Hermes Agent

On 23 October 2026, Hermes published stable v0.22.5. It removed the built-in hermes mcp serve command, leaving external clients with a manual launcher migration. A smaller core still leaves someone responsible for keeping the integration working.

Where it stands, 2026-10-24

Before upgrading, repair any external MCP launcher and preserve ignored worktree files. Gateway jobs can continue after the terminal closes, so set a runtime budget. Avoid retired PyPI/Homebrew installs, the unofficial npm bridge and terminal-only isolation for hostile code.

Experimental MCP event subscriptions ship in stable but require events: true; the MCP server’s general tool bridge requires --tools. Canary changes are listed separately below, and v0.22.5 did not replace standalone Desktop installers.

Channel. Use stable v0.22.5, published on 23 October 2026. Download the linked v0.22.5 installer as install.sh, then run bash install.sh --commit bf0203a794a07aac3ff764972ab9087baa4e4f4e. Alternatively, pin Docker nousresearch/hermes-agent@sha256:9c5561579f3ffdf333401797094ac3a743738d6c25d40f4331c7bf77b694238d. Fresh official installs now select stable; existing official-source installs can run hermes update --set-channel stable, including to leave an ahead-of-stable checkout. Avoid retired PyPI/Homebrew distribution and npm’s unofficial bridge. Canary and main contain later source changes. The browser removals, remembered MCP approvals and catalog version enforcement described under ‘Audit adapters before choosing canary’ are not in stable v0.22.5.

What to repair before upgrading

Update each external MCP launcher. Install mcp-serve in its launch profile, then replace client arguments ["mcp", "serve"] with ["mcp-serve"]. Check every external client before rollout.

Its conversation tools still read history, send through linked accounts and answer approvals; the general tool bridge stays off without --tools.

Save ignored files before automatic worktree cleanup. In v0.22.5, idle dirty or unpushed worktrees can be archived and removed by default; ignored files are deleted without entering the archive. Inspect hermes worktree prune --dry-run; set worktrees.archive_dirty: false if dirty trees must stay, and preserve ignored state separately. Archive retention defaults to 30 days. Session auto-deletion separately defaults off again; saved choices still govern existing installations. Set worktree and session retention independently.

Check the delivered Desktop bundle. v0.22.5 did not replace standalone Desktop installers. Its selected source and install/update checks passed, while native package smoke entries were skipped and no new native packages were listed. Before rollout, test startup, existing sessions and required plugins on the delivered artifact.

The Desktop source update to simple-git 4.0.2 also changes SSH/askpass environment forwarding; test custom Git authentication on the installed bundle.

Who owns unattended work

Follow the job after closing the terminal. Classic chat, chat -q and -z attach to gateway execution; EOF or detach leaves the job running. Track the persisted session identity and explicit completion. Set agent.run_budget_seconds in configuration: the main agent has no default turn or wall-clock cap, and this client rejects --run-budget. Before allowing an interrupted client to resubmit work, decide who reconciles it.

Test script approval with the viewer you will use. A local session’s own foreground turn can skip whole-script execute_code approval with an attached approval-capable viewer and notifier, outside delegated-child context. Injected, automation, delegated and detached turns do not gain this exemption; individual terminal guards remain, while direct Python effects bypass them. Confine the process to contain direct Python effects.

Unattended gateway turns without an answering surface use their unattended approval mode, which defaults to denial, as do cron and single-query modes. Do not generalize those defaults to every execution path.

Approve an event’s instructions before retiring its polling wrapper. Opt-in events: true enables experimental MCP subscriptions whose approved instructions and result destination become a signed webhook route; occurrences start unattended runs while the gateway is running. Test duplicates, revocation, renewal and lapse handling first. Poll/push delivery and secondary multiplexed-profile subscriptions are unsupported. Keep a person responsible for which events may trigger which effects.

Configure paid-tool consent before delegating. Hermes reserves declared MCP costs before dispatch and requires consent above the server’s per-chat threshold, including for trusted servers. Meshy’s catalog supplies estimates and a 200-credit threshold. Check vendor billing separately: accounting is in memory, restarts lose the tally, and undeclared or zero-priced tools have no cost gate. An operator can approve excess; set a separate account spending limit where required.

Treat a delegation route as a credential grant. The optional advanced-delegation plugin offers named model and profile routes; a profile route uses that profile’s credentials, skills and terminal policy. Test one completed handback before replacing a supervisor that chooses those routes. Review what the pinned plugin can execute and which credentials and terminal permissions each destination profile grants.

Test memory recovery before leaving a long job unattended. External memory has two independent admission gates per process and home/provider, for prefetch and background work, each capped at 16 in-flight calls; closed gates allow at most one recovery probe per 60 seconds while below that cap. Together they can retain up to 32 calls; Python cannot cancel the stuck threads. Test timeout, recovery and shutdown with the chosen provider before trusting it with long jobs.

Keep hostile code outside the host process. On Linux with non-root Hermes and rootful, non-remapped Docker, output handback attempts to strip setuid/setgid and conditionally clear file capabilities, including persistent-container paths. Check cleanup warnings before running outputs on the host; cleanup is bounded and cannot contain a malicious root process still modifying the mount. Narrow explicit lsp.trusted_workspaces roots, which also trust descendants, as part of confining the full process.

Start a trial with the right data route. The welcome trial is claimed once per OS user on that computer through first-install local Desktop onboarding; once claimed, it can serve the install’s other surfaces while guest access is allowed, including cron and Kanban model resolution. Check the connected account and model route before adding work data. Connector results can require no training or zero retention; Nous routes carry those constraints and refuse without fallback when denied. Keep that refusal intact.

What changes only in canary

Audit adapters before choosing canary. The 24 October canary source, v0.22.5+canary.20261024T065630Z, includes legacy browser-tool removal and removal of /v1/browser-control, /v1/artifacts and browser.controller.*. The configuration migration drops browser.extension_control; the documented replacement uses browser.cdp_url. Audit tool names and transports.

Canary also remembers MCP session/permanent approvals per tool and enforces catalog minimum versions before plugin install/update. On stable, compare catalog requirements manually and expect session/always answers to prompt again on later write-capable calls to an untrusted MCP server.

What is unresolved

• Native delivery. Dated Store-client and APT package identities, followed by installation and migration results, would settle delivery beyond the recorded build artifacts. Accepting a downloadable canary also requires a source-linked bundle and a target-platform trial.
• File-tool confinement. Require a stable tag containing canary’s backend routing declaration, a plugin pin adopting it, and denied-path read/write/search probes. The v0.22.5 Bubblewrap catalog says file tools still run on the host.
• Kanban handbacks. The automation repair leaves producer/card work outstanding. To settle that report, identify the exact failing card/session/version and replay it successfully.
• Memory quality. Establishing gains beyond memory lifecycle repair would require controlled task-outcome or recall tests.
• Role enforcement. Require server-side allow/deny tests for dashboard OIDC groups and hosted connector calls before relying on them.
• Exposure ranges. Issue-specific advisories with explicit ranges would settle the Git-filter and webhook exposure questions.