HarnessMatch
Menu

General-purpose agent

Hermes Agent

Persistent open agent with coding tools, durable automation, and isolated runtimes.

Status
Active
License
MIT
Evidence
Documented + code-verifiable, 25 sources
Product record checked
2026-07-27
Compare harnessesInspect sources

At a glance

An MIT-licensed general agent with terminal, desktop, web, API, and messaging surfaces; persistent memory and goals; coding and browser tools; nested parallel delegation; scheduled jobs; MCP; checkpoints; and local, container, SSH, or managed execution backends.

Good choice if

  • Long-lived development workflows that benefit from bounded memory, searchable sessions, and persistent goals
  • API-driven, scheduled, or delegated work running in Docker, SSH, Daytona, Modal, or a whole-process wrapper
  • Multi-provider workflows spanning terminal, desktop, web, MCP, browser automation, and messaging channels

Check before choosing

  • The default local backend executes with the user's host privileges; command screening is explicitly documented as a heuristic, not a security boundary
  • It is a broad personal-agent platform rather than a coding-only product, so setup and threat surface are larger than a focused coding CLI
  • Checkpoints, memory-write review, skill-write review, and whole-process isolation are opt-in rather than the default posture
See 2 more considerations
  • Background subagents are not restart-durable: an interrupted in-flight attempt can become unknown and must not be assumed safe to retry
  • Repository SWE, browser, batch, and trajectory utilities are project-owned evaluation assets; no score is imported without a complete independent run record

Why it qualifies as a coding harness

This confirms category fit, not product quality. Every required criterion links back to first-party evidence.

Qualifies4 of 4 required criteria evidenced

  • Adaptive agent loop

    Documented

    The system repeatedly observes results and chooses the next action instead of following a fixed one-pass graph.

    EvidencePersistent goals

  • Repository tool execution

    Documented

    The system can use tools to inspect and change a repository or its execution environment.

    EvidenceTools and toolsets

  • Task-aware context management

    Documented

    The runtime assembles, updates, compacts, retrieves, or persists task-relevant context while work proceeds.

    EvidencePersistent memory

  • Model-independent runtime control

    Documented

    Permissions, budgets, interruption, policy, or stop controls operate outside the model's own text generation.

    EvidenceSecurity and trust boundaries

Membership establishes category fit only. It does not score quality, safety, autonomy, model capability, or benchmark performance. · Read the membership rule.

How it works under the hood

Seven mechanisms mapped from first-party records. These labels describe what the harness provides, not how intelligent its model is.

7/7layers documented
  • Execution & isolationSandbox availableDocumented mechanism, not a performance score.
  • Tooling & integrationsExtensible + browserDocumented mechanism, not a performance score.
  • Context & statePersistent stateDocumented mechanism, not a performance score.
  • Lifecycle & recoveryManaged recoveryDocumented mechanism, not a performance score.
  • ObservabilityStructured tracesDocumented mechanism, not a performance score.
  • VerificationWorkflow-gatedDocumented mechanism, not a performance score.
  • Governance & permissionsPolicy controlsDocumented mechanism, not a performance score.

Public code audit

5/5public artifacts present
Security policy
Present at inspected commit
CI workflow
Present at inspected commit
Automated tests
Present at inspected commit
Evaluation assets
Present at inspected commit
Contributor documentation
Present at inspected commit

The inspected 0.19.0 source tree contains 2,729 Python and TypeScript test files under tests/ and apps/ plus 22 CI workflows. Its Mini-SWE runner, browser benchmark script, batch runner, trajectories, and other evaluation utilities are project-owned assets; they do not provide a complete independent model × harness × environment × budget × attempts result, so no product score is imported.

Inspect commit 0fa5e41c86f022bba147797849f0b44865721476, checked 2026-07-27

Measured configurations

No benchmark run passes the full metadata admission policy for this harness yet. Missing data is not scored as zero.

Benchmark policy and all runs

Capability support

Documented first-class product support, checked against the sources below.

External tools (MCP)
DocumentedProduct-supported MCP integrationSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Local models
DocumentedLocal or self-hosted model pathSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Agent parallelism
DocumentedDelegated or parallel agent workflowSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Runs without an open UI
DocumentedNon-interactive or automation surfaceSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Browser control
DocumentedBuilt-in or product-supported browser controlSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Isolated execution
DocumentedDocumented execution-isolation mechanismSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Undo file changes
DocumentedProduct-supported file or session rollbackSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.

Primary evidence

Each capability claim is tied to a first-party record and a verification date.

Product record checked 2026-07-27
Hermes Agent 0.19.0 releaseLatest stable version and date, desktop and gateway changes, smart approvals, subagent inspection, delivery durability, and completion-contract release contextOfficial repositoryHermes documentation overviewSupported installation surfaces, persistent memory, terminal backends, scheduled automation, delegation, browser automation, MCP, and batch processingOfficial docsTools and toolsetsCoding file and terminal tools, browser automation, delegation, scheduling, memory, and per-platform toolset configurationOfficial docsSecurity and trust boundariesSmart, manual, and off approval modes; immutable deny rules; fail-closed timeouts; file-write policy; SSRF controls; container boundaries; and host-execution limitationsOfficial docsTerminal backend configurationLocal, Docker, SSH, Singularity, Modal, and Daytona execution placement, container hardening and persistence, credential forwarding, and remote file synchronizationOfficial docsCheckpoint and rollbackOpt-in pre-mutation shadow-Git snapshots, file and directory rollback, diff preview, retention limits, excluded files, and external-side-effect limitsOfficial docsSubagent delegationParallel and nested children, inherited tool boundaries, separate contexts and terminals, iteration budgets, background delivery, cancellation, and restart-durability limitsOfficial docsPersistent goalsDurable goal lifecycle, continuation budget, completion contracts, evidence-oriented judging, persistence, intervention, and documented false-positive and false-negative risksOfficial docs
View 17 additional sources
Additional first-party evidence17 sources
Scheduled tasksGateway scheduler, isolated sessions, execution ledger states, overlap locking, delivery targets, pause and resume, and restart handlingOfficial docsAPI serverAuthenticated OpenAI-compatible endpoints, structured streaming, background run surfaces, and jobs CRUD for scheduled automationOfficial docsDesktop appElectron desktop client, headless JSON-RPC backend, local and remote runtime attachment, authentication, logs, and extension modelOfficial docsPersistent memoryBounded cross-session memory, FTS5 session search, default autonomous writes, optional write approval, threat scanning, and review controlsOfficial docsMCP integrationMCP server configuration, transport and tool loading, authorization, filtering, cache refresh, and security considerationsOfficial docsBatch processingParallel prompt execution, isolated environments, resumable runs, and structured trajectory generation for training or evaluation without a product scoreOfficial docsRepository snapshotPublic feature and setup surface at the exact inspected commit, including interfaces, providers, memory, cron, delegation, runtime backends, and coding entry pointsOfficial repositoryPackage version at inspected commitHermes Agent package identity, version 0.19.0, Python constraints, dependencies, and executable entry pointsOfficial repositorySecurity policy at inspected commitExplicit OS-boundary threat model, host default, terminal-backend versus whole-process isolation, in-process heuristic limits, credentials, plugins, and external surfacesOfficial repositoryContinuous integration at inspected commitChanged-area detection and parallel test, lint, type, integration, desktop, gateway, security, and packaging lanes in the public repositoryOfficial repositoryCheckpoint implementation at inspected commitShadow-Git checkpoint capture, restore, diff, pruning, size bounds, excluded paths, project identity, and non-fatal failure behaviorOfficial repositoryApproval implementation at inspected commitDangerous-command detection, deny and allow rules, session and permanent decisions, cron behavior, and backend-dependent guard pathsOfficial repositoryDelegation implementation at inspected commitParallel and nested child execution, concurrency limits, inherited tools, asynchronous delivery, cancellation, live logs, and lifecycle handlingOfficial repositoryAutomation API at inspected commitOpenAI-compatible requests, structured run events, authentication, session continuity, background runs, and scheduled-job endpointsOfficial repositoryObservability specification at inspected commitTrace and metric contracts for model, tool, approval, delegation, lifecycle, correlation, and exporter behavior plus observer limitationsOfficial repositoryProject SWE runner at inspected commitProject-owned local, Docker, and Modal task runner and trajectory format, recorded only as an evaluation asset without importing a scoreOfficial repositoryBatch trajectory runner at inspected commitProject-owned concurrent agent trajectory generation and checkpointed batch execution, not independent harness performance evidenceOfficial repository

Ecosystem discovery

OpenRouter apps Discovery signal only; usage rank is not used as a quality or capability score. Observed 2026-07-27.