NousResearch/hermes-agent

Selection

Select when

• You want a standalone agent rather than an add-on inside Claude Code.
• You need the same sessions, skills, and memory across terminal, desktop, browser, and messaging surfaces.
• You want to switch among multiple hosted or custom model providers.
• You need persistent memory and searchable conversation history across sessions.
• You want the agent to create or improve reusable Agent Skills from experience.
• You need scheduled unattended tasks with delivery to messaging platforms.
• You need parallel subagents and multiple local, container, SSH, or cloud execution backends.
• You want to host remote agent execution while using a local desktop client.
• You need an MCP host and plugin middleware around model and tool calls.
• You are migrating supported data and configuration from OpenClaw.

Boundaries

Avoid when

• You specifically need a native Claude Code plugin or hook.
• You need a small repository-local rules file rather than a separate runtime.
• You cannot review or accept the risks of shell, file, network, credential, and scheduled tool access.
• You require all data and inference to remain offline without configuring local-only providers and tools.
• You cannot operate or trust the selected remote host, messaging bridge, model provider, or tool service.
• You require an independently audited sandbox or security model.
• You need a stable, independently verified compatibility matrix across every advertised operating system and backend.
• You want no persistent memory, user profiling, session history, or locally stored credentials.
• You require middleware failures to block execution rather than follow the documented fail-open behavior.
• You cannot accommodate Python, Node.js, Git, ripgrep, ffmpeg, and optional voice or browser dependencies.

Strengths

Capabilities

Risk profile

Risks and limitations

• Uncertainty: only selected first-party README and documentation files were supplied, so core runtime, installers, sandboxing, tools, memory, gateway, credential storage, tests, and update implementations were not directly inspected.
• Uncertainty: repository metadata and embedded evaluation references extend into 2026 relative to this analysis context, so release state, adoption counts, issue counts, and recency cannot be independently reconciled.
• Uncertainty: translated READMEs disagree with the English README about whether six or seven terminal backends exist and omit or add some platform caveats.
• Uncertainty: no first-party file supplied here demonstrates native integration with Claude Code; classification as an alternative or companion is an inference from Hermes operating as its own agent, CLI, gateway, and desktop runtime.
• Repository claims that Hermes is the only agent with a built-in learning loop and that skills self-improve were not independently validated.
• Persistent memory, session search, user modeling, messaging bridges, remote gateways, and hosted providers create privacy exposure that depends on configuration and third-party policies.
• The runtime can execute shell commands, interpolate shell output, access files, call network services, request sudo or secrets, and run unattended cron tasks, creating a broad high-impact permission surface.
• Middleware failures are documented as fail-open, which may be unsuitable when middleware is intended as a mandatory security boundary.
• Tool-request middleware can rewrite commands, paths, URLs, or arguments before guardrails and approvals evaluate them, so enabled plugins require careful trust review.
• Installer and update paths download software and may install Python, Node.js, ripgrep, ffmpeg, Git tooling, application code, and optional dependencies.
• Remote Desktop mode executes agent tools and file operations on the gateway host rather than the display machine, which can surprise users without careful workspace and credential separation.
• No independent security audit, privacy assessment, sandbox escape analysis, compatibility test matrix, or reproducible production-quality benchmark was supplied.

First-party documentation references command approvals, DM pairing, container isolation, isolated subagents, guarded tool execution, encrypted Desktop connection configuration, filtered remote headers, secret and sudo prompts, and candidate probing. However, implementations were not supplied. The agent can run shell and file operations, networked tools, cron jobs, remote execution, plugins, and middleware. Middleware is fail-open, and request middleware mutates values before guardrails and approvals, so plugins are not an appropriate unreviewed trust boundary. Remote hosts, installers, updates, model endpoints, MCP servers, and messaging integrations all expand the attack surface.