Hermes Agent

`hermes backup` writes a zip of the whole ~/.hermes home. `hermes import <zip>` restores it on a machine the owner runs, including profile aliases and the gateway service. The FAQ documents moving to a new machine as install, back up, copy and import. Export and restore each need no approval or queue.

• CLI Commands reference (backup / import)
• FAQ – exporting Hermes to another machine
• hermes_cli/backup.py

The backup covers config.yaml, .env, auth.json, the credential vault, state.db sessions, memories, skills, cron jobs, MCP tokens and memory-provider files. Portal connectors are enabled by default (`connectors.enabled: True`). Credentials for accounts linked through them are held by Nous and its integration providers, and connector policy is stored at the Portal, so those integrations can be re-linked only through the Portal.

• CLI Commands reference
• Tool Search – Connectors (remote tools)
• hermes_cli/config_defaults.py
• tools/connectors/portal/client.py
• Nous Portal Privacy Policy

The runtime is MIT-licensed and the source has no licence check or required Nous account. Cron runs in-process by default, and update checks and the remote model catalog can be switched off. With Nous blocked, Portal connector tools disappear, and public documentation does not give an owner-run replacement for each connector.

• LICENSE (MIT)
• Tool Gateway
• Tool Search – Connectors
• Web Search
• hermes_cli/config_defaults.py

Ollama, llama.cpp, vLLM and LM Studio are documented, and the minimum model is documented as native tool calling with at least 64k context. Tools run in the runtime. The bundled Google Meet plugin's `meet_say` works only in realtime mode, and that mode is hardcoded to wss://api.openai.com/v1/realtime, so this capability is lost off OpenAI.

• Providers (local models, minimum requirements)
• Vision
• Built-in plugins
• plugins/google_meet/realtime/openai_client.py

Everything the P2 export contains lives locally in ~/.hermes on the owner's machine, so a current copy stays with the owner after Portal suspension, a lapsed plan or shutdown. Portal terms allow suspension without notice, but that does not reach local state.

• FAQ
• Which file does what
• Nous Portal Terms of Service

State is unencrypted, in documented formats: SQLite state.db (schema documented and in source), Markdown MEMORY.md, USER.md, SOUL.md and SKILL.md files, cron jobs.json and config.yaml. All logic ships as MIT source. Provider-sealed reasoning replay blobs are treated as inference internals, which the criterion excludes.

• Session storage (developer guide)
• Which file does what
• hermes_state_common.py (SCHEMA_SQL)

Locally assembled context is visible: `HERMES_DUMP_REQUESTS` writes each request body, system prompts and compaction summaries are stored, and `hermes config show` lists local settings. Two shortfalls. (1) No public evidence settles whether the Portal adds context server-side (G12). (2) Model identity is not fully determinable: the Portal says backend routing for a model 'can change over time', the free list includes an undisclosed 'stealth' model, and the Portal-chosen compaction model appears only in a debug log.

• Prompt assembly
• Environment variables
• Nous Portal integration
• agent/auxiliary_client.py
• Portal recommended-models feed

The Portal privacy policy covers collection of prompts, outputs, conversation history, tool interactions, telemetry and usage logs, and derived datasets, analytics and models. It states no retention periods, and the owner has no item-level view of what is held. The only bound is account deletion within six months of termination.

• Nous Portal Privacy Policy
• Nous Portal Terms of Service

Setup recommends Nous's own Portal, which is disclosed and replaceable through Full or Blank Slate setup and `hermes model`. The Portal's recommended-models feed sets model ordering with undisclosed criteria and cannot be switched off. There is no binding no-paid-placement commitment, and one promotional partnership (Nemotron) is disclosed.

• hermes_cli/setup.py (setup mode picker)
• Onboarding recommendations
• Run Nemotron 3 Ultra free
• Quickstart

Tool calls are stored in state.db with their arguments, subagent and cron runs are recorded, and the owner is warned when the store fails. Two shortfalls. (1) Ended sessions are pruned by default (`sessions.auto_prune: True`, `retention_days: 90`). (2) Successful shell-hook runs and outbound webhook calls leave no record; only failures are logged.

• hermes_cli/config_defaults.py (sessions.auto_prune)
• agent/shell_hooks.py
• Sessions
• Hooks

state.db and the logs carry no hash chain, signature or owner-held checkpoint. The only integrity code is SQLite `PRAGMA integrity_check`, which repairs corruption.

• Session storage (developer guide)
• hermes_state_repair.py

The default terminal backend is local, and state.db is not on the protected write-path list. Dangerous-command patterns do not cover deleting state.db or editing it with sqlite3, so nothing in the default configuration stops the agent from altering its record. Docker isolation exists but is not documented as protection for the record.

• Security (protected paths, dangerous commands)
• Configuration (terminal backends)
• agent/file_safety.py

The default install is a git clone of the MIT source, with Python dependencies hash-pinned in uv.lock, so the running code can be tied to a commit. Nous Portal inference and the connector service are closed hosted components that are optional but on by default in the recommended setup.

