Hermes Agent

No shortfalls: `hermes backup` immediately writes the complete Hermes home (config, .env, auth.json, state.db, skills, memory, cron, profiles) to one zip, and `hermes import <zip>` restores it in place on another machine. The docs advise stopping the gateway first and running `hermes setup` afterwards to check provider keys.

• hermes_cli/backup.py
• FAQ: Exporting Hermes to another machine
• CLI reference: hermes import

`hermes backup` includes configuration, the SOUL.md persona, MEMORY.md/USER.md, the session database, skills, cron jobs, secrets and the encrypted credential vault, which is everything that defines the agent. Only regenerable caches such as checkpoints and browser profiles are excluded.

• hermes_cli/backup.py (exclusion and secret-file rules)
• Which file does what

The runtime is MIT-licensed Python that runs locally and can be pointed at a self-hosted OpenAI-compatible endpoint (e.g. Ollama, llama.cpp), so it can operate without contacting Nous servers.

• LICENSE
• Local Ollama setup guide

Hermes has no identity of its own that contacts can verify: after migration they recognize it only through the messaging-platform accounts and A2A peer tokens whose credentials travel in the backup, relying on each platform. Nous is not involved in either case.

• hermes_cli/backup.py (secret files)
• Messaging gateway docs
• A2A docs

No license checks or remote enablement flags were found; update checks are read-only and plugin update polling can be set to 0. The optional Nous free-tier identity only affects Nous-hosted inference and tools.

• hermes_cli/config_defaults.py
• hermes_cli/anon_auth.py

Tools, memory, skills, cron, MCP and the messaging gateway are executed by the runtime and work with any model, and the optional Nous Tool Gateway services have self-keyed alternatives. Local models must support tool calling to use them.

• Tool Gateway docs
• Local models docs

State is stored as YAML config, .env, Markdown memory/persona files, JSON cron jobs and a documented SQLite schema (state.db), all readable without Hermes.

• hermes_state_common.py (schema)
• Which file does what

The system prompt is assembled by open-source code from owner-visible files (SOUL.md, AGENTS.md, memory, skills) and is persisted per session in the state.db `system_prompt` column. Context files discovered mid-session are injected as visible messages.

• agent/prompt_builder.py
• Context files docs

Memory and user profile live in local files and SQLite; Nous keeps no profile in a self-hosted setup. Owner-selected external services (inference providers, the optional Honcho memory provider, Nous Portal) process data under their own policies.

• Memory docs
• Memory providers docs

Every session's messages, tool calls and tool results are stored in the local state.db, and A2A exchanges in a local audit log, all included in backups. Sessions can be exported with `/export`.

• Sessions docs
• hermes_state_portability.py
• A2A docs

Skills are Markdown (agentskills.io format) with optional scripts, and the runtime, plugins and tools are plain Python source.

• Skills docs
• hermes-agent repository

No advertising, sponsorship or partner-ranking channel was found in the source. Content comes into context only through owner-installed skills, plugins, MCP servers and connected platforms.

• hermes-agent repository
• Plugins docs

The runtime writes each tool-call turn to the session database before any tool runs, and if that write fails it ends the turn without executing the tools. Final text replies are flushed before delivery but are still sent if that write fails, with a later retry.

• agent/turn_tool_round.py
• agent/tool_executor.py
• agent/turn_final_response.py

Edits to or deletions from the session database or the A2A audit log are not detectable, because rows and entries carry no hashes, chaining or signatures.

• hermes_state_common.py (schema)
• A2A security (audit log)

With the default local terminal backend, the agent runs as the owner's OS user and its shell and file tools can reach ~/.hermes/state.db. The Docker backend mounts only credentials, skills and caches (read-only) plus the working directory, which keeps the session database out of reach.

• hermes_cli/config_defaults.py (approvals, protected_instruction_files)
• tools/environments/docker.py
• Security docs

Session history is in SQLite and logs, including the A2A audit log, are plain text or JSONL under ~/.hermes, readable with sqlite3 or any text tool.

