Hermes Agent

NousResearch's open-source agent runtime: profile system + auth pool + IM gateway + skill plugin + cron, built for running multi-channel, multi-model automation workflows from one shell.

1. Core Product / Service

Hermes Agent is an open-source agent runtime published by NousResearch (hermes-agent). It can run locally or as a long-lived service on a server.

Core architecture:

• CLI entry: hermes wrapper, backed by hermes_cli.main (Python venv); can run as a background service for the gateway and scheduled jobs.
• Profile system: hermes profile create/use/alias manages multiple independent configurations, supports --clone-all for credential copying; useful for isolating "OAuth subscription vs cheap provider" setups.
• Auth pool: provider credentials are stored centrally as a single source of truth; supports API key / OAuth / PKCE types.
• Model routing tiers (config.yaml):
  • model: primary conversation model (used by hermes chat and the IM gateway)
  • auxiliary.* small tasks (approval / compression / flush_memories / mcp / session_search / skills_hub / web_extract / vision) each specifying provider+model
  • delegation.* subagent invocations routed separately
  • compression.* history compression routed separately
• IM Gateway: native Lark/Feishu integration; Telegram and Slack are connected via channel adapters.
• Cron: the scheduled-jobs file supports per-job provider/model/base_url override (the CLI doesn't expose these fields; the JSON must be edited directly).
• Skill plugin: skills are registered as skills/<category>/<name>/SKILL.md; the scanner doesn't follow symlinks, so real copies are required.

Provider coverage: native support for Anthropic (including OAuth subscription tokens), Moonshot Kimi (kimi-coding / kimi-coding-cn, K2.5/K2.6 already in the built-in model list), DeepSeek direct, openrouter for all remaining models.

2. Target Users & Pain Points

Main users: individual builders and small teams running multiple scheduled jobs, IM channels, and sub-agents who want them wrapped in one runtime.

Pain points / design motivations:

• Terminal coding CLIs such as Claude Code are typically single-session, single-channel, single-model; automation workflows are often multi-channel + multi-cron + multi-model
• Subscription OAuth quota (Anthropic Pro/Max) and pay-per-use need to be burned separately — primary conversation uses the subscription, subagents and compression go to cheap providers
• Multiple IM bots share the same auth pool and skill library, avoiding per-channel reconfiguration

3. Competitive Landscape

Key differentiation: multi-IM channel + cron + multi-model routing combined, with fine-grained routing of subscription OAuth quotas. Claude Code and Aider lack this abstraction layer; OpenClaw is more geared toward team multi-user scenarios; the Anthropic Agent SDK is library-level and requires assembly.

4. Unique Observations

• OAuth subscription + auxiliary separation is the key to cost savings: the main model can use Anthropic OAuth (consuming subscription quota) while auxiliary/delegation/compression point to cheap models on openrouter like deepseek / minimax-m2.7. Subagent 8-concurrency × OAuth easily hits rate limits, so routing delegation to cheap providers is a necessary protection.
• Trap of crons defaulting to the main model: if the main model is OAuth, daily crons will burn subscription quota and can trigger Anthropic anomaly detection — provider/model must be explicitly overridden per job (the CLI doesn't expose these fields). This is an implicit risk that is easy to miss.
• PKCE state = code_verifier trick: hermes stuffs the PKCE code_verifier directly into the OAuth state parameter (agent/anthropic_adapter.py), so the state pasted back from the authorization callback equals the verifier. If the flow dies mid-way the token endpoint can be called manually to exchange for tokens — a rare but clever implementation.
• Skill scanner doesn't follow symlinks: a skill in development must be copied as a real directory into the skills folder to be recognized; ln -s is silently ignored.
• Kimi integration with zero source changes: Moonshot Kimi is natively supported, including automatic base-URL switching (a sk-kimi- key prefix → api.kimi.com/coding, regular sk- → configure base_url), and tool schema sanitize runs automatically. hermes auth add kimi-coding is enough to connect K2.5/K2.6.
• Local patches get overwritten by updates: any local modifications to the upstream repo are overwritten by hermes update, so customizations are best maintained as idempotent patch scripts that can be re-run after each update.
• Tradeoff vs OpenClaw: OpenClaw is better suited for "team multi-user collaboration" scenarios (dmPolicy / allowFrom / multi-user isolation); Hermes fits single-operator setups that need profile + auth pool + cron — see openclaw-hermes-updates.
• Kimi via Hermes path: direct Moonshot connection is cheaper than going through openrouter (OpenRouter may not pass through prompt-caching discounts), but Kimi on OpenRouter is also cheaper than direct Moonshot (third-party providers compete fiercely) — depends on whether the workload is cache-friendly.

5. Financials

N/A — open-source project; no separate commercial product or funding disclosed for the runtime itself.

6. People & Relationships

• Publisher: NousResearch (open-source hermes-agent repo)
• Models commonly routed:
  • Primary conversation: Anthropic Claude (OAuth subscription)
  • Auxiliary / subagent: deepseek / minimax / glm etc. via openrouter
  • Direct: kimi (Moonshot) for coding / long context
• Ecosystem comparison: tinyfish (alternative if not wanting to self-build web automation)

Sources

• Internal research notes — Hermes config architecture, profile, auth pool, OAuth PKCE, cron override risk
• Internal research notes — Kimi/Moonshot native support, base-URL auto-switching, tool schema sanitize
• Internal research notes — Feishu gateway access control + upstream-update override issue
• Internal research notes — Skill scanner doesn't follow symlinks
• Internal research notes