• Installation
• scripts/install.sh
• Live install.sh

There is no cryptographic agent identity; the A2A design lists DID/Ed25519 identity as out of scope. Owners can set up per-channel identities they control, such as a mailbox on their own domain or an A2A Agent Card on their own host, which Nous cannot revoke. Attribution is per channel only.

• Give your agent an email address
• A2A
• plugins/platforms/a2a/DESIGN.md

Skills have an attributed ledger (curator, agent or user) with per-entry rollback. `/snapshot` covers config, state.db, .env, auth.json and cron, and config backups are kept. Memory, model and runtime-version changes have no attributed change log, memory restore means importing a full backup, and the Portal-held connector state is not covered.

• Checkpoints and rollback
• Curator
• Slash commands

SOUL.md replaces the default identity, most guidance blocks have config switches, and edited or deleted bundled skills are preserved across `hermes update`. Some system-prompt segments can be changed only by editing source: the Hermes help guidance, the steer-channel note and the runtime/environment block. Platform hints can be replaced but not emptied.

• Prompt assembly
• Personality & SOUL.md
• Skills
• agent/system_prompt.py

MEMORY.md and USER.md are plain files, editable per entry, and agent-authored skills are editable files. The session store that `session_search` recalls across sessions can only be deleted a whole session at a time; items cannot be edited and single messages cannot be deleted. External memory providers are off by default.

• Memory
• CLI Commands (sessions)
• Sessions

Owners can connect any MCP server (`hermes mcp add`) or local plugin without review or signing. Every built-in tool sits in a toolset that `agent.disabled_toolsets` removes, and that setting is applied last. Only the separate plugin catalog is curated.

• MCP
• Plugins
• Configuration (toolsets)
• model_tools.py

Approvals, secret redaction, the private-IP SSRF block, Tirith scanning and protected instruction files can be switched off. Several protections have no owner switch in the local backend: the hardline command blocklist ('no override flag'), the file write/read deny lists, the cloud-metadata SSRF floor, prompt-injection scanning of memory and cron prompts, and the Skills Guard block on 'dangerous' verdicts.

• Security
• Skills (Skills Guard)
• tools/approval.py
• tools/url_safety.py

Runtime updates are applied only by explicit `hermes update`, and owners can pin a concrete model and auxiliary models, disable the remote model catalog, or use a local model. A live plugin kill list fetched from Nous can stop an already-installed catalog plugin from loading, and there is no switch to decline this in advance; the owner can re-enable it only afterwards with a forced reinstall.

• Updating
• Plugin catalog
• Model catalog
• hermes_cli/plugins_discovery.py

Gateway access is deny-by-default with per-user allowlists and pairing, and file tools block writes to config.yaml and .env. Two shortfalls. (1) Outbound contact and network scope are only on/off per toolset or a web denylist, with no per-recipient or per-domain allowlist in the default backend. (2) The agent can change its own approval mode and allowlists through the terminal with `hermes config set`, which matches no gated pattern, and the documentation says the terminal can overwrite denied paths. Spend is treated as met under G11: there is no built-in payment tool, card fills need confirmation, and Portal top-up is human-only.

• Security (authorization, file safety, SSRF)
• Configuration (website blocklist, docker_network)
• tools/approval_detection.py
• tools/file_tools_write_guards.py

Owners can set manual approval for dangerous commands, `approvals.deny` floors, untrusted-MCP gating and deny-by-default cron and subagent modes. In the default 'smart' mode an auxiliary model decides whether a flagged command is approved. Gating an arbitrary tool requires writing a `pre_tool_call` hook script, since config has no require-approval list.

• Security (approval modes)
• Hooks
• tools/approval_smart.py

Ctrl+C and gateway `/stop` interrupt the foreground turn and background processes. `hermes pause` writes an ESTOP file that blocks new cron, kanban and gateway work, but in-flight work is never killed, and stopping cron, subagents and the gateway takes separate steps.

• CLI Commands (pause/resume, gateway stop)
• Cron
• Delegation

On the recommended Nous Portal path, the terms license Service Data for training and product development. Inference payloads are stored and used for training unless the owner enables Privacy Mode, which is opt-out and applies only going forward. The privacy policy can change by posting. Hermes telemetry to Nous is off by default, but the FAQ still says Hermes collects no telemetry.

• Nous Portal Terms of Service
• Nous Portal Privacy Policy
• FAQ
• hermes_cli/config_defaults.py (telemetry.shared_metrics)

`hermes auth list/remove`, `hermes vault`, `hermes mcp remove` and `hermes pairing revoke` each show and revoke their own credential class, with no single list. `hermes auth logout` only deletes local tokens and does not revoke them at the provider. Connector credentials held by Nous have no documented owner view or guarantee of deletion on revocation.

• CLI Commands (auth)
• Credential vault
• hermes_cli/auth.py
• Nous Portal Privacy Policy

`hermes uninstall --full` removes local data, but Portal data needs a separate account termination. Nous deletes the account within six months of termination, or one month on request, and gives no documented confirmation. The privacy policy says prior use may already be 'incorporated into models', and derived datasets are retained.

• Updating & uninstalling
• Nous Portal Terms of Service
• Nous Portal Privacy Policy