dangerous-pattern heuristics), not an approval gate", and the two settings are independent. Turning on the guard while leaving write_approval false gets you pattern matching against known-bad content, not review. If you want to see changes before they take effect, you want write_approval.

Memory has the same switch, memory.write_approval. Config lives in ~/.hermes/config.yaml, secrets in ~/.hermes/.env, and hermes config set routes values to the right file.

Where it runs, and what protects your host

The default terminal backend is local, and the docs' own isolation column for it reads "None — runs on host". Commands the agent decides to run are commands on your machine, as your user.

The defence is therefore not a sandbox but an approval layer, on by default. approvals.mode defaults to smart, which uses "an auxiliary LLM to assess risk" — trivial commands auto-approve for that command only, "genuinely dangerous commands are auto-denied", anything uncertain escalates to you. The prompt times out at 300 seconds and fails closed: "If no response is given within the timeout, the command is denied by default."

Underneath sits a blocklist nothing can switch off — rm -rf /, the fork bomb, mkfs on a mounted root, dd to a raw device, piping an untrusted URL into a shell. The docs call it "the floor below --yolo", tripping "before the approval layer even sees the command", with "no override flag", and note the list is "not exhaustive". Above that floor, --yolo, /yolo or HERMES_YOLO_MODE=1 removes every remaining check for the session.

Counter-intuitive, and worth internalising: the isolated backends — Docker, Singularity, Modal, Daytona, Vercel Sandbox — skip dangerous-command approval entirely, "because the container itself is the security boundary", and your approvals.deny globs go with it. The safe-feeling choice moves you from "asked before each risky command" to "not asked at all, but confined". Docker's confinement is real — all capabilities dropped with narrow re-adds, no-new-privileges, a 256-process limit, opt-in-only env forwarding — but it is a different protection, not a stronger version of the same one.

The docs' candour about their own limits is unusual enough to quote rather than paraphrase. On write guards: "it does not sandbox a hostile or compromised agent" — "The terminal tool runs as the same OS user and can still cat or overwrite denied paths via shell commands." On deny rules: "They are not a sandbox against a deliberately adversarial process", the stated threat model being "an honest-but-wrong agent". Take that at face value for a tool that reads web pages and email on your behalf — it is why an enforcement layer outside the model's judgement is a reasonable thing to want on top.

Gateway pairing, by contrast, is conservative: eight-character codes, one-hour expiry, lockout after five failures, deny by default.

Should you use it

The most useful fact about Hermes Agent on 2026-07-31 is not a feature. It is the pace, and the project publishes it.

The v0.19.1 notes describe the ten days since v0.19.0 as "~2,789 commits · ~4,748 files changed · ~442,000 insertions · ~392,300 deletions", a window its own authors call "dominated by bug-fix and salvage waves". Deletions at nearly ninety per cent of insertions over ten days is not a codebase settling down. The first tag was 2026-03-12; twenty-three releases have followed, roughly weekly.

Read that as a signal, not an insult. It says: adopt it for work you can afford to have wobble, pin a version if you depend on it, and re-read the docs after every update because the setting you configured may have moved. It also says the repository's ~223,000 stars and 26,000-plus open issues measure attention and throughput, not stability.

One open issue bears on the trust model above: #54722, filed 2026-06-29, "Agent can report verified success or factual conclusions after failed or unverified tool evidence" — its author calls it "a design flaw with bug-level failure modes". It is open, labelled P2 and needs-repro, with zero reactions, though in a repo with 26,000-plus open issues reaction counts are a poor severity signal in either direction. One report to watch, not a verdict.

So: worth installing if the gateway shape is what you want — an agent that persists, schedules, and answers from your phone while running somewhere else. Worth avoiding if you need a tool that behaves identically next month. Either way, decide about skills.write_approval on day one, before it has written itself thirty files you never read.

Where we fit, briefly

We build UFO, so weigh this accordingly — and the answer to this page's question is not us. If you want a self-hosted agent you can message from Telegram, install Hermes Agent, or read our OpenClaw setup guide for the closest alternative.

UFO is the layer after that one: a team chat where several AI agents are channel members alongside people, each running on a machine you've paired, with task cards for work that outlives a session and human-only channels the agents can't see. Hermes Agent is a thing you could run on one of those machines.

Sources

Everything here comes from Hermes Agent's own documentation, README, release notes and the GitHub API, read on 2026-07-31 against v0.19.1. Where the project's own pages disagree — the count of terminal backends — this page says so rather than picking one. Claims that appear only in secondary coverage, including the launch date, the "300+ models" figure as a verified number, and any funding reporting, are deliberately absent.

Not affiliated with Nous Research. If something here is wrong or has gone stale, tell us and we'll fix it.