How to Run Hermes Agent: Desktop vs CLI vs Docker/VPS vs Bot Gateway

TL;DR

You don't have to choose a front-end — you have to choose where the agent lives. Hermes Desktop, the CLI/TUI, and the web dashboard are all front-ends to the same agent core: same config, same API keys, same sessions, same skills, same memory. The official docs put it plainly: "Pick whichever fits the moment. They share state." The decision that actually matters is where the agent process runs: your own machine (simplest), a Docker container on a VPS or home server (always-on), managed Hermes Cloud (hosted for you), or your phone via Termux (best-effort). Current release is v0.20.6 (as of 2026-08-27).

Quick router: brand new? Start with Hermes Desktop. Terminal person? The TUI (hermes --tui) is the officially recommended interactive experience. Want a Telegram/Discord bot that never sleeps? Docker on a $5 VPS. On the fence about Windows native vs WSL2? There's an official answer.

The two decisions (and the two that aren't)

People searching "hermes desktop vs cli" are usually asking four different questions at once. Two of them are real decisions; two aren't:

• Which front-end do I look at? — not really a decision. Desktop, CLI/TUI, and dashboard share one session store; you can start a chat in the app and resume it in the terminal.
• Which platform am I on? — mostly decided for you. The official platform-support tiers tell you what's safe (see the matrix below).
• Where does the agent process live? — the real decision. Laptop vs container/VPS vs managed cloud vs phone changes uptime, security posture, and how you update.
• Which channels reach it? — the second real decision. Terminal-only, or the messaging gateway (Telegram, Discord, Slack, WhatsApp, Signal, SMS and 15+ more) — one background process that connects to every platform you configure.

The modes at a glance

The front-ends: Desktop, CLI/TUI, dashboard

Hermes Desktop is a native app for macOS, Windows, and Linux built around the same agent core — "not a separate product or a lightweight clone" per the docs. It's the best default for most people: multi-session chat windows, the Bot Mode roster, Memory Graph, a global Quick Entry hotkey, and the ability to connect to several remote gateways, VPS boxes, or Cloud instances at once. If you already run the CLI, hermes desktop launches it against your existing config. We wrote a full Hermes Desktop guide covering install, desktop-only features, plugins, and the known rough edges.

The CLI and TUI are two terminal front-ends over one SQLite session store. The classic CLI is what hermes gives you by default; the newer TUI (hermes --tui, Node.js ≥ 20) is what the official docs call "the recommended way to run Hermes interactively". Power-user features live here: worktree-isolated parallel agents (hermes -w), background sessions (/bg), shell passthrough (!cmd), and skill slash-commands.

The web dashboard (hermes dashboard) is a machine-level admin panel at 127.0.0.1:9119 that manages every profile on the box; for local use "no data leaves localhost" per the docs. Its optional Chat tab embeds the full TUI in the browser through a pseudo-terminal — the one feature with a real platform constraint (POSIX PTY, so WSL2 rather than native Windows).

Where the agent lives

Your machine (default)

The standard install (install.sh on macOS/Linux/WSL2, install.ps1 or the Desktop installer on Windows) runs everything locally. Simplest to set up, updates via hermes update, and everything above applies. The only catch: the agent sleeps when your laptop does — cron jobs and bots included.

Docker on a VPS or home server (always-on)

The official image (nousresearch/hermes-agent, x86_64 + aarch64, Tier 1) is the supported path for anything that should stay up: bot gateways, cron-driven agents, team instances. Under the hood it's Debian with s6-overlay supervising the gateway and dashboard — crashed processes restart themselves. One container can host several profiles, which the docs now recommend over one-container-per-profile. Plan for 1GB/1 core minimum, 2–4GB with browser tools. Two rules that save real pain: never point two gateway containers at one data directory (session/memory corruption), and remember Docker installs update by pulling a new image — hermes update is intentionally unsupported there.

Security, in one paragraph: binding the dashboard or backend to a non-loopback address engages a mandatory auth gate, and the old --insecure escape hatch is now a deprecated no-op — because in June 2026 internet scanners used unauthenticated public dashboards as the entry point for a real campaign that planted SSH-key backdoors via MCP-config persistence. The official guidance since: OAuth via Nous Portal for anything reachable from the public internet; username/password only on a trusted LAN or VPN (Tailscale). Details in the Docker guide and dashboard docs.

Browsing deployment tooling? The Atlas catalogs community deployment options — Docker Compose stacks, Nix flakes, systemd templates, Kubernetes charts.

Managed Hermes Cloud

Nous also runs Hermes Cloud — hosted instances you create, start, stop, and destroy from the Portal's agents page (or, fittingly, from an agent via its MCP server). It's the "I want an always-on Hermes without owning a server" answer. The public docs on it are still thin compared to Docker, so treat this as the convenience path rather than the deeply documented one; Desktop connects to Cloud instances the same way it connects to any remote gateway.

Your phone (Termux, Tier 2)

Hermes runs on Android via Termux with a tested bundle: CLI, cron, background terminal, a best-effort Telegram gateway, MCP, and memory. The honest limits from the official Termux guide: Android may suspend background jobs, so "gateway persistence is best-effort rather than a normal managed service," and heavy extras (voice, full browser bootstrap) aren't available. For a phone-centric setup that works today, most people pair a VPS-hosted gateway with Telegram on the phone — see the Hermes in your pocket use case.

Bots and messaging: the gateway

"Bot mode" isn't a separate install — it's the messaging gateway: one background process that connects to all your configured platforms. Telegram, Discord, Slack, Google Chat, WhatsApp, Signal, SMS and more each have setup pages, and the official platform comparison shows exactly which features (voice, images, files, threads, reactions, streaming) each channel supports. hermes gateway setup is the entry point from every install mode. In Hermes Desktop, Bot Mode is built in and on by default — a "bot" is just a Hermes profile with a face, and everything has CLI parity (hermes -p <bot> chat).

Platform support tiers (official)

Source: official platform support page. Yes, Intel Macs are unsupported; yes, brew install hermes-agent is a trap.

Windows: native or WSL2?

Both are Tier 1, and the official WSL2 guide gives a refreshingly direct answer. Pick WSL2 if: you want the dashboard's embedded terminal tab (POSIX PTY, WSL2-only), you do POSIX-heavy development and want Hermes on the same Linux filesystem as your tools, or you already maintain a WSL2 environment. Native is fine — or better — for everyone else: chat, the gateway, cron, browser tools, and MCP all run natively, and you skip crossing the WSL↔Windows boundary every time you touch a file or URL. The native guide's feature matrix lists the exact deltas.

If you're still deciding

• "I just want to try Hermes" → Hermes Desktop on your Tier-1 machine. Everything transfers to the CLI later because it's the same agent.
• "I live in a terminal" → install.sh + hermes --tui. Add the dashboard when you want a browser view.
• "I want a bot that answers at 3am" → Docker on a small VPS (or Hermes Cloud), gateway configured, dashboard behind OAuth or a tailnet. Manage it from Desktop's remote-gateway connections.
• "I want it on my phone" → Telegram against a VPS gateway first; Termux if you genuinely need phone-local execution.
• "I run NixOS" → you already know the tradeoff you signed up for. The Nix setup guide is extensive; it's still Tier 2.

Next steps: the install guide for your platform, the Skills Hub once you're running, and deployment options from the community catalog. Comparing agents instead of modes? Hermes vs Claude Code.

FAQ

Does Hermes Agent have a desktop app?

Yes — Hermes Desktop, a native app for macOS, Windows, and Linux built on the same agent core as the CLI. Install it from the official download page, or run hermes desktop from an existing install.

Should I use Hermes Desktop or the CLI?

It's not either/or: they share config, sessions, skills, and memory, so you can move between them freely. Desktop adds visual multi-session and bot management; the TUI is the officially recommended interactive terminal experience.

Can I run Hermes Agent on a Raspberry Pi or home server?

Yes — the Docker image is Tier 1 on aarch64, which covers ARM single-board computers. Budget 1GB RAM/1 core minimum (2–4GB with browser tools), and update by pulling a new image.

Can I run Hermes Agent on Android?

Yes, via Termux (Tier 2). CLI, cron, MCP, memory, and a best-effort Telegram gateway are tested; Android may suspend background jobs, so don't rely on it as an always-on host.

Do I need a VPS to run Hermes as a Telegram or Discord bot?

No — the gateway runs anywhere, including Desktop's built-in Bot Mode. But a VPS or Hermes Cloud is the right home once you want the bot to outlive your laptop's lid.

Is it safe to expose the Hermes dashboard on a VPS?

Only behind the auth gate — OAuth (Nous Portal) for anything public, username/password strictly for LAN/VPN. Unauthenticated dashboards were exploited in a real June 2026 campaign; the --insecure flag is now a deprecated no-op.

Should I install on Windows natively or in WSL2?

Native for most people (it's Tier 1 and nearly everything works). WSL2 if you want the dashboard's embedded terminal or a real POSIX environment shared with your dev tools.