This is an early release preview. You may encounter bugs.
HermesClaw logo
Unclaimed

Harness security deployment

HermesClaw

Community stack running the Hermes Agent inside NVIDIA's OpenShell sandbox with kernel-enforced network and filesystem limits

C 46/100 GitHub score ? This grade is derived from GitHub signals, not user votes. Open for the full breakdown.
No votes yet

01 / About

What HermesClaw is.

HermesClaw is a community stack that runs the Hermes Agent (Nous Research) inside NVIDIA's OpenShell sandbox. OpenShell enforces limits on network egress, filesystem writes, and system calls at the kernel level, so the agent keeps its full tool set while the operating system, not the prompt, decides what it may touch. OpenShell intercepts every call to inference.local inside the sandbox and routes it to the configured backend.

The project can also run without OpenShell as a plain Docker container (multi-arch, linux/amd64 and linux/arm64) with a llama-server on the host, which is the path for macOS and machines without an NVIDIA GPU. The full sandbox mode requires Linux, an NVIDIA GPU, and an OpenShell install. Hermes's system prompt is around 11k tokens, so a 32k context window is needed for local models.

Enforcement in sandbox mode is layered: network egress through an OPA policy and HTTP CONNECT proxy to approved hosts only, filesystem access via Landlock limited to ~/.hermes/, /sandbox/, and /tmp/, seccomp BPF blocking ptrace, mount, kexecload, perfeventopen, and processvm_*, and a privacy router that strips credentials from the agent and injects backend credentials outside the process.

Features

  • Policy presets: strict (inference only), gateway (adds Telegram and Discord), and permissive (adds web search and GitHub skills), switchable without a restart
  • Hermes capabilities retained: persistent MEMORY.md and USER.md, self-improving skills (DSPy + GEPA), 40+ built-in tools, cron tasks, multi-agent delegation, MCP servers, and IDE integration over ACP (VS Code, JetBrains, Zed)
  • Messaging: Telegram and Discord under the gateway policy; Signal, Slack, WhatsApp, and email under permissive; voice notes are transcribed before reaching the model
  • Inference backends: llama.cpp, NVIDIA NIM, OpenAI, Anthropic, Ollama, and vLLM
  • Skills library: installable skills for a weekly arXiv digest, code review, database anomaly detection, market alerts, a Slack support bot, and Home Assistant control
  • Use-case guides: seven end-to-end setups (researcher, developer, home automation, data analyst, small business, privacy-regulated, trader) each with automated tests
  • CLI: hermesclaw onboard, start, stop, status, connect, logs, policy-set, doctor, and chat
  • Personalisation: a persona.yaml loaded into every session and ~/.hermes/SOUL.md injected into the system prompt
  • Comparison with NemoClaw: a maintained feature table and test results contrast HermesClaw with NVIDIA's OpenClaw-based reference stack

02 / Discussion CREDIBILITY-GATED

Discussion

Reading is open to everyone. Posting and voting need a verified identity or a GitHub grade of B or higher.

  • No discussions yet.

03 / Build

Build with HermesClaw.

Browse the catalogue for frameworks, tools, and harnesses, each scored on real GitHub credibility.

Get HermesClaw →

Browse the catalogue