Quick Verdict
Hermes Agent is an MIT-licensed autonomous agent built by Nous Research. As of July 21, 2026, the official site identifies v0.19.0 as the current release. It can run on a personal computer, server, container, or cloud sandbox and combine a terminal, messaging gateway, persistent memory, reusable skills, MCP tools, subagents, and scheduled jobs. Its value is continuity: one agent can retain project context and reuse procedures instead of starting every conversation from zero.
That capability creates a larger risk surface than ordinary chat. Hermes can run commands, write files, load third-party skills, call external services, and execute cron jobs without someone watching every step. Command approvals, path guards, and credential filters are useful defense in depth, but the official security documentation does not present them as complete isolation. A local terminal runs with the current OS user’s authority, and shell commands can bypass write-tool protections. Containers, cloud sandboxes, virtual machines, or separate hosts are the meaningful boundaries for untrusted execution.
Best For
Hermes is best for developers, researchers, and automation teams that can manage containers, API credentials, logs, updates, and least-privilege access. It suits users who want inspectable source code and model-provider choice. People who want a low-maintenance assistant should compare ChatGPT. Teams that prefer deterministic visual automation may be better served by n8n, while Dify is a stronger comparison for managed AI applications and knowledge workflows. Do not give Hermes production credentials unless your team can operate a genuine sandbox and review what it executes.
Key Features
- Persistent memory and skills: Searches prior sessions, retains user and project context, and converts procedures into reusable skills.
- Tool execution: Provides terminal, web, browser, image, and voice capabilities, with MCP support for additional tools.
- Messaging gateway: Works through the CLI and multiple messaging services, including Telegram, Discord, Slack, WhatsApp, Signal, and email.
- Subagent delegation: Creates separate conversations and execution environments for parallel workstreams.
- Scheduled automation: Built-in cron can run recurring jobs and deliver results to messaging channels.
- Provider choice: Self-hosted Hermes can use Nous Portal, OpenRouter, OpenAI, or compatible endpoints.
Use Cases
Use Hermes inside an isolated container to inspect code, run tests, and prepare a patch for human review. It can collect public information on a schedule, produce recurring reports, or preserve a research procedure as a skill. Subagents can divide retrieval, comparison, and drafting work. MCP integrations can expose specialized services, but each server should receive only the tools, directories, and credentials required for its task. Production changes should remain approval-gated and auditable.
Pricing
| Option | Price | What it includes |
|---|---|---|
| Self-hosted Hermes Agent | Free | MIT software; infrastructure, model, search, and third-party API costs are separate |
| Nous Portal Free | $0/month | Free models, standard rate limits, no monthly credits |
| Nous Portal Plus | $20/month | $22 monthly credits, paid model catalog, hosted tools, higher limits |
| Nous Portal Super | $100/month | $110 monthly credits and a higher rollover cap |
| Nous Portal Ultra | $200/month | $220 monthly credits and the highest listed rollover cap |
Portal is an optional model and hosted-tool gateway, not a requirement for the open-source agent. Official pages can show different model counts as the catalog changes, so rely on the live billing and model pages before subscribing.
Pros
- MIT-licensed, inspectable, self-hostable software with provider choice.
- A broad combination of memory, skills, tools, messaging, delegation, and scheduling.
- Detailed official documentation for approvals, credential filtering, SSRF controls, and execution backends.
- Supports moving command execution off the host into containers, cloud sandboxes, or separate machines.
Cons
- Tools, MCP servers, and skills increase prompt-injection, credential, and software-supply-chain exposure.
- Cron repeats actions while unattended, so a bad instruction or excessive permission can have persistent effects.
- Local execution has no OS boundary; approvals and blocklists are not a hostile-code sandbox.
- Nous Portal’s policy permits broad processing of workflow data by default; Privacy Mode must be enabled and is prospective.
- Self-hosting still requires infrastructure, upgrades, backups, observability, and incident response.
Nous says its services may collect prompts, instructions, uploads, outputs, conversation history, tool interactions, telemetry, usage logs, and traces, and may disclose service data to model, infrastructure, analytics, research, and other providers for operating, improving, evaluating, training, or fine-tuning related technologies. Privacy Mode limits storage and use of inference payloads for training, improvement, and support after activation, subject to security, legal, and operational exceptions. It does not retroactively remove previously processed data, and operational metadata may still be retained.
Alternatives
| Alternative | Better for | Main difference from Hermes |
|---|---|---|
| OpenClaw | Self-hosted personal agents and messaging | Similar long-running-agent category; evaluate its permissions and operations separately |
| n8n | Visual, deterministic business automation | More explicit workflow nodes and less open-ended autonomy |
| Dify | Team AI applications and knowledge bases | More application management, less centered on a resident personal agent |
| ChatGPT | General assistance with minimal setup | Lower operations burden, less self-hosting and execution control |
FAQ
Is Hermes Agent free and open source?
Yes. The agent is MIT-licensed. Models, hosting, and external tools can still create usage costs.
Do I need a Nous Portal subscription?
No. Portal combines models and hosted tools under one account, but Hermes can use other providers and separately configured tools.
Does self-hosting keep every prompt local?
No. The agent code may run locally while prompts, files, or tool results are sent to whichever model and service providers you configure.
Does Privacy Mode erase earlier training use?
No. Nous states that the control may operate prospectively and may not affect information processed before activation.
Can command approval replace a sandbox?
No. Approval reduces accidental damage. Untrusted execution needs an OS-level boundary such as a container, VM, cloud sandbox, or separate host.
Why are skills and cron risky?
Skills can introduce instructions, code, and credential requirements. Cron executes repeatedly without supervision. Review sources, minimize permissions, and test both in isolation.
Bottom Line
Hermes Agent v0.19.0 is a capable, flexible open-source resident agent, but its usefulness comes directly from powers that can expose files, credentials, and external systems. Start in an isolated environment without production secrets, enable only necessary tools, review every skill and scheduled job, and understand Portal privacy settings before sending sensitive content. If you cannot continuously operate those controls, a narrower managed product is the safer choice.