• Session storage recovery docs

In A2A exchanges, the calling and the receiving Hermes both persist the conversation keyed by the shared A2A context and task ids, and the server also appends each exchange to `a2a_audit.jsonl`, so the two records can be matched. Delegated subagent sessions are linked to their parent session.

• A2A docs
• A2A adapter source
• Delegation docs

The runtime is MIT-licensed (OSI-approved), with exact-pinned dependencies, a uv.lock and a Nix flake. Bit-for-bit reproducible release builds are not documented.

• pyproject.toml
• flake.nix

Active configuration comes from owner-readable config.yaml and .env files, layered over code defaults and environment variables. The layering means the effective config is not always the literal file contents.

• Configuration docs
• hermes_cli/config_effective.py

Messages can be attributed only through the platform bot accounts and A2A tokens the agent uses, whose credentials travel in the backup, so recipients rely on each platform's authentication. Outbound messages carry no signature a recipient could check independently; A2A push notifications use an HMAC with a shared secret.

• Messaging gateway docs
• A2A docs

The action record carries no integrity data, so no tool can check that it is unaltered.

• hermes_state_common.py (schema)

`hermes backup` and quick snapshots capture the full state as YAML, Markdown, JSON and SQLite, so the owner can compare two snapshots with open tools such as `diff` and SQLite's `sqldiff`. No built-in state digest is provided.

• hermes_cli/backup.py (quick snapshots)
• Which file does what

Persona (SOUL.md), project instructions (AGENTS.md) and prompt-building code are all owner-editable; the built-in prompt text is in MIT source.

• Personality docs
• agent/prompt_builder.py

Memory entries live in editable MEMORY.md and USER.md files, and sessions can be deleted from the local database.

• Memory docs

Skills are editable Markdown files, and the entire runtime can be forked or modified under MIT.

• Skills docs

Owners can enable or disable toolsets, add MCP servers and plugins, and set deny globs and approval modes, including tools Nous does not provide.

• MCP docs
• Plugins docs

`hermes model` switches among Nous Portal, OpenRouter, OpenAI, Anthropic, Bedrock and custom or local endpoints. The skill and tool set is unchanged, provided the model supports tool calling.

• Configuring models docs
• Local models docs

No license check or paid unlock gates modification. Nous subscriptions only cover hosted inference and Tool Gateway services.

• LICENSE
• Nous Portal docs

The gateway enforces per-platform inbound allowlists and DM pairing, and `A2A_TRUSTED_PEERS` limits inbound peers. No runtime allowlist of outbound recipients was found, and `a2a_call` accepts any A2A endpoint.

• .env.example
• SECURITY.md
• A2A docs

A runtime approval gate intercepts dangerous commands and code execution, and owner deny globs block even under --yolo. Writes to instruction files always require approval. The default 'smart' mode lets an auxiliary LLM auto-approve low-risk actions; 'manual' mode always prompts.

• tools/approval.py
• hermes_cli/config_defaults.py (approvals)

The agent is a local process that the owner can interrupt or kill directly, and the gateway can be stopped by the owner's service manager or CLI with no provider involvement.

• CLI docs

Source shows OTLP monitoring export disabled by default and diagnostics uploaded to Nous only on an explicit `hermes debug share`. Content goes to the owner-chosen inference provider. Desktop free-tier onboarding can create a Nous identity at first run, and no network-inspection verification was performed.

• Gateway monitoring docs
• hermes_cli/diagnostics_upload.py
• hermes_cli/anon_auth.py

API keys and OAuth tokens are held locally in .env and auth.json, and site logins in a locally encrypted vault (vault.key). All are inspectable and revocable, and all are included in backups.

• Credential vault docs
• hermes_cli/backup.py (secret files)

All state is local, so deleting ~/.hermes or running `hermes uninstall` removes the agent. Nous retains nothing for self-hosted use; retention by chosen model providers follows their own policies.

• hermes_cli/subcommands/uninstall.py