Overview
OpenClaw and Hermes Agent
Hermes Agent (Nous Research, MIT) is a personal-agent platform with a CLI, messaging gateway, desktop app, and plugin system. The comparison below reflects source at 6defe7eb6c (reviewed August 27, 2026), not a live adversarial test or a guarantee about every deployment.
Source findings. Hermes's security policy treats authorized callers within an adapter as equally trusted; their configured tools can include shell access. Its command guards include hardline and configured deny rules before smart review on host-reaching backends. Cron and single-query contexts default to denying commands that require approval, while other non-interactive contexts can still auto-approve. Its Codex adapter reuses a thread within a running agent and supports steering, but starts a new native thread after process restart; user turn input is text-only. A curated MCP bridge exposes Hermes tools to Codex, excluding tools that require the running Hermes agent-loop context.
Historical reports. A user-posted static-analysis audit of Hermes v0.8.0 classified four findings as critical and nine as high; those are the reporter's classifications, not verified current-head vulnerability counts. The cited updater failure and gateway memory leak were closed with maintainer comments recording fixes. Third-party CNA records, including CVE-2026-14625, report vendor non-response; that statement is the CNA's account, not an independent finding of this review.
Hermes's built-in memory store removes entries without source-session tombstones. A later write can add the same fact again; this is a limitation inferred from the store contract, not a reproduced model-driven resurrection. Autonomous memory writes are enabled by default, with an optional approval gate. Hermes also provides atomic credential writes, import-frozen redaction, child-environment scrubbing, and session attribution in its SQLite store.
Both projects support many model providers and channels. Counts are not directly comparable: catalogs mix vendors, authentication routes, transports, and plugin distribution types. OpenClaw's catalog includes Nextcloud Talk, generic Nostr, Twitch, Urbit, and three Zalo connection paths; Hermes's Nostr integration is Buzz-specific and supports self-hosted relays. Check the current catalogs for the exact integration and maintenance model you need.
Integration choices. Hermes includes SimpleX, ntfy, and conversational email adapters (IMAP polling, threaded SMTP replies), plus Home Assistant state-change subscriptions. OpenClaw handles email as automation: the bundled IMAP trigger routes authenticated inbound mail into an isolated session using the selected reader agent's tool policy. The documented setup configures a restricted reader; isolation alone does not restrict its tools. Gmail push provides a separate Gmail automation path, with sending through skills. Hermes's email adapter checks sender authorization and authentication by default, then routes messages into per-sender conversations with the configured core toolset. Both projects support third-party integrations; evaluate the adapter, its defaults, and who maintains it rather than inferring completeness from a feature count.
Hermes also has opt-in session pruning and OTLP gateway monitoring export, separate from its Langfuse tracing. Its updater fast-forwards a selected Git branch and can roll back when critical-file syntax checks fail. These controls should not be omitted when comparing OpenClaw's release channels and audit architecture.
| Property | OpenClaw | Hermes Agent (6defe7eb6c) |
|---|---|---|
| Trust boundary | Gateway-owned authority; configured sandbox, node, or cloud-worker execution; sandboxing off by default | Parent-owned tool dispatch; terminal, file, and generated-Python work can use remote backends |
| Policy gate | Structural tool policy and deterministic denial; optional review and approval layers | Smart review of flagged commands behind hardline/configured denials on host-reaching backends; cron and one-shot defaults deny flagged commands, other headless paths may auto-approve |
| Vendor harnesses | Codex app-server, Copilot SDK, Claude Code CLI as native runtimes | Opt-in Codex loop with steering and a curated MCP tool bridge; text-only turn input, no native resume after restart; Copilot API and ACP adapters |
| Code execution | JavaScript/TypeScript Code Mode in QuickJS, with policy checked on host tool calls | Python in a local child or configured terminal backend, with bounded tool RPCs through the parent |
| Roles and multi-user | Configured person-level role ceilings and default role; scopes and session attribution; experimental per-tenant fleet cells | Equal trust within an adapter's authorized set; slash-command controls and separate profiles, including profile multiplexing |
| Secrets | SecretRefs, isolatable-owner degradation, protected store values and egress sentinels; ingress-auth failures stop startup | Environment/vault credentials, scoped profile resolution, optional Docker token-injection proxy; no general transcript-store redaction boundary |
| Isolated IMAP reader sessions with operator-configured tool restrictions; send via skills | Sender authorization/authentication by default; IMAP/SMTP chat with configured core tools and per-sender conversations | |
| Upgrades | Four channels, immutable package versions, schema guards, release-validation workflow | Git branch fast-forward, main by default; syntax-check rollback; Docker :latest follows main |
| Memory provenance | Tracked session origins, trust gating, bounded admission policy, attributable purge and forgotten-session records | Built-in string entries without source-session lineage or deletion tombstones; autonomous writes default on, optional approval |
| Audit | Metadata ledger with 30-day query cutoff and row caps; best-effort collection and separate OTel diagnostics | Session attribution; opt-in session pruning; Langfuse traces and separate OTLP gateway monitoring |
| Worker observability | Terminal, Gateway dev-server portals, brokered worker desktop | Terminal, desktop previews, SSH-forwarded dev servers, optional Camofox browser VNC |
| Plugins | In-process and unsandboxed; manifest validation, SDK contracts, install trust checks | In-process and unsandboxed; Python registration APIs, desktop SDK, declaration-based consent |
| Security record | Public repository advisories and documented trust model; counts are not a safety score | Third-party CVEs and historical user reports; no public repository advisories at the review date |
| Governance | OpenClaw Foundation, MIT, public maturity scorecard | Nous Research, venture-backed, MIT |
| Funding and revenue | Independent 501(c)(3) funded by donations; no paid tier, hosted service, or token; the only default Foundation-bound request is a version check | Venture-funded (Paradigm-led Series A); paid Nous Portal tiers ($20 to $200 per month, per TechCrunch) presented in the README and setup |
In the separately reviewed August 28, 2026 snapshot, Hermes defaults to persistent kernels for local Python execution and attempts persistent kernels for remote execution, falling back to per-call execution when a remote kernel is unavailable. The former code_execution.kernel_mode setting is ignored. Remote reuse also depends on task identity; reset: true discards kernel state, and state is not restored after Hermes restarts.
