HermesClaw is a self-hosted community stack that runs NousResearch's Hermes Agent inside NVIDIA's OpenShell sandbox. The premise is containment: OpenShell enforces limits on the agent out-of-process at the kernel level, so even a fully compromised agent cannot exceed them. OpenShell intercepts the agent's inference calls and routes them to a configured backend, so Hermes runs with its full capability stack while the OS constrains what it can actually do. It targets people who want to run a capable local agent but need hard security boundaries, including privacy- or compliance-sensitive deployments.
Enforcement is layered across four mechanisms:
- Network: an OPA policy plus HTTP CONNECT proxy allows egress only to approved hosts
- Filesystem: Landlock LSM restricts writes to a few directories (~/.hermes/, /sandbox/, /tmp/)
- Process: a Seccomp BPF filter blocks dangerous syscalls (ptrace, mount, kexec_load, and others)
- Inference: a privacy router strips the agent's credentials and injects backend credentials separately
Security posture is switched via hot-swappable policy presets — strict (inference only), gateway (adds Telegram/Discord), and permissive (adds web search and GitHub skills) — without restarting the sandbox. Inside the sandbox, Hermes provides persistent memory, 40+ built-in tools (terminal, file, vision, voice, browser, image generation), self-improving skills, scheduled tasks, multi-agent delegation, MCP server integration, IDE integration over ACP, and messaging gateways. Inference is served locally via llama.cpp (a GGUF model on the host) or through providers such as NVIDIA NIM, OpenAI, Anthropic, Ollama, or vLLM. It ships a hermesclaw CLI, a pre-built skills library, and can run in plain CPU Docker mode; full OpenShell hardware enforcement additionally requires Linux with an NVIDIA GPU. It is presented as an experimental community project, distinct from NVIDIA's official NemoClaw reference implementation.
