Hermes Agent

The agent acts directly in the systems it can reach. It runs shell commands, edits files and executes Python scripts that call Hermes tools over a sandboxed RPC bridge, and it connects to any MCP server over stdio or HTTP with tool filtering for each server. Bundled skills work with GitHub through the gh CLI and with Gmail, Calendar, Drive, Docs and Sheets through Google Workspace OAuth, and webhook runs can post their result as a GitHub pull request comment. About 85 tools sit in the registry, toolsets switch on or off for each platform, and plugins add new tools.

Sourcehermes-agent.nousresearch.com/docs/reference/tools-referenceread 2026-11-07

The delegate_task tool spawns child agents, each with a fresh context, its own terminal and the parent's toolsets, up to 10 at a time by default with no hard ceiling. Orchestrator children can spawn workers of their own when spawn depth is raised, results can return per task or per group against an optional output schema, and the parent can list, steer or stop children while they run. For longer projects, a Kanban board in SQLite assigns tasks to named profiles with parent and child dependencies, and a dispatcher promotes ready tasks and starts the assigned profile every 60 seconds.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/delegationread 2026-11-07

Context is gathered for each session. Hermes loads one project file such as AGENTS.md, CLAUDE.md or .cursorrules into the prompt, picks up files in subdirectories as its tools reach them, takes files, folders, git diffs and URLs through @ references, and turns PDFs, Office files and notebooks into text. The /learn command can turn a directory or a URL into a knowledge base skill with a reference file for each topic, which the agent opens when a task needs it. Hermes keeps no index or embedding store over a codebase or a document collection.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/context-filesread 2026-11-07

Dangerous shell commands, such as recursive deletes, disk formatting, SQL drops and piping a download into a shell, pass through an approval gate. Manual mode asks every time, the default smart mode lets an auxiliary model approve low risk commands and deny dangerous ones, and an unanswered prompt is denied after 300 seconds.

Scheduled and unattended runs deny by default, a hard blocklist refuses the most destructive commands even with approvals switched off, and desktop clicks and typing use the same gate. Memory and skill writes can be held for review, and editors and the API server receive the same approval requests.

Sourcehermes-agent.nousresearch.com/docs/user-guide/securityread 2026-11-07

Access is set for each deployment.

Messaging users are refused until they appear on a platform or global allowlist or pair with a one time eight character code, API server and A2A callers need bearer keys for each profile or each peer, and an administrator can pin configuration keys and shared values for every user on a machine in a system directory.

Secrets are stripped from child processes and redacted from tool errors, and private and cloud metadata addresses are blocked. There is no SSO, role based access or audit log for an organization, and no SOC 2, ISO 27001 or other attestation is named.

Sourcehermes-agent.nousresearch.com/docs/user-guide/securityread 2026-11-07

Every session in the CLI and on messaging platforms is stored in SQLite with the role, content, tool calls and tool results of each message, plus the model, token counts and timestamps. Sessions can be searched, resumed or exported as JSONL, Markdown, HTML or a trace file, with credentials redacted on request.

Approval history sits in the same database, every A2A exchange is written to an audit file, and the API server streams run events. Observer hooks expose model calls, tool calls, approvals and subagent activity to plugins, with an official Langfuse plugin and a NeMo Relay integration that can export OpenTelemetry traces.

Sourcehermes-agent.nousresearch.com/docs/user-guide/sessionsread 2026-11-07

Hermes keeps two memory files for each profile, MEMORY.md for its own notes on the environment and past work and USER.md for what it learns about the user, capped at 2,200 and 1,375 characters.

The agent adds, patches and removes entries itself, and the files stay on disk across sessions and load into each new one, with an optional review step that holds writes until the user approves them. Entries can be listed, edited or deleted from the CLI.

Every past conversation sits in SQLite with full text search the agent can query, and plugins such as Honcho, Mem0, RetainDB and ByteRover add external memory beside the files.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/memoryread 2026-11-07

Hermes runs wherever the user installs it, on macOS, Linux, Windows, WSL2 or Android through Termux, with code and data on that machine. Terminal work can run locally or in Docker, SSH, Modal, Daytona, Vercel Sandbox or Singularity backends, and Docker containers drop all capabilities, block privilege escalation and cap processes, memory and disk. Local models through Ollama, LM Studio, vLLM or llama.cpp keep inference on the user's own hardware. Paid Nous Portal plans add one always on Hermes Cloud agent with 4 to 8 GB of memory, with no hosting region named.

Sourcegithub.com/nousresearch/hermes-agentread 2026-11-07

Each profile comes seeded with a bundled catalog of more than 40 skills across 12 categories, covering GitHub work, systematic debugging, test driven development, arXiv search, PDF handling and Google Workspace, and an official optional catalog adds more with built in trust.

The Skills Hub installs skills from official sources, GitHub, ClawHub, LobeHub and others after a security scan, including more than 200 site specific browser skills from browse.sh.

Automation blueprints turn common jobs such as a morning brief into cron jobs the user confirms, built in personalities switch per session, and a plugin catalog installs reviewed plugins in one click.

Sourcehermes-agent.nousresearch.com/docs/reference/skills-catalogread 2026-11-07

Work reaches Hermes from many directions. Cron jobs take plain language or cron schedules, run unattended in isolated sessions on a 60 second gateway tick, and deliver to the chat they came from or to any connected platform. Webhook routes on the gateway check GitHub, GitLab and Standard Webhooks signatures, turn the payload into a prompt, and can merge bursts of events or fire an existing cron job. The gateway also takes messages from more than 20 chat platforms, Microsoft Graph change notifications, A2A calls and the API server, beside the CLI, TUI, desktop app and editors.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/cronread 2026-11-07

Users pick the provider and the model.

More than 40 inference options are supported, including Nous Portal, OpenRouter, Anthropic, OpenAI, Google Gemini and Vertex AI, AWS Bedrock, Azure AI Foundry, DeepSeek, z.ai, Hugging Face and local servers such as Ollama, LM Studio, vLLM and llama.cpp, and ChatGPT through Codex, Claude Max, xAI Grok, Qwen and MiniMax subscriptions sign in by OAuth.

The hermes model wizard and /model switch models, flags set one for a single run, auxiliary tasks and subagents can use cheaper models, OpenRouter routing sorts by cost, speed or quality, and fallback providers take over on errors.

Sourcehermes-agent.nousresearch.com/docs/integrations/providersread 2026-11-07

An OpenAI compatible API server exposes chat completions, responses with state kept on the server, and a runs API with an event stream and stop, approval and clarify actions, plus endpoints to manage sessions and scheduled jobs, all behind a bearer key with idempotency keys and a default cap of 10 concurrent runs. Hermes also serves an A2A agent card at the standard well known path, with JSON RPC methods to send, stream, list and cancel tasks and a bearer token for each peer. It runs as an ACP server for editors, embeds as a Python library and takes plugins through a public plugin API.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/api-serverread 2026-11-07

The batch runner sends hundreds or thousands of prompts through the agent in parallel and reports tool call counts, success and failure rates for each tool, reasoning coverage and duration, so the same prompt set can show how different models use tools. It produces trajectories for training and does not grade whether a task was solved. Inside a session, /review sends a background reviewer subagent over the work just produced, language servers check each file the agent writes and feed errors back before the turn ends, and checkpoints let /rollback undo a change.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/batch-processingread 2026-11-07

Hermes drives real interfaces itself.

Its browser toolset launches a headless Chromium with a throwaway profile, or attaches to the user's Chrome, Brave or Edge or to a cloud browser from Browserbase, Browser Use or the Nous Tool Gateway, and the agent navigates, clicks, types, runs JavaScript and reads screenshots over the Chrome DevTools Protocol through the open source browser harness from the Browser Use project, with saved logins filled from a vault.

A computer use toolset reads accessibility trees and screenshots to click, type, scroll and drag on macOS, Windows and Linux desktops without moving the cursor, through the open source cua driver, with those actions behind the approval gate.

Sourcehermes-agent.nousresearch.com/docs/user-guide/features/computer-useread 2026-11-07