{ "name": "Hermes Agent", "repo": "https://github.com/NousResearch/hermes-agent", "docs": "https://hermes-agent.nousresearch.com/docs/", "headless": { "finding": "Yes. `hermes chat -q \"\" --oneshot` (or -Q/--quiet, or any non-TTY stdio) answers one prompt and exits; `--query-file PATH` reads the prompt from a file and `--query-file -` from stdin. `hermes -z ` is a scripted one-shot that prints only the final reply text. `--in ` selects the working directory; otherwise the CLI uses its launch directory. `--format stream-json` emits JSONL events (system, text, tool_use, tool_result, result) on stdout. Exit codes for chat -Q/--oneshot/non-TTY: 0 turn completed, 1 failed/partial/budget hit/init failed, 130 interrupted, 75 (kanban worker only) provider rate-limit/overload/5xx/timeout/quota with the task requeued. For -z: 0 completed, 2 failed or partial or usage error, 1 completed with no text, 130 interrupted. `--max-turns N` caps tool-calling iterations per turn (default 500). Approvals: in single-query (-q) sessions, dangerous commands are handled by approvals.single_query_mode, default `deny` (blocked, no prompt); `approve` auto-approves everything; `--yolo` / HERMES_YOLO_MODE=1 / approvals.mode: off skip approval checks entirely. An always-on hardline blocklist (root filesystem wipes, fork bombs) still applies even under --yolo. Pending approvals time out after 300 s (default) and are then denied (fail-closed).", "quote": "With `--oneshot`, `-Q`, or non-TTY stdio it answers and exits. | --query-file: \"Read the query from a file (`-` = stdin).\" | --in: \"Change into `` before starting or resuming.\" | -z: \"single prompt in, final response text out, nothing else on stdout or stderr.\" | -z exit codes: \"`0` the turn completed; `2` it failed or stopped partway (`partial`, iteration budget, `completed: false`).\" | security: \"A `-q` session runs a single turn and exits with no user waiting to answer prompts;\" \"`approve` auto-approves everything in single-query context. Mirrors `cron_mode`.\" | --yolo: \"Bypass dangerous-command approval prompts.\"", "url": "https://hermes-agent.nousresearch.com/docs/reference/cli-commands ; https://hermes-agent.nousresearch.com/docs/user-guide/security#approval-modes", "third_party": false }, "confinement": { "finding": "Several layers, none on by default except approval checks and the write denylist. (a) Shell commands: before any command runs, Hermes checks it against a curated dangerous-pattern list (recursive deletes, mkfs, dd if=, SQL DROP/TRUNCATE, docker stop/kill, pipe-to-shell); approvals.mode is manual, smart (default: an auxiliary LLM rates risk and auto-denies genuinely dangerous commands) or off. A permanent command_allowlist (exact commands, shell globs or rule keys) is approved silently; `hermes approvals` turns approval history into allowlist proposals. A hardline blocklist cannot be overridden. (b) File writes: write_file/patch always deny protected paths (~/.ssh/, ~/.aws/, /etc/sudoers, .env files, among others); setting HERMES_WRITE_SAFE_ROOT restricts write_file and patch to the listed directory prefix(es) and hard-blocks anything outside. The docs say the terminal tool runs as the same OS user and can still overwrite denied paths through shell commands. (c) OS-level isolation by terminal backend: local (default, no isolation), docker (hardened: --cap-drop ALL, no-new-privileges, --pids-limit 256, size-limited/noexec tmpfs; credential files mounted read-only; CPU/memory limits via container_cpu/container_memory), ssh, modal (cloud VM per task), daytona, vercel_sandbox, plus plugin singularity/apptainer. Under the container/cloud backends the dangerous-command check is skipped. `--worktree` runs in an isolated git worktree (not a security boundary). (d) Network: terminal.docker_network: false runs the Docker container with --network=none, cutting off all egress from agent commands; a website blocklist applies to web_search, web_extract, browser_exec and all URL-capable tools; SSRF protection is always on and fails closed. (e) Tools: -t/--toolsets selects which toolsets are enabled (the legacy hermes-agent runner has --enabled-toolsets/--disabled-toolsets); --safe-mode disables user config, rules, plugins, shell hooks and MCP servers; terminal and execute_code strip sensitive environment variables from child processes. No per-tool allow/deny list for individual shell commands beyond the approval allowlist was found, and there is no seatbelt/bubblewrap/gVisor sandbox for the local backend.", "quote": "\"Before executing any command, Hermes checks it against a curated list of dangerous patterns.\" | \"When set, `write_file` and `patch` may only target paths inside the listed directory prefix(es).\" | \"The `terminal` tool runs as the same OS user and can still `cat` or overwrite denied paths via shell commands.\" | \"When using the `docker` terminal backend, Hermes applies strict security hardening to every container.\" | Local backend: \"The default. Commands run directly on your machine with no isolation.\" | docker_network false: \"cutting off all network egress from agent commands.\" | \"The blocklist is enforced across `web_search`, `web_extract`, `browser_exec`, and all URL-capable tools.\"", "url": "https://hermes-agent.nousresearch.com/docs/user-guide/security ; https://hermes-agent.nousresearch.com/docs/user-guide/configuration#terminal-backend-configuration ; https://hermes-agent.nousresearch.com/docs/reference/cli-commands", "third_party": false }, "token_reporting": { "finding": "Yes, in machine-readable form. (1) `hermes -z ... --usage-file ` writes a JSON usage report after the run, even if the run fails: estimated_cost_usd, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, token totals, api_calls, model, provider, session ID and completion flags; auxiliary LLM calls are reported separately. (2) `hermes chat -q ... --format stream-json` ends with a `result` JSONL record holding session_id, exit_code, text, tokens {input, output, total, cache_read, cache_write}, duration_ms (plus error on failure). No cost field is listed in that record. (3) `hermes insights` shows token/cost/activity analytics (--days, --source filters), and `hermes sessions export` writes sessions to JSONL; in-session /usage and /insights also exist. No field for reasoning tokens was found in the docs.", "quote": "usage file fields include \"`estimated_cost_usd`, `input_tokens` / `output_tokens` / `cache_read_tokens`\" | result record: \"`session_id`, `exit_code`, `text`, `tokens` (`input`, `output`, `total`, `cache_read`, `cache_write`), `duration_ms`\" | \"Every stdout line is one JSON object\" | hermes insights: \"Show token/cost/activity analytics.\"", "url": "https://hermes-agent.nousresearch.com/docs/reference/cli-commands", "third_party": false }, "parallelism": { "finding": "Yes. The delegate_task tool spawns child agents with isolated context; when given a `tasks` array they run in parallel, up to delegation.max_concurrent_children (default 10, configurable, no hard ceiling). delegation.max_spawn_depth sets tree depth (default 1 = flat). Other keys: delegation.max_iterations, independent_completions, worktree_isolation, orchestrator_enabled, and delegation.model / delegation.provider / delegation.base_url to give subagents a different model (default: the parent's). delegate_task subagents share the parent session's container. Separately, a kanban board with dispatcher-spawned worker agents exists (exit code 75 requeues a task), and `--worktree` runs a session in an isolated git worktree \"for parallel-agent workflows\". The docs found do not state a limit on several independent `hermes` processes running at once.", "quote": "\"Up to 10 concurrent subagents by default (configurable, no hard ceiling)\" | \"Batch children still run in parallel, subject to `delegation.max_concurrent_children`.\" | \"If omitted, subagents use the same model as the parent.\" | \"Start in an isolated git worktree for parallel-agent workflows.\"", "url": "https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation ; https://hermes-agent.nousresearch.com/docs/reference/cli-commands", "third_party": false }, "providers": { "finding": "Many first-class providers: Nous Portal, OpenAI Codex, Anthropic, OpenRouter, Ramp Router, Fireworks AI, NovitaAI, AI Gateway, z.ai/GLM, Kimi/Moonshot, Arcee AI, GMI Cloud, Nebius Token Factory, Actual Computer, MiniMax, xAI (Grok), Qwen Cloud/Alibaba, Kilo Code, Xiaomi MiMo, Tencent TokenHub, OpenCode, DeepSeek, Hugging Face, Google Gemini, Google Vertex AI, OpenAI API, Azure AI Foundry, AWS Bedrock, NVIDIA Build, Ollama Cloud, StepFun, LM Studio, plus any OpenAI-compatible Custom Endpoint (`--provider custom --base-url --api-key`, key not written to disk). Local backends documented: Ollama, vLLM, SGLang, llama.cpp/llama-server, LM Studio. GitHub Copilot is a labs plugin rather than built in. Fallback providers can be chained for rate-limit/overload errors.", "quote": "Ollama: \"Local Models, Zero Config.\" | vLLM: \"High-Performance GPU Inference\" | llama.cpp: \"CPU & Metal Inference.\" | \"Fallback providers are tried in order when the primary model fails with rate-limit, overload, or connection errors.\"", "url": "https://hermes-agent.nousresearch.com/docs/integrations/providers ; https://hermes-agent.nousresearch.com/docs/reference/cli-commands", "third_party": false }, "subscription_login": { "finding": "Yes, for several vendors, via `hermes auth` / `hermes model`: OpenAI Codex (ChatGPT plan) by device-code login, no Codex CLI needed; Nous Portal subscription by OAuth (the recommended path); Anthropic Claude OAuth, but only on a Claude Max plan with purchased extra-usage credits (Claude Pro cannot use it); GitHub Copilot by device-code login (`hermes auth add copilot`, labs plugin) or a GitHub token; Qwen Portal, MiniMax and xAI SuperGrok/X Premium+ by browser OAuth. A consumer Gemini subscription cannot be used (API key or Vertex service account only).", "quote": "\"The OpenAI Codex provider authenticates via device code by default (open a URL, enter a code).\" | \"Nous Portal is Nous Research's unified subscription gateway and the recommended way to run Hermes Agent.\" | \"It only works if you're on a Claude Max plan and have purchased extra usage credits.\" | \"Sign in with `hermes auth add copilot` (device-code login), or set `COPILOT_GITHUB_TOKEN`, `GH_TOKEN` or `GITHUB_TOKEN`.\" | \"There is currently no way to sign in to Hermes with a consumer Gemini subscription.\" | hermes auth: \"Handles OAuth flows for Codex/Nous/Anthropic.\"", "url": "https://hermes-agent.nousresearch.com/docs/integrations/providers ; https://hermes-agent.nousresearch.com/docs/reference/cli-commands", "third_party": false }, "license": { "finding": "MIT (SPDX: MIT). The GitHub repository API also reports spdx_id \"MIT\", and the PyPI package reports license_expression \"MIT\".", "quote": "MIT License\n\nCopyright (c) 2025 Nous Research", "url": "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/LICENSE", "third_party": false }, "latest_stable": { "finding": "v0.22.5 (\"Hermes Agent v0.22.5\"), published 2026-10-23T05:28:45Z, prerelease false, draft false (GitHub releases API /releases/latest and /releases list). Package registry: PyPI `hermes-agent` (author Nous Research, MIT) is at 0.19.0, uploaded 2026-07-20T18:37:26, so PyPI lags the GitHub releases. The README lists install scripts (curl / PowerShell) and a Termux APT repository, not pip.", "quote": "\"tag_name\": \"v0.22.5\", \"name\": \"Hermes Agent v0.22.5\", \"prerelease\": false, \"draft\": false, \"published_at\": \"2026-10-23T05:28:45Z\" | PyPI info.version: 0.19.0", "url": "https://api.github.com/repos/NousResearch/hermes-agent/releases/latest ; https://api.github.com/repos/NousResearch/hermes-agent/releases?per_page=20 ; https://pypi.org/pypi/hermes-agent/json", "third_party": false }, "latest_prerelease": { "finding": "No release object marked prerelease was found in the GitHub releases API: the newest entries (v0.22.5, v0.22.4 2026-10-21T18:49:24Z, v0.22.3 2026-10-21T12:21:11Z, v0.22.2 2026-10-15T08:21:32Z, v0.22.1 2026-10-14T23:59:24Z) all have prerelease false. Only the first ~5 entries could be read; older entries were not checked. The releases atom feed does list newer canary and release-candidate tags, newest v0.22.5+canary.20261026T071310Z (updated 2026-10-26T07:13:11Z), and rc.3-v0.22.5 (2026-10-23T02:25:20Z). But /releases/tags/ returns HTTP 404 for both, which suggests they are git tags without a published GitHub release object (an inference, not confirmed).", "quote": "atom feed entry: \"v0.22.5+canary.20261026T071310Z\" updated 2026-10-26T07:13:11Z; API: \"prerelease\":false on all visible entries", "url": "https://github.com/NousResearch/hermes-agent/releases.atom ; https://api.github.com/repos/NousResearch/hermes-agent/releases?per_page=100", "third_party": false }, "last_commit": { "finding": "Newest commit on main: 1ae3c55e4bb16f495ebf0536a5672782d903e15e, committer date 2026-10-27T03:21:53Z (author date 2026-10-27T01:22:54Z), message \"test(a2a): cover token-mode Host, malformed Host and missing Content-Type\". The repository API reports pushed_at 2026-10-27T03:57:26Z.", "quote": "\"sha\": \"1ae3c55e4bb16f495ebf0536a5672782d903e15e\" ... committer \"date\": \"2026-10-27T03:21:53Z\"", "url": "https://api.github.com/repos/NousResearch/hermes-agent/commits?per_page=1", "third_party": false }, "fork_of": { "finding": "Not a fork: the GitHub API reports fork false and lists no parent. The README says it is built by Nous Research. It offers migration/import from OpenClaw and other agents, but that is an import feature, not fork lineage.", "quote": "\"fork\": false | README: \"built by Nous Research\"", "url": "https://api.github.com/repos/NousResearch/hermes-agent ; https://raw.githubusercontent.com/NousResearch/hermes-agent/main/README.md", "third_party": false }, "maintenance": { "finding": "Actively maintained, not archived. Commits and canary tags appear daily in late October 2026, and stable releases v0.22.1 through v0.22.5 came out between 2026-10-14 and 2026-10-23. Repository created 2025-07-22.", "quote": "\"archived\": false, \"pushed_at\": \"2026-10-27T03:57:26Z\", \"created_at\": \"2025-07-22T22:22:28Z\"", "url": "https://api.github.com/repos/NousResearch/hermes-agent", "third_party": false }, "gaps": [ "Prerelease: the GitHub releases API pages were too large to read in full; only the newest ~5 release objects were inspected (all prerelease:false). Canary/rc tags appear only in the atom feed and return 404 as release objects. Pages checked: https://api.github.com/repos/NousResearch/hermes-agent/releases?per_page=100, /releases/tags/v0.22.5%2Bcanary.20261026T071310Z, /releases/tags/rc.3-v0.22.5, https://github.com/NousResearch/hermes-agent/releases.atom.", "Reasoning-token field: no reasoning-token field is documented for --usage-file or the stream-json result record (checked docs/reference/cli-commands). The full field list of the usage file was not read verbatim beyond the quoted names.", "No per-command allow/deny list for the terminal tool other than the approval allowlist/dangerous-pattern list, and no OS sandbox (seatbelt/bubblewrap/gVisor) for the local backend, was found on docs/user-guide/security or docs/user-guide/configuration.", "The security page does not mention network controls for the docker backend; the docker_network:false setting comes from docs/user-guide/configuration. Whether network can be cut for the local backend: not found.", "Explicit documentation of running many independent hermes processes concurrently was not found; only delegate_task parallelism, kanban workers and --worktree are documented.", "No separate changelog page was found in the docs navigation or llms.txt; release information was taken from the GitHub API/atom feed.", "Quotes were taken through a page-fetch tool that extracts text; long docs pages (cli-commands ~150k chars, configuration ~279k chars) were only partly read, so some sections (e.g. the full delegation/approvals parts of configuration) were not checked." ], "sources": [ "https://github.com/NousResearch/hermes-agent", "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/README.md", "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/LICENSE", "https://api.github.com/repos/NousResearch/hermes-agent", "https://api.github.com/repos/NousResearch/hermes-agent/releases?per_page=20", "https://api.github.com/repos/NousResearch/hermes-agent/releases?per_page=100", "https://api.github.com/repos/NousResearch/hermes-agent/releases/latest", "https://api.github.com/repos/NousResearch/hermes-agent/commits?per_page=1", "https://github.com/NousResearch/hermes-agent/releases.atom", "https://pypi.org/pypi/hermes-agent/json", "https://hermes-agent.nousresearch.com/docs/", "https://hermes-agent.nousresearch.com/llms.txt", "https://hermes-agent.nousresearch.com/docs/reference/cli-commands", "https://hermes-agent.nousresearch.com/docs/user-guide/security", "https://hermes-agent.nousresearch.com/docs/user-guide/configuration", "https://hermes-agent.nousresearch.com/docs/integrations/providers", "https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation" ] }