Hermes Agent
v1.2.1
Nous Research's AI agent with 30+ tools, web dashboard, 16 messaging platforms, and all coding agents
One command deploys Nous Research's Hermes Agent on a fresh Linux VPS: an autonomous agent with 30+ native tools, a web dashboard, and connectors for 16 messaging platforms -- plus the four major CLI coding agents (Claude Code, OpenAI Codex, Gemini CLI, OpenCode) preinstalled beside it.
The web dashboard runs as a systemd service bound to localhost and is published through Caddy with HTTPS and basic auth, so you can reach it from anywhere without exposing it to everyone. Tool-loop guardrails ship with hard-stop enabled -- a sane default for unattended and cron-driven sessions.
Security is handled on day one: a default-deny firewall with only SSH and the dashboard ports open, fail2ban, unattended security upgrades, and a nightly backup of the Hermes state (config, sessions, memories, skills, cron, hooks) to /var/backups/agent with 7-day rotation. The Hermes release is pinned and bumped weekly after smoke tests on fresh VMs.
What's included
- Hermes Agent v2026.7.7.2 (pinned) -- 30+ native tools, web dashboard, fast mode, 16 messaging platforms, pluggable context engine
- Claude Code -- Anthropic's CLI coding agent
- OpenAI Codex -- OpenAI's CLI coding agent
- Gemini CLI -- Google's CLI coding agent
- OpenCode -- open-source coding agent
- Caddy reverse proxy with auto-HTTPS and basic auth
- Docker, Go, Rust, Node.js 22, Python + uv
- Playwright with Chromium and Firefox
- ripgrep, fd, fzf, jq, yq, bat, tmux, htop, btop
- Hardening: ufw (22/80/443 only), fail2ban, unattended security upgrades, nightly state backups -- validated on Ubuntu, best-effort on RHEL
After install
- SSH in and switch to the hermes user: su - hermes
- Configure Hermes: hermes setup
- Web dashboard: systemd service hermes-dashboard, bound to 127.0.0.1 behind Caddy basic auth
- Backup/restore: hermes backup, hermes import
- Telegram: set TELEGRAM_ALLOWED_USERS in ~/.hermes/.env BEFORE connecting a bot
- Other agents: claude, codex, gemini, opencode
How the install works
Generated from the install script itself -- these are the exact phases it runs on your server.
- 1.Pre-flight checks
- 2.Configuration
- 3.Creating swap
- 4.Creating user
- 5.Installing system dependencies
- 6.Hardening (firewall, fail2ban, auto-updates)
- 7.Installing Node.js
- 8.Installing pnpm
- 9.Installing Docker
- 10.Installing Go
- 11.Installing Rust
- 12.Installing Python + uv
- 13.Installing Playwright
- 14.Installing Hermes Agent v2026.7.7.2
- 15.Configuring Hermes (guardrails + env)
- 16.Installing additional agents
- 17.Installing Caddy
- 18.Configuring dashboard + Caddy
- 19.Configuring log rotation + nightly backup
Supported Operating Systems
Requirements
- RAM
- 512MB minimum
- Disk
- 5GB minimum
Configuration
| Variable | Default | Description |
|---|---|---|
| VIRTUA_USER | hermes | System user for the agent |
| VIRTUA_PASS | random 24-char | User password (for su - hermes). Auto-generated if not set. |
| HERMES_HOST | server hostname | Hostname or IP for the web dashboard. Caddy reverse proxy with basic auth. Hostnames get auto-HTTPS via Let's Encrypt. |
| HERMES_AUTH_USER | hermes | Username for dashboard basic auth |
| HERMES_AUTH_PASS | random 24-char | Password for dashboard basic auth. Auto-generated if not set. |
Frequently Asked Questions
How do I configure Hermes after the install?
SSH in, switch to the hermes user with "su - hermes", then run "hermes setup" to pick a provider and add an API key. Start the agent with "hermes". The dashboard URL and credentials are printed at the end of the install and stored in /root/.hermes-ssh-credentials.
Can I connect Telegram or another messaging platform?
Yes -- Hermes supports 16 messaging platforms. Before connecting a Telegram bot, set TELEGRAM_ALLOWED_USERS in ~/.hermes/.env. Without the allow-list, anyone who discovers your bot can talk to the agent and run its tools on your server.
What else is installed besides Hermes?
The claude, codex, gemini, and opencode CLIs, plus the full toolchain (Docker, Go, Rust, Node.js, Python with uv, Playwright), so Hermes can delegate coding work to specialist agents on the same machine.
Which servers can I use?
Any fresh Ubuntu 24.04/25.04, Debian 12/13, or Rocky/AlmaLinux 9/10 server with at least 1GB RAM and 10GB disk. Swap is created automatically on small machines, so an entry-level VPS is enough to start.
Is the server safe to leave on the internet?
The installer applies a default-deny firewall with only SSH open, enables fail2ban, and turns on unattended security upgrades. Note that ports published by Docker containers you start yourself bypass the host firewall -- bind them to 127.0.0.1 unless you mean to expose them.
Changelog
- Hermes Agent pinned to release v2026.7.7.2 (weekly pin-bump loop)
- Hermes Agent pinned to release v2026.7.1 (weekly pin-bump loop, smoke-tested)
- Tool-loop guardrails hard-stop enabled by default in ~/.hermes/config.yaml (circuit breaker for unattended/cron sessions)
- Pre-staged ~/.hermes/.env (mode 600) with Telegram allow-list guidance
- One-click hardening: ufw default-deny (22/80/443 only), fail2ban, unattended security upgrades (Ubuntu-validated)
- Nightly backup of Hermes state (config, sessions, memories, skills, cron, hooks) to /var/backups/agent (7-day rotation) and log rotation
- Dashboard systemd unit restarts on failure, bound to 127.0.0.1
- Updated for Hermes Agent 0.9.0 (The Everywhere Release)
- Git submodules support for complete clone
- Pre-created ~/.hermes directory structure
- WhatsApp bridge Node.js dependencies
- New features: web dashboard, fast mode, backup/restore, 16 messaging platforms
- Optional Caddy reverse proxy with basic auth for web dashboard (HERMES_HOST)
- Initial release
- Full dev environment: Docker, Go, Rust, Node.js, Python
- Playwright with Chromium and Firefox
- Developer tools: ripgrep, fd, fzf, jq, bat, tmux, htop