KiwiClaw vs Hermes Agent: An Honest Comparison
The short version
Hermes Agent and KiwiClaw are not really in the same category. Hermes is an open-source personal agent you run on your own machine, and its own security policy describes it as single-tenant. KiwiClaw is a managed service that runs an agent for you in an isolated container, with credential isolation, approval gates, audit events, and account roles. If you want to operate the thing yourself, Hermes is a good choice. If you want it operated, that is what we sell.
What Hermes Agent is
Hermes Agent is an MIT-licensed agent from Nous Research, written in Python and driven from a CLI on a machine you control. It carries a large provider layer with unusually good failure classification and recovery, a plugin and MCP system, adapters for messaging platforms, and a skills system in which the agent writes and revises its own skill files as it works.
That self-improvement loop is the most interesting part, and it is ahead of most agents: a deterministic trigger fires during a turn and a forked model call writes or updates a markdown skill file. We have no shipped equivalent today, and we are not going to pretend otherwise on a comparison page.
The project also documents its own limits more clearly than most commercial vendors do, which is what makes an honest comparison possible at all.
What KiwiClaw is
KiwiClaw is managed hosting for an agent we operate. The engine is our own hardened private fork with OpenClaw lineage — not Hermes, and not a stock upstream image. Each tenant gets its own container on dedicated European metal in Falkenstein, Germany, running under gVisor with capabilities dropped and no-new-privileges set.
Around that sits the product: a dashboard with WebChat, Telegram, Slack, and Discord; approval modes that gate what the agent may execute; audit events covering account, agent, configuration, and administrative activity; account roles for teams; and an LLM proxy that holds provider credentials so that tenant containers don't have to.
What we do not have is certification. KiwiClaw is not SOC 2 certified and does not sign HIPAA BAAs. The security page lists the live controls and the gaps together.
The difference that actually matters: who provides the boundary
Hermes' SECURITY.md describes it as "a single-tenant personal agent" and states that "the only security boundary against an adversarial LLM is the operating system", adding that nothing inside the agent process constitutes containment. Its agent/file_safety.py says the same thing about credentials: the path denylist is "NOT a security boundary", because the shell tool runs as the same OS user.
That is a correct description of the design, and it tells you precisely what a host has to supply. When you self-host, you are that host. The boundary is whatever your machine provides, which for most people means an agent with shell access running as their own user, on their own laptop, alongside their SSH keys.
KiwiClaw's job is to be the layer Hermes says it does not provide: a per-tenant gVisor sandbox, dropped Linux capabilities, egress controls, and provider credentials that terminate at our proxy instead of sitting in the container. Hermes does ship an optional hardened Docker backend for its shell tool, and it is competently built — it is simply off by default, and it covers the shell rather than the whole process tree.
Statements about Hermes here come from the project's own documentation and source, read at v0.20.0 / commit 01a1037 on 2026-08-05. Defaults change between releases; check the current version before relying on any of it.
Side by side
| KiwiClaw | Hermes Agent | |
|---|---|---|
| What it is | Managed hosting for an agent we run | Open-source agent you run yourself |
| License and cost | $15/mo BYOK · $39/mo Standard with model access included | MIT — free software, plus your infrastructure and API spend |
| Tenancy model | Multi-tenant platform, one isolated container per agent | Single-tenant personal agent, per its own SECURITY.md |
| Isolation boundary | gVisor container per tenant, capabilities dropped, no-new-privileges | The operating system you run it on; an opt-in hardened Docker backend covers the shell tool |
| