# Hermes Agent (slim)

> Open-source personal agent from Nous Research that the owner runs on a computer or server. It answers on messaging apps, keeps memory between sessions, runs scheduled jobs and connects to accounts, models and MCP servers the owner configures.

- Full: https://www.anchorterminal.com/tools/hermes-agent.md (~8,100 tokens) · this version ~2,130 tokens · JSON https://www.anchorterminal.com/tools/hermes-agent.json · canonical https://www.anchorterminal.com/tools/hermes-agent
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**B · 67.9/100 · rank #244 of 986 · #3 in Personal assistants · not agent-ready · confidence medium**


Assessment: Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.

## Facts

- Kind: Agent harness · vendor: Nous Research · category: Personal assistants · legal entity: Nous Research, Inc. · provenance 53/100
- Packages: oci `nousresearch/hermes-agent`
- Auth: None · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Where it runs: The owner's computer, server or container (Linux, macOS, Windows, WSL2, Android through Termux), with a desktop app, a terminal UI and a gateway process. Nous also sells hosted instances as Hermes Cloud, which this listing does not grade
- What it does without asking: Runs shell commands and edits files on the host. Dangerous command patterns go through approval, default mode `smart`, where an auxiliary model approves low-risk commands, denies dangerous ones and asks about the rest. `manual` always asks and `off` or `--yolo` never does. A fixed blocklist cannot be overridden
- Sending, paying, deleting: Saved-card fills always ask and are refused in cron, webhook and API sessions. Address fills need no confirmation. The Google Workspace skill tells the model to confirm before sending mail or changing calendar, Drive, Docs or Sheets, which is an instruction and not a code gate. Recursive deletes and SQL drops trigger approval
- Unattended runs: Cron jobs, `/heartbeat` prompts and webhook-triggered jobs. `approvals.cron_mode`, `single_query_mode` and `unattended_mode` default to `deny`, which blocks a dangerous command without asking. Cron sessions cannot create cron jobs
- Accounts and credentials: Google Workspace by OAuth (Gmail read, send and modify, Calendar, Drive, Contacts read-only, Sheets, Docs) with the token in `~/.hermes/google_token.json`. Mail over IMAP and SMTP. Site logins and cards in a Fernet-encrypted vault under `~/.hermes/vault/`, filled into the page without reaching the model, or read from 1Password or Bitwarden. API keys in `~/.hermes/.env` or an external secret manager. MCP OAuth tokens in `~/.hermes/mcp-tokens/`
- Memory: `MEMORY.md` (2,200 characters) and `USER.md` (1,375 characters) in `~/.hermes/memories/`, plain files the owner can edit or delete. Every session is stored in SQLite at `~/.hermes/state.db` with full-text search, removed with `hermes sessions delete` or `prune`. External memory providers such as Honcho and Mem0 are optional plugins
- Channels: Telegram, Discord, Slack, WhatsApp, Signal, SMS, email, Matrix, Mattermost, Microsoft Teams, Google Chat, LINE, iMessage through BlueBubbles or Photon, DingTalk, Feishu, WeCom, Weixin, QQ, IRC, ntfy, webhooks and an OpenAI-compatible API server
- Who can message it: Nobody by default. Per-channel allowlists, a cross-channel allowlist or a pairing code approved with `hermes pairing approve`. All authorised senders are trusted equally
- Model providers: Any the owner configures, among them Nous Portal, OpenRouter, OpenAI, Anthropic, Google, Ollama and LM Studio. Prompts and tool results go to that provider and to any auxiliary model, web search, speech or cloud browser backend that is turned on
- Sandbox: Terminal backends local (default, on the host), SSH, Docker, Singularity, Modal, Daytona and Vercel Sandbox. Container backends skip the dangerous-command check. The code execution tool, MCP subprocesses, plugins and skills run in the agent process whatever the backend
- MCP client: stdio and HTTP servers with OAuth 2.1, per-server `tools.include` and `tools.exclude`, a catalogue of reviewed servers, and a filtered environment for stdio servers
- Telemetry: None, per the FAQ. Passive update checks can be turned off
- Cost of a month: The software is free. Model usage is billed by the provider chosen, or nothing with a local model. Optional Nous Portal plans are $0, $20, $100 and $200 a month, and an optional Hermes Cloud instance is $0.51 a day running on the Standard size (about $15 for 30 days) plus inference
- Releases: v0.21.7 on 11 October 2026 and v0.21.6 on 8 October, after eight date-versioned releases from 19 August to 24 September 2026
- Security advisories: None published on GitHub on 12 October 2026. The v0.21.6 notes list fixes for dashboard sign-in, git filter programs and the email sender allowlist

- Scores: Reliability 57, Performance pending, Schema & documentation 80, Agent ergonomics 80, Security & auth 75, Payments & pricing 60, Task success pending, Maintenance & community 84, Transparency & trust 63 · negative events -3 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as the Goose and Khoj dossiers are. · Schema & documentation, Harness reading of the framework line, as for Goose. · Agent ergonomics, Harness reading, scored on what a person or pipeline driving it must supply. · Security & auth, Harness reading used for Goose. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v0.21.7 was published on 11 October 2026, the day before this check (30). · Transparency & trust, MIT (30).
- Sources: 26, open questions: 11, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/hermes-agent.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/hermes-agent.svg` or a link to https://www.anchorterminal.com/tools/hermes-agent from a page on nousresearch.com or one of its subdomains, or the README of github.com/NousResearch/hermes-agent, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `approvals.mode: manual` before giving it real accounts. The default `smart` lets an auxiliary model approve commands
2. Run the gateway with `terminal.backend: docker` or the project's Docker image when it reads mail, web pages or group chats
3. Set `memory.write_approval: true` and `skills.write_approval: true` to review what it saves about the owner
4. Leave `approvals.cron_mode` and `approvals.unattended_mode` at `deny` for scheduled and webhook runs
5. Set `TELEGRAM_ALLOWED_USERS` or the matching allowlist per channel. Never set `GATEWAY_ALLOW_ALL_USERS=true`

## Connect

```bash
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash   # then: hermes setup
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |
| nanobot | B | 62.4 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/nanobot.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)