Hermes Agent

Hermes is Company Brain's second runtime kind: a fully isolated agent runtime per assistant, running in its own Kubernetes namespace with persistent storage. Use Hermes when you want durable workspace state, erxes workspace tools, and the shared skill pot alongside chat and Discord.

What a Hermes agent is

One identifier = one isolated runtime. Creation first makes a hermes identifier (reserving a plan slot), then provisions a dedicated runtime while Kubernetes reconciles it.
Persistent. The runtime keeps its home and workspace on persistent volumes, so provider credentials and assistant state survive restarts — ordinary restarts do not require signing in again.
Separate from OpenClaw. Hermes has its own fleet view, its own runtime records, and its own lifecycle. Deploying or destroying a Hermes agent can never mutate an OpenClaw assistant.
Private by default. The browser reaches the runtime only through a backend-minted, minutes-long login URL; the runtime's network policy admits nothing else.

Create a Hermes agent

Open Company Brain → Hermes Agent (/agent/hermes).
Select Create and choose Setup type → Create new server.
Enter the Identifier name and Description, then Continue.
Pick the connection type:
- API key — paste a key from a supported provider, or
- Subscription plan — choose one of the six Hermes subscription plans.
Complete the provider step and confirm.

After creation, the runtime boots in its own namespace. ChatGPT and MiniMax plans continue into a one-time device-code step after the pod is ready; token and setup-key plans (Claude setup-token, GitHub token, Qwen and Z.AI plan keys) are applied during deployment. The page polls while Kubernetes finishes the rollout.

Hermes subscription plans

Hermes accepts API keys from the same major providers as OpenClaw, plus six subscription options with Hermes-specific guides:

Claude — a setup-token generated by Claude Code on your own computer.
ChatGPT — a one-time device code; no API key needed.
GitHub Copilot — a GitHub token from an account with an active Copilot plan.
MiniMax Coding Plan — device-code sign-in; no API key required.
Qwen Coding Plan — the global Coding Plan key.
Z.AI GLM Coding Plan — the global Coding Plan key.

After connection, the credential is stored only in that assistant's private runtime on its persistent volume.

Use the Hermes WebUI

Open the runtime from the fleet card or detail page. erxes mints a short-lived login URL per user; raw runtime credentials never reach the browser.
Copy the WebUI password from the detail page when you need a direct login.
Health is polled continuously; the fleet card shows provisioning state (deploying, ready, failed) at a glance.

Connect erxes workspace tools

Hermes runtimes can call erxes capabilities through a scoped OAuth client:

From chat, start the erxes connection (erxes_auth_start) — it returns an approval URL and one-time code.
Approve in erxes, selecting the permission actions you want to grant.
erxes_tools_search then lists only the live capabilities your OAuth scopes and erxes permissions allow, and erxes_tool_call executes them. Destructive capabilities ask for a one-time confirmation first.

The plugin can only reach the agent-tools manifest and call endpoints — it cannot send arbitrary GraphQL — and OAuth tokens stay in the runtime's persistent state. Replacing or removing the connection invalidates saved credentials.

Use the skill pot

The fleet shares a skill registry:

Community skills are published by runtimes like yours and are visible only inside the organization that published them.
Verified skills are promoted by erxes and visible to every customer.

Inside the runtime, ask the assistant to search the pot before building, and publish with a green self-test (erxes-skill-publish <skill> runs the skill's self-test, a safety scan, then publishes).

Connect Discord

Ready Hermes runtimes expose the same Discord management sheet as OpenClaw, from the detail toolbar and fleet card. The official erxes AI Assistant bot installation is shared by both runtime kinds, but each channel binding is assistant- and runtime-scoped. The sheet opens automatically after creation and provides server/channel selection and response controls.

Transfer and delete

Transfer credentials export the controller-verified runtime token and connection metadata. Importing them in another organization re-homes the existing runtime — preserving its persistent volumes — instead of creating a replacement.
Delete destroys the runtime's Kubernetes resources; the persistent volume is retained per the storage policy.

Quotas

Hermes shares the Company Brain assistant entitlement with OpenClaw: 3, 10, and 25 People plans grant 3, 10, and 25 total slots across both kinds, and the fleet view shows your remaining capacity. Creation is blocked while the entitlement is exhausted; over-plan assistants use the billing selector.