{"as_of":"2026-10-27","identity_and_version":{"project":"Nous Research Hermes Agent","repository":"https://github.com/NousResearch/hermes-agent","documentation":"https://hermes-agent.nousresearch.com/docs/","release":"v0.22.5","commit":"bf0203a794a07aac3ff764972ab9087baa4e4f4e","tag_resolution":"https://api.github.com/repos/NousResearch/hermes-agent/git/tags/56b6a31fededdf7364e1a0a79548d144e7fd81a3","newest_release":{"channel":"GitHub Releases; stable, draft=false, prerelease=false","published_at":"2026-10-23T05:28:45Z","source":"https://api.github.com/repos/NousResearch/hermes-agent/releases/tags/v0.22.5","latest_check":"https://api.github.com/repos/NousResearch/hermes-agent/releases/latest","conflict":"Editorial release-body date is October 22; date here uses GitHub Releases published_at. Desktop installer app was not newly bundled."},"license":{"name":"MIT","source":"https://github.com/NousResearch/hermes-agent/blob/v0.22.5/LICENSE"},"product_boundary":{"finding":"Python hermes CLI entrypoint is hermes_cli.main:main; hermes-agent is a separate legacy runner. Audit concerns CLI/gateway execution, not the SDK, server invocation or Desktop.","source":"https://github.com/NousResearch/hermes-agent/blob/v0.22.5/pyproject.toml#L565-L567"},"method":"Static official-doc/source/API audit; no Hermes execution/model calls. Release tag resolved to the recorded commit. Current-source comparison pinned to 1ae3c55e4bb16f495ebf0536a5672782d903e15e."},"corrections":[{"question":"Are the requested headless flags actually shipped?","finding":"Shipped: top-level -z/--oneshot PROMPT and --usage-file PATH; chat --oneshot is a boolean with -q/--query-file. stream-json requires a query, implies quiet finite mode and rejects --tui. Bare -q on a TTY is interactive.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/_parser.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/stream_json.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Is the finite CLI a standalone AIAgent process?","finding":"Stable -z and chat stream-json dispatch to a gateway: create/resume session, submit prompt, await settlement. The older direct run_oneshot helper is not the CLI dispatch. The CLI client can exit before its execution authority.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/main.py#L3022-L3028","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Can a prompt plus working directory produce persistent files and then exit?","finding":"Statically supported, not executed: hermes chat --in /worker/job --oneshot -q \"Create output.txt containing done, then finish.\" --toolsets terminal,file --max-turns 20 --format stream-json. --in sends cwd to session creation; file tools use that terminal environment. For Docker, explicitly bind the job directory or enable docker_mount_cwd_to_workspace (default false); otherwise output need not reach that host directory. Check files and settlement.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py#L200-L223","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/file_tools.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/environments/docker.py#L853-L929"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"What is the exact final stream-json schema?","finding":"Final JSONL: type=\"result\",session_id,exit_code,text,tokens={input,output,total,cache_read,cache_write},duration_ms,timestamp(epoch ms); optional error,replay_gap. Missing tokens become 0. No reasoning/cost/auxiliary/child breakdown. Events: system/init,text,tool_use,tool_result (output capped 5000 chars). Failure/detachment can emit result without completed work.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/stream_json.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat_view.py#L425-L447"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"What exactly does the usage-file ledger contain?","finding":"Ledger keys: estimated_cost_usd,cost_status,cost_source,input_tokens,output_tokens,cache_read_tokens,cache_write_tokens,reasoning_tokens,total_tokens,api_calls,model,provider,session_id,completed,partial,interrupted,turn_exit_reason,failed,service_tier; failure is optional. service_tier is requested tier. When attached, auxiliary contains api_calls,input_tokens,output_tokens,cache_read_tokens,cache_write_tokens,reasoning_tokens,estimated_cost_usd,total_tokens,by_task. Each by_task entry omits total_tokens. total_including_auxiliary contains only estimated_cost_usd,total_tokens,api_calls. Missing top-level result values become null.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/oneshot.py#L26-L85","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/oneshot.py#L215-L236","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/turn_finalizer.py#L708-L727"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Do root totals include delegated children?","finding":"Root token/api-call counters exclude child loops. Finalization rolls up child estimated_cost_usd only, so dollars and tokens have different scopes. Root auxiliary aggregation follows ancestor/compression lineage, not descendant subagents. total_including_auxiliary is therefore not a whole-tree token ledger. Collect child usage separately without adding child dollars twice to the rolled-up root estimate.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_results.py#L361-L428","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/turn_finalizer.py#L687-L725","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_state_usage.py#L415-L445"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Are auxiliary calls, cache hits and reasoning counted consistently?","finding":"Main total_tokens=input+cache_read+cache_write+output; input means uncached input. Reasoning is separately reported, not added again. Auxiliary rows preserve cache buckets, but auxiliary.total_tokens is calculated as input+output, omitting auxiliary cache tokens; the grand total inherits that omission. Auxiliary recording also needs a store/context/response usage and is best effort.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/usage_pricing.py#L626-L679","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/oneshot.py#L46-L85","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/aux_accounting.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/usage_pricing.py#L65-L81"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Does api_calls or total_tokens include every retry and all billed usage?","finding":"Returned api_calls counts outer iterations, each containing retries: not all HTTP attempts. Tokens accumulate responses reaching the recorder with usage; usage-less responses, errors and discarded/retried responses lack guaranteed billable-token coverage. MoA has a special reference-usage fold.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/conversation_loop.py#L1573-L1602","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/turn_usage.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/turn_finalizer.py#L687-L710"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Is usage-file guaranteed on all failures, and is it only for -z?","finding":"Docs promise a report even on failure and restrict it to top-level -z. Source writes after gateway settlement; startup/connection failures or early detachment can return first, and write errors are swallowed. Missing reports are unknown usage. Conversely GatewayChatView accepts the global usage-file argument for any finite run, suggesting an undocumented chat extension; do not present that as the documented contract.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat_view.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py#L333-L399","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/reference/cli-commands.md","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/oneshot.py#L215-L236"],"evidence_kind":"conflicting: documentation versus source","version_scope":"v0.22.5"},{"question":"Can a noninteractive run still require a person or leave work alive?","finding":"A finite client can detach with exit 3 when input is required or execution is unresolved, without cancelling accepted work. Ctrl-C in the transport returns 130 while gateway work continues. Settled chat uses 0/1/130; -z distinguishes unfinished/failed (2), interrupt (130) and completed-but-empty (1). Supervision must track/cancel the gateway job, not merely kill the client.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat_view.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py#L389-L399","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/oneshot.py#L92-L108"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"What Docker network and filesystem confinement ships by default?","finding":"Docker terminal networking defaults on; false adds --network=none and rejects contradictory flags. Workspace/root persistence and bind mounts are writable; cwd mounting/host-user mode default off. Selected capabilities are re-added after cap-drop; snap compatibility omits no-new-privileges. CPU/memory/PID limits depend on cgroups, disk quota on storage support. This confines the terminal, not the agent.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/environments/docker.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/config_defaults.py#L360-L386"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Do file tools or execute_code escape Docker to operate on the host?","finding":"File tools share the configured terminal backend, including when called first. Non-local execute_code uses a remote kernel or per-call script on that backend; RPC tools still execute in their usual locations. SECURITY.md and the code-execution page introduction describe host subprocess execution too broadly: actual source dispatches Docker execution remotely. Local arbitrary Python bypasses shell-string guards. Distinguish code location from host-side RPC/tool handling.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/file_tools.py#L269-L377","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/code_execution_tool.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/SECURITY.md#L70-L84"],"evidence_kind":"conflicting documentation versus source; static inference","version_scope":"v0.22.5"},{"question":"Which enabled tools remain outside the terminal sandbox?","finding":"browser_exec runs arbitrary host Python through a host Popen harness, even if its browser CDP target is elsewhere; the schema requires terminal access but does not move the harness into Docker. MCP subprocesses, plugin loading, hooks and skill loading also remain outside terminal isolation. web_search/web_extract use agent-side provider adapters. Thus Docker terminal mounts/networking do not cover every tool.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/browser_use_cli.py#L675-L845","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/SECURITY.md#L70-L95","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/web_tools.py"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Does Docker networking or the egress proxy impose an agent-wide network policy?","finding":"The official whole-agent Compose setup uses host networking, distinct from a Docker terminal. Optional iron-proxy injects proxy/CA/token settings and checks configuration; that does not establish agent-wide OS-enforced egress restrictions. The official isolation guide calls for separate networks/proxy policy. Confine the authority and subprocess tree as well as terminal execution.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/docker-compose.yml","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/environments/docker_egress.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/user-guide/egress/network-isolation.md"],"evidence_kind":"documented plus source-inferred","version_scope":"v0.22.5"},{"question":"What happens to dangerous commands and file writes with nobody present?","finding":"-z admits an unattended turn, which the approval gate treats as YOLO. Finite chat instead honors single_query_mode (default deny). Isolated Docker can skip ordinary shell guards; detected host binds restore them. User deny rules survive isolated-backend/YOLO shortcuts; hardline floors apply on host-access paths. File safe roots constrain file tools, not shell/Python writes. Pattern rules and denial-breaker advice are not process containment or a spend cap.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/approval.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/gateway/session_finite.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/user-guide/security.md"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"How restrictive are toolsets, and do restrictions survive delegation?","finding":"Explicit toolsets enable groups; disabled sets subtract last, but disabled platform bundles preserve core tools. Public delegate_task has no toolsets parameter. Children inherit sets/denials plus leaf exclusions; internal narrowing retains MCP sets by default. Depth grants delegation. Profile-routed children install their target profile policy, so parent confinement is not universally inherited.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/model_tools.py#L285-L339","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_toolsets.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_routes.py#L118-L156","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/user-guide/features/delegation.md#L375-L390"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Are root and delegated runs bounded by sensible shipped defaults?","finding":"Default root agent.max_turns is null/unlimited, contradicting CLI help saying 500. Set an explicit positive chat --max-turns; it caps iterations, not aggregate tokens/time. Gateway transport rejects --run-budget and points to agent.run_budget_seconds configuration. Stable child defaults: 250 iterations, 10 concurrent, depth 1, two total one-shot spawns, inactivity timeout disabled. Children have independent budgets; configuration prose contains stale 50/3/depth-ceiling claims.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/config_defaults.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/config.py#L1826-L1865","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py#L15-L32","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/user-guide/configuration.md","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/_parser.py#L298-L305"],"evidence_kind":"conflicting: documented defaults versus pinned implementation","version_scope":"v0.22.5"},{"question":"Does parallel delegation work in a finite CLI, and what isolation is inherited?","finding":"Finite delegation joins results while batches run concurrently. Default same-profile children seed cwd and alias the parent container, sharing environment/filesystem rather than independent containers. Optional child worktrees apply only to local Git workspaces. Child timeout is inactivity-based and off by default, not a wall-clock deadline.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_dispatch.py#L250-L280","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_child_run.py#L795-L820","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_config.py"],"evidence_kind":"source-inferred","version_scope":"v0.22.5"},{"question":"Which subscription logins are actually documented in stable?","finding":"Nous Portal documents subscription OAuth. Codex documents ChatGPT OAuth without requiring Codex CLI, but leaves eligible tiers/quota charging unspecified. Hermes Anthropic docs require Max plus purchased extra usage, exclude base Max allowance and Pro OAuth; API-key billing is separate. Stable Copilot includes direct subscription/device login and copilot-acp, the latter requiring a separate CLI/login. These are publisher claims, not entitlement tests.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/integrations/providers.md#L134-L274","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/integrations/nous-portal.md","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/providers.py"],"evidence_kind":"documented; stable provider registration corroborates routes","version_scope":"v0.22.5"},{"question":"Are account logins and API-key plans interchangeable with subscription access?","finding":"xAI OAuth documents SuperGrok/X Premium+ but warns of inference 403 despite active subscriptions. Qwen/MiniMax OAuth are account-login paths; paid entitlements are not established here. OpenRouter PKCE stores an API key. Gemini requires a key; Vertex uses ADC/service accounts and GCP billing, not documented Google consumer-plan access. Alibaba plan endpoints still require keys. Initial authorization needs an owner; unattended work assumes provisioned credentials.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/guides/xai-grok-oauth.md","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/integrations/providers.md","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/guides/minimax-oauth.md"],"evidence_kind":"documented; subscription semantics not found where stated","version_scope":"v0.22.5"},{"question":"Which current features must not be backported into the stable profile?","finding":"At inspected default-branch commit, Copilot moves to a labs plugin; one-shot policy removes clarify/live delegate controls while retaining skill_manage. Stable prunes skill_manage instead. These changes are post-stable. Conversely -z, usage-file and stream-json already ship in v0.22.5.","exact_supporting_url":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/oneshot_footprint.py","https://github.com/NousResearch/hermes-agent/blob/1ae3c55e4bb16f495ebf0536a5672782d903e15e/agent/oneshot_footprint.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/providers.py","https://github.com/NousResearch/hermes-agent/blob/1ae3c55e4bb16f495ebf0536a5672782d903e15e/website/docs/integrations/providers.md#L207-L220"],"evidence_kind":"version comparison: pinned stable versus pinned default branch","version_scope":"stable versus 1ae3c55e4bb16f495ebf0536a5672782d903e15e; no later release inferred"}],"confirmed_capabilities":[{"capability":"Finite prompt/cwd CLI, file-writing path, JSONL/ledger exports and parallel child joining are present; limits and static-verification qualifications are in corrections.","sources":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/gateway_chat.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/stream_json.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/tools/delegate_tool_dispatch.py"]},{"capability":"Provider breadth","finding":"Stable docs list Nous, OpenRouter, OpenAI API/Codex, Anthropic, Copilot API/ACP, Gemini/Vertex, Bedrock, Azure Foundry, DeepSeek, xAI, Qwen/DashScope, MiniMax, Kimi, z.ai, Hugging Face, NVIDIA, Novita, Fireworks, AI Gateway, Ramp Router, Nebius, Arcee, GMI, Actual, Kilo, Xiaomi, Tencent, OpenCode Zen/Go, CommandCode, Ollama Cloud, StepFun, LM Studio and custom endpoints, including region/plan variants. Integration listing is not a model-compatibility test.","source":"https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/integrations/providers.md#L15-L60"}],"unresolved":[{"question":"Complete billable-token/dollar reconstruction, including all retries?","finding":"No root-only guarantee. Missing provider usage, child auxiliary spend and best-effort persistence require reconciliation. Included/unknown/estimated cost is not a measured plan debit.","pages_checked":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/usage_pricing.py","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_state_usage.py"]},{"question":"Uniform per-invocation counters on resumed sessions?","finding":"Not established: finalization copies session counters; auxiliary reporting subtracts a snapshot. Prefer fresh sessions or durable baselines.","pages_checked":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/agent/turn_finalizer.py#L687-L725","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/hermes_cli/oneshot.py#L57-L73"]},{"question":"OAuth paid-tier eligibility and quota charging?","finding":"Codex tiers/quota semantics and Qwen/MiniMax paid entitlement remain unestablished; xAI entitlement failures are documented. Login support is not unlimited-use evidence.","pages_checked":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/integrations/providers.md#L134-L154","https://github.com/NousResearch/hermes-agent/blob/v0.22.5/website/docs/guides/minimax-oauth.md"]},{"question":"Behavioral verification and universal confinement?","finding":"No execution claim. Interface/file-write verification is static; comprehensive confinement across tools/plugins is not established.","pages_checked":["https://github.com/NousResearch/hermes-agent/blob/v0.22.5/SECURITY.md"]}],"ranking_implications":{"assessment":"Eligible, flexible and parallel-capable. Safe defaults, full metering and hard completion bounds require wrapper engineering; this audit does not rank other candidates.","worker_additions":["Use explicit --oneshot, --in, positive --max-turns, fresh session, provisioned credentials and minimal tools. Verify files and gateway settlement; handle exit 3/disconnects.","Confine the authority/process tree and job profile with OS/container/VM permissions, mounts and egress policy. Restrict terminal networking separately; expose no Docker control socket.","Meter root plus child/model auxiliary records; correct auxiliary cache totals, retain missing usage as unknown, avoid double-counting rolled-up child dollars and reconcile against provider accounting.","Set independent parent/child iterations, depth, concurrency and spawn caps; supervise the gateway job deadline/cancellation. Restrict browser_exec, MCP, plugins, hooks, cron, messaging and profile routes."]}}