A personal agent that leaves the terminal
Hermes combines a terminal agent with a messaging gateway. The same ongoing assistant can receive work through Telegram, Discord, Slack, WhatsApp, Signal, email, or its terminal interface. It remembers sessions, can turn successful procedures into skills, schedules recurring work, and delegates parallel tasks. Model access is replaceable: Nous Portal is the bundled subscription route, while OpenRouter, OpenAI, and compatible custom endpoints are supported.
This makes Hermes different from a coding assistant that exists only inside one repository. It is designed to stay online, accept remote requests, and operate a machine or cloud environment. Terminal backends include local execution, Docker, SSH, Singularity, Modal, Daytona, and Vercel Sandbox. That flexibility is useful when a long task should survive a closed laptop, but the deployment target determines what the agent can reach and what a mistake can damage.
The learning story is also broader than ordinary chat history. Hermes can search past conversations, maintain a user profile, create Agent Skills, and nudge itself to store useful knowledge. Those features can reduce repeated explanation. They can also preserve bad assumptions, stale instructions, or sensitive material. Memory needs review and retention rules just like any other user data.
Setup starts simple and expands quickly
The official installers target Linux, macOS, WSL2, Termux, and native Windows. They provision the Hermes environment and supporting command-line tools. Afterward, users choose a model provider and configure tools. Nous Portal can bundle model access with web search, image generation, speech, and a cloud browser, while separate provider credentials remain an option.
A messaging deployment takes more work. Each channel needs its own bot or account setup, tokens, pairing or allowlists, and a gateway process that stays alive. Voice transcription needs its dependencies. Scheduled work needs a dependable host. Remote execution needs SSH, container, or serverless credentials. MCP entries expand the capability set again. Run hermes doctor, keep secrets out of conversation text, and add one channel or backend at a time.
Windows support is documented in detail, including a portable Git Bash path. Platform edge cases remain. One current report says Docker sandbox sessions use a colon in a directory name, which Windows rejects, causing every sandboxed tool call to fail in the reporter's setup. Another Ubuntu report says the installer needed libatomic1 and then stalled while downloading a Playwright browser. These reports make a clean-machine trial worthwhile before a wider rollout.
What happened when we ran it
We cloned commit 999703f into a fresh unprivileged Debian container with three CPUs and 8 GB of RAM. The repository contained 10,024 files, about 2,413,781 lines of source, and occupied 157.7 MB. It is an npm-workspace monorepo with Docker and Compose files, a tests directory, and 30 CI workflow files.
Npm installation succeeded in 76 seconds. It added 1,199 packages and used 1,439 MB on disk, a substantial local footprint. The measured workspace had no build script or target, so the harness skipped the build. It also had no test script or target, so tests were skipped rather than passed.
Npm audit found 6 known vulnerabilities, all rated high severity. It found none at critical, moderate, or low severity. Our measurement does not say which runtime paths reach those packages, and we did not test exploitability. Before exposing a gateway, inspect the audit details on the pinned release, update where supported, and decide whether any remaining dependency is reachable from untrusted messages or tool output.
The security boundary is the product decision
Hermes can write files, execute shell commands, use network tools, run background work, and respond to remote messages. The documentation covers command approval, direct-message pairing, and container isolation. Those controls are necessary, though operators should verify the exact route used by each tool mode.
An open security report says terminal(background=true) executed a command without the dangerous-command consent check that blocked the same foreground command. The reporter demonstrated the behavior through the Telegram gateway with manual approvals. We have not reproduced it, but the claim concerns a direct bypass of a user-facing control. Check whether your pinned version resolves the report, then test foreground and background commands from every enabled channel. Until then, sandboxing and an unprivileged account should carry the main safety load.
Scheduled automations deserve similar caution. A cron task may run when nobody is watching and deliver results to a chat platform. Use narrow working directories, minimal credentials, explicit recipients, and tasks whose failure is recoverable. Delegated subagents multiply throughput and tool calls, so cap parallel work and spending at the provider level.
Health and decision
The repository was pushed on August 23, 2026. Release v2026.8.19, identified as Hermes Agent 0.20.5, was published on August 21. GitHub's open count is an extraordinary 34,872 issues and pull requests combined. Fresh code, releases, and issue updates show intense activity, but that queue is too noisy to use as a clean measure of support quality. Search for the exact platform, backend, and channel you plan to use.
Hermes is a serious trial for a personal agent that must remain reachable and retain context across sessions. OpenClaw is the closest alternative for a cross-platform assistant. Deep Agents fits developers embedding an agent harness in Python, while OpenManus is a more experimental general-agent base. Hermes earns the operational cost only if messaging continuity, scheduling, and memory are core requirements rather than interesting extras.