--- summary: "Source-by-source comparison of OpenClaw and Hermes Agent at the reviewed August 2026 snapshots, with the property table" title: "OpenClaw and Hermes Agent" read_when: - You want the side-by-side property table for OpenClaw and Hermes Agent - You need the source citations behind the comparison claims - You are checking which findings are review observations rather than tests --- Hermes Agent (Nous Research, MIT) is a personal-agent platform with a CLI, messaging gateway, desktop app, and plugin system. The comparison below reflects source at [`6defe7eb6c`](https://github.com/NousResearch/hermes-agent/tree/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70) (reviewed August 27, 2026), not a live adversarial test or a guarantee about every deployment. **Source findings.** Hermes's [`security policy`](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/SECURITY.md) treats authorized callers within an adapter as equally trusted; their configured tools can include shell access. Its [command guards](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/tools/approval.py#L4564) include hardline and configured deny rules before smart review on host-reaching backends. Cron and single-query contexts default to denying commands that require approval, while other non-interactive contexts can still auto-approve. Its [Codex adapter](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/agent/transports/codex_app_server_session.py) reuses a thread within a running agent and supports steering, but starts a new native thread after process restart; user turn input is text-only. A [curated MCP bridge](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/agent/transports/hermes_tools_mcp_server.py) exposes Hermes tools to Codex, excluding tools that require the running Hermes agent-loop context. **Historical reports.** A [user-posted static-analysis audit of Hermes v0.8.0](https://github.com/NousResearch/hermes-agent/issues/7826) classified four findings as critical and nine as high; those are the reporter's classifications, not verified current-head vulnerability counts. The cited [updater failure](https://github.com/NousResearch/hermes-agent/issues/32384) and [gateway memory leak](https://github.com/NousResearch/hermes-agent/issues/25315) were closed with maintainer comments recording fixes. Third-party CNA records, including [CVE-2026-14625](https://nvd.nist.gov/vuln/detail/CVE-2026-14625), report vendor non-response; that statement is the CNA's account, not an independent finding of this review. Hermes's [built-in memory store](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/tools/memory_tool.py) removes entries without source-session tombstones. A later write can add the same fact again; this is a limitation inferred from the store contract, not a reproduced model-driven resurrection. Autonomous memory writes are enabled by default, with an optional approval gate. Hermes also provides atomic credential writes, import-frozen redaction, child-environment scrubbing, and session attribution in its SQLite store. Both projects support many [model providers](/providers) and [channels](/channels). Counts are not directly comparable: catalogs mix vendors, authentication routes, transports, and plugin distribution types. OpenClaw's catalog includes Nextcloud Talk, generic Nostr, Twitch, Urbit, and three Zalo connection paths; Hermes's Nostr integration is Buzz-specific and supports self-hosted relays. Check the current catalogs for the exact integration and maintenance model you need. **Integration choices.** Hermes includes SimpleX, ntfy, and conversational email adapters (IMAP polling, threaded SMTP replies), plus Home Assistant state-change subscriptions. OpenClaw handles email as automation: the bundled [IMAP trigger](/automation/imap) routes authenticated inbound mail into an isolated session using the selected reader agent's tool policy. The documented setup configures a restricted reader; isolation alone does not restrict its tools. [Gmail push](/automation/cron-jobs#gmail-pubsub-integration) provides a separate Gmail automation path, with sending through skills. Hermes's [email adapter](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/plugins/platforms/email/adapter.py#L1028) checks sender authorization and authentication by default, then routes messages into per-sender conversations with the configured core toolset. Both projects support third-party integrations; evaluate the adapter, its defaults, and who maintains it rather than inferring completeness from a feature count. Hermes also has [opt-in session pruning](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/hermes_cli/config_defaults.py#L3256) and [OTLP gateway monitoring export](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/agent/monitoring/otlp_exporter.py), separate from its Langfuse tracing. Its [updater](https://github.com/NousResearch/hermes-agent/blob/6defe7eb6c462bb784d1f27f5afe7ca4b627fc70/hermes_cli/update_cmd.py#L8000) fast-forwards a selected Git branch and can roll back when critical-file syntax checks fail. These controls should not be omitted when comparing OpenClaw's release channels and audit architecture. | Property | OpenClaw | Hermes Agent (`6defe7eb6c`) | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Trust boundary | Gateway-owned authority; configured sandbox, node, or cloud-worker execution; sandboxing off by default | Parent-owned tool dispatch; terminal, file, and generated-Python work can use remote backends | | Policy gate | Structural tool policy and deterministic denial; optional review and approval layers | Smart review of flagged commands behind hardline/configured denials on host-reaching backends; cron and one-shot defaults deny flagged commands, other headless paths may auto-approve | | Vendor harnesses | Codex app-server, Copilot SDK, Claude Code CLI as native runtimes | Opt-in Codex loop with steering and a curated MCP tool bridge; text-only turn input, no native resume after restart; Copilot API and ACP adapters | | Code execution | JavaScript/TypeScript Code Mode in QuickJS, with policy checked on host tool calls | Python in a local child or configured terminal backend, with bounded tool RPCs through the parent | | Roles and multi-user | Configured person-level role ceilings and default role; scopes and session attribution; experimental per-tenant fleet cells | Equal trust within an adapter's authorized set; slash-command controls and separate profiles, including profile multiplexing | | Secrets | SecretRefs, isolatable-owner degradation, protected store values and egress sentinels; ingress-auth failures stop startup | Environment/vault credentials, scoped profile resolution, optional Docker token-injection proxy; no general transcript-store redaction boundary | | Email | Isolated IMAP reader sessions with operator-configured tool restrictions; send via skills | Sender authorization/authentication by default; IMAP/SMTP chat with configured core tools and per-sender conversations | | Upgrades | Four channels, immutable package versions, schema guards, release-validation workflow | Git branch fast-forward, main by default; syntax-check rollback; Docker `:latest` follows main | | Memory provenance | Tracked session origins, trust gating, bounded admission policy, attributable purge and forgotten-session records | Built-in string entries without source-session lineage or deletion tombstones; autonomous writes default on, optional approval | | Audit | Metadata ledger with 30-day query cutoff and row caps; best-effort collection and separate OTel diagnostics | Session attribution; opt-in session pruning; Langfuse traces and separate OTLP gateway monitoring | | Worker observability | Terminal, Gateway dev-server portals, brokered worker desktop | Terminal, desktop previews, SSH-forwarded dev servers, optional Camofox browser VNC | | Plugins | In-process and unsandboxed; manifest validation, SDK contracts, install trust checks | In-process and unsandboxed; Python registration APIs, desktop SDK, declaration-based consent | | Security record | Public repository advisories and documented trust model; counts are not a safety score | Third-party CVEs and historical user reports; no public repository advisories at the review date | | Governance | OpenClaw Foundation, MIT, public maturity scorecard | Nous Research, venture-backed, MIT | | Funding and revenue | Independent 501(c)(3) funded by donations; no paid tier, hosted service, or token; the only default Foundation-bound request is a version check | Venture-funded (Paradigm-led Series A); paid Nous Portal tiers ($20 to $200 per month, per TechCrunch) presented in the README and setup | In the separately reviewed August 28, 2026 snapshot, Hermes defaults to [persistent kernels for local Python execution](https://github.com/NousResearch/hermes-agent/blob/306db2776c6b6f1acc85c31c4dabba3263f0e9fd/tools/code_execution_tool.py#L2070) and [attempts persistent kernels for remote execution](https://github.com/NousResearch/hermes-agent/blob/306db2776c6b6f1acc85c31c4dabba3263f0e9fd/tools/code_execution_tool.py#L1273), falling back to per-call execution when a remote kernel is unavailable. The former `code_execution.kernel_mode` setting is ignored. Remote reuse also depends on task identity; `reset: true` discards kernel state, and state is not restored after Hermes restarts.