OpenClaw and Hermes Agent

Hermes Agent (Nous Research, MIT) is a personal-agent platform with a CLI, messaging gateway, desktop app, and plugin system. The comparison below reflects source at 6defe7eb6c (reviewed August 27, 2026), not a live adversarial test or a guarantee about every deployment.

Source findings. Hermes's security policy treats authorized callers within an adapter as equally trusted; their configured tools can include shell access. Its command guards include hardline and configured deny rules before smart review on host-reaching backends. Cron and single-query contexts default to denying commands that require approval, while other non-interactive contexts can still auto-approve. Its Codex adapter reuses a thread within a running agent and supports steering, but starts a new native thread after process restart; user turn input is text-only. A curated MCP bridge exposes Hermes tools to Codex, excluding tools that require the running Hermes agent-loop context.

Historical reports. A user-posted static-analysis audit of Hermes v0.8.0 classified four findings as critical and nine as high; those are the reporter's classifications, not verified current-head vulnerability counts. The cited updater failure and gateway memory leak were closed with maintainer comments recording fixes. Third-party CNA records, including CVE-2026-14625, report vendor non-response; that statement is the CNA's account, not an independent finding of this review.

Hermes's built-in memory store removes entries without source-session tombstones. A later write can add the same fact again; this is a limitation inferred from the store contract, not a reproduced model-driven resurrection. Autonomous memory writes are enabled by default, with an optional approval gate. Hermes also provides atomic credential writes, import-frozen redaction, child-environment scrubbing, and session attribution in its SQLite store.

Both projects support many model providers and channels. Counts are not directly comparable: catalogs mix vendors, authentication routes, transports, and plugin distribution types. OpenClaw's catalog includes Nextcloud Talk, generic Nostr, Twitch, Urbit, and three Zalo connection paths; Hermes's Nostr integration is Buzz-specific and supports self-hosted relays. Check the current catalogs for the exact integration and maintenance model you need.

Integration choices. Hermes includes SimpleX, ntfy, and conversational email adapters (IMAP polling, threaded SMTP replies), plus Home Assistant state-change subscriptions. OpenClaw handles email as automation: the bundled IMAP trigger routes authenticated inbound mail into an isolated session using the selected reader agent's tool policy. The documented setup configures a restricted reader; isolation alone does not restrict its tools. Gmail push provides a separate Gmail automation path, with sending through skills. Hermes's email adapter checks sender authorization and authentication by default, then routes messages into per-sender conversations with the configured core toolset. Both projects support third-party integrations; evaluate the adapter, its defaults, and who maintains it rather than inferring completeness from a feature count.

Hermes also has opt-in session pruning and OTLP gateway monitoring export, separate from its Langfuse tracing. Its updater fast-forwards a selected Git branch and can roll back when critical-file syntax checks fail. These controls should not be omitted when comparing OpenClaw's release channels and audit architecture.

Property	OpenClaw	Hermes Agent (6defe7eb6c)
Trust boundary	Gateway-owned authority; configured sandbox, node, or cloud-worker execution; sandboxing off by default	Parent-owned tool dispatch; terminal, file, and generated-Python work can use remote backends
Policy gate	Structural tool policy and deterministic denial; optional review and approval layers	Smart review of flagged commands behind hardline/configured denials on host-reaching backends; cron and one-shot defaults deny flagged commands, other headless paths may auto-approve
Vendor harnesses	Codex app-server, Copilot SDK, Claude Code CLI as native runtimes	Opt-in Codex loop with steering and a curated MCP tool bridge; text-only turn input, no native resume after restart; Copilot API and ACP adapters
Code execution	JavaScript Code Mode with Node or QuickJS, typed tool documentation, and policy checked on host tool calls	Python in a local child or configured terminal backend, with bounded tool RPCs through the parent
Roles and multi-user	Configured person-level role ceilings and default role; scopes and session attribution	Equal trust within an adapter's authorized set; slash-command controls and separate profiles, including profile multiplexing
Secrets	SecretRefs, isolatable-owner degradation, protected store values and egress sentinels; ingress-auth failures stop startup	Environment/vault credentials, scoped profile resolution, optional Docker token-injection proxy; no general transcript-store redaction boundary
Email	Isolated IMAP reader sessions with operator-configured tool restrictions; send via skills	Sender authorization/authentication by default; IMAP/SMTP chat with configured core tools and per-sender conversations
Upgrades	Four channels, immutable package versions, schema guards, release-validation workflow	Git branch fast-forward, main by default; syntax-check rollback; Docker :latest follows main
Memory provenance	Tracked session origins, trust gating, bounded admission policy, attributable purge and forgotten-session records	Built-in string entries without source-session lineage or deletion tombstones; autonomous writes default on, optional approval
Audit	Metadata ledger with 30-day query cutoff and row caps; best-effort collection and separate OTel diagnostics	Session attribution; opt-in session pruning; Langfuse traces and separate OTLP gateway monitoring
Worker observability	Terminal, Gateway dev-server portals, brokered worker desktop	Terminal, desktop previews, SSH-forwarded dev servers, optional Camofox browser VNC
Plugins	In-process and unsandboxed; manifest validation, SDK contracts, install trust checks	In-process and unsandboxed; Python registration APIs, desktop SDK, declaration-based consent
Security record	Public repository advisories and documented trust model; counts are not a safety score	Third-party CVEs and historical user reports; no public repository advisories at the review date
Governance	OpenClaw Foundation, MIT, public maturity scorecard	Nous Research, venture-backed, MIT
Funding and revenue	Independent 501(c)(3) funded by donations; no paid tier, hosted service, or token; the only default Foundation-bound request is a version check	Venture-funded (Paradigm-led Series A); paid Nous Portal tiers ($20 to $200 per month, per TechCrunch) presented in the README and setup

In the separately reviewed August 28, 2026 snapshot, Hermes defaults to persistent kernels for local Python execution and attempts persistent kernels for remote execution, falling back to per-call execution when a remote kernel is unavailable. The former code_execution.kernel_mode setting is ignored. Remote reuse also depends on task identity; reset: true discards kernel state, and state is not restored after Hermes restarts.