Hermes Agent vs OpenClaw: Architecture, Skills, Security and Fit

Hermes Agent vs OpenClaw is a choice between two MIT-licensed, self-hosted personal agents. OpenClaw, stewarded by the OpenClaw Foundation, is organised around a gateway that connects many chat channels and devices. Hermes Agent, built by Nous Research, is organised around a learning loop that turns experience into reusable skills and memory. Both assume one operator or a trusted team.

Both projects rank among the most-starred repositories on GitHub, both ship releases every few days, and each has been changing fast enough that comparisons from the spring are already stale. Everything below was checked on 27 September 2026 against the OpenClaw repository and docs, the Hermes Agent repository and docs, and the GitHub Advisory Database. For background on the category itself, see what an AI agent harness is.

The comparison at a glance

Architecture: a gateway control plane versus an agent runtime

OpenClaw’s centre of gravity is the Gateway, a long-running process that owns sessions, tools, events and channel connections, serving WebSocket and HTTP on a single port. The Control UI, CLI, TUI and native apps for macOS, iOS, Android, Windows and Linux are all clients of it. Paired devices act as nodes, which lets the gateway invoke device capabilities such as running a command on a paired Mac. Models and even other agent harnesses such as Codex are plugins behind the gateway, and one gateway can host several agents, each with its own tool profile and sandbox settings.

Hermes Agent’s centre of gravity is the agent loop. You meet it as an interactive terminal UI, a desktop app, or a messaging gateway that serves every chat platform from one process, and in Docker it can also expose an OpenAI-compatible API on port 8642. The notable design choice is the terminal backend: where commands run is separate from where the agent runs. The same agent can execute on the host, in a hardened container, over SSH on another server, or in serverless sandboxes on Modal, Daytona or Vercel that hibernate when idle. Nous describes this as talking to the agent from Telegram while it works on a cloud VM.

The practical difference: OpenClaw gives you one place to set policy for many channels, agents and devices on a host. Hermes gives you one agent whose execution environment you can move around.

Skills, learning and memory

The two projects have converged on skills. Both store them as folders with a SKILL.md file and YAML frontmatter, and both follow the open Agent Skills format, so a well-written skill often ports between them. Our explainer on agent skills covers the format in more depth.

The differences are in where skills come from and how they change:

• Learning. Self-improvement is Hermes Agent’s headline feature. It creates a skill after a complex task, refines skills while using them, and nudges itself to save durable facts. By default it writes skills freely; setting skills.write_approval: true stages every change for review. OpenClaw added a comparable Skill Workshop, whose self-learning mode defaults to auto, with propose available to hold drafts for approval.
• Registries. OpenClaw installs from ClawHub explicitly with openclaw skills install and can verify a skill’s trust envelope. Hermes Agent’s Skills Hub pulls from several sources, including ClawHub, scans every hub install, gives official skills built-in trust, and refuses to let --force override a dangerous verdict.
• Memory. Hermes Agent keeps two small files injected at session start, MEMORY.md at 2,200 characters and USER.md at 1,375, plus full-text session search with LLM summaries for recall. OpenClaw writes USER.md, MEMORY.md, dated daily notes and an optional dream diary into the workspace, with search and pluggable backends such as Honcho or LanceDB.

Switching is supported in one direction: hermes claw migrate imports an OpenClaw persona, memories, user-created skills, command allowlist, messaging settings and selected API keys, with a dry-run mode to preview the result.

Channels, models and local inference

OpenClaw covers more ground on messaging. Its README lists Discord, iMessage, Slack, Teams, Telegram, WhatsApp and more than twenty other services, plus native companion apps. Hermes Agent covers the major chat platforms, email and Home Assistant, which is enough for most personal setups.

On models, both are provider-agnostic. OpenClaw ships provider pages for dozens of hosted services alongside local runtimes. Hermes Agent supports Nous Portal, OpenRouter, Anthropic, OpenAI, many API-key providers, and any server that implements /v1/chat/completions.

Local inference is where the projects differ in detail:

• OpenClaw talks to Ollama through its native /api/chat endpoint and warns that the OpenAI-compatible /v1 path makes tool calling unreliable. vLLM, LM Studio and SGLang have their own providers.
• Hermes Agent uses Ollama’s OpenAI-compatible endpoint as a custom provider and says agentic work needs at least 64,000 tokens of context. Its desktop app can install and manage a llama.cpp runtime that sizes models to your GPU.

Both connect to external tools through the Model Context Protocol. OpenClaw applies its normal tool policy to MCP tools, and Hermes lets you filter which tools each server exposes. Our local LLM setup guide walks through each configuration step by step.

Sandboxing and security defaults

The two projects start from different defaults, and both are explicit about their limits.

OpenClaw binds the gateway to loopback, gives unknown senders a pairing code instead of an answer, and allowlists groups. For a trusted operator, though, host commands run without approval prompts, and tool sandboxing stays off until configured. Exec approvals, named operator roles and a metadata-only audit ledger are available, and openclaw security audit checks a config for drift. The docs define one trust domain per gateway and recommend separate gateways for users who do not trust each other.

Hermes Agent denies every messaging user until you allowlist them or approve a pairing code. On the default local backend it checks commands against dangerous patterns and asks for approval, using an auxiliary model to auto-approve low-risk cases in the default smart mode. Container backends skip that check because the container is treated as the boundary, and the Docker backend trims Linux capabilities to a short list, blocks privilege escalation and caps process counts. Its security policy calls Hermes a single-tenant personal agent and states that operating-system isolation is the only security boundary against an adversarial model.

NVIDIA’s NemoClaw reference stack supports both, running either agent inside an OpenShell sandbox with policy on file, network and process access.

Security track record

As of 27 September 2026, OpenClaw’s repository lists 722 published security advisories, 14 of them critical and 249 high, including CVE-2026-25253, a one-click token theft through the Control UI. Hermes Agent’s repository shows no published repository advisories, and the GitHub Advisory Database holds 10 reviewed entries for its Python package: one high (CVE-2026-53869, a DNS rebinding issue in WebSocket endpoints, fixed in 0.16.0), six medium and three low.

Read those numbers with care. OpenClaw has a larger attack surface, far more users and researchers looking at it, and a practice of publishing an advisory per fix. Its ClawHub registry was also the target of the ClawHavoc malicious-skill campaign, and because Hermes can install from ClawHub too, the same vetting applies to both. Our OpenClaw security review covers the incidents and a hardening baseline.

Licensing, stewardship and ecosystem

Both codebases are MIT-licensed, so the software choice carries no license risk. Stewardship differs. OpenClaw is developed by the OpenClaw Foundation, an independent 501(c)(3) that employs the core team and signs releases; its donors include Amazon, OpenAI, Red Hat and the University of Michigan, and it offers no paid tier or hosted service. Hermes Agent is built by Nous Research, a company, which sells optional services around the open-source agent:

• Nous Portal plans from free to $200 a month, bundling model access and hosted tools.
• Hermes Cloud, from $0.56 per running instance-day, with inference and tool usage billed on top.
• Hermes Business, launched in September 2026 with a shared team balance and per-member usage caps, and Hermes Enterprise, offering on-premises or private-cloud deployment with single sign-on and SLAs, as reported by TAO Media.

The ecosystems overlap more than the rivalry suggests. Ollama ships ollama launch openclaw and ollama launch hermes, NemoClaw sandboxes both, and community bridges run the two agents side by side on the same chat account.

Which one to pick

Whichever you choose, apply the same basics: keep the agent off the public internet, restrict who can message it, isolate command execution, review every third-party skill, and upgrade on a schedule.

What neither is designed for

Both projects describe themselves as tools for one operator or a team that trusts each other. OpenClaw’s answer to multiple tenants is a separate gateway per tenant; Hermes Agent’s security policy starts from a single tenant. That is the right design for personal automation, and it leaves out the requirements of a company-wide deployment: users with different data entitlements sharing agents, identity tied to a corporate directory, approvals by named owners, audit evidence retained for years, and egress rules enforced centrally across hundreds of agents. Hermes Business and Enterprise add team accounts and SSO on top of the agent, and they deserve evaluation on their own terms.

For how a governed platform compares with each harness, see VDF AI versus Hermes Agent and VDF AI versus OpenClaw.

How VDF AI fits

For agent workflows that span a whole organisation, VDF AI offers a governed alternative you can run on your own servers, in a private cloud, fully air-gapped, or in VDF’s managed cloud. It does not run, host or integrate with Hermes Agent or OpenClaw.

VDF AI Agents are built from reusable, versioned Agent Skills with testing and audit logs. Tool access is granted per role through the MCP gateway and each tool call is recorded, while Human Approval nodes in VDF AI Networks hold consequential steps until an accountable owner signs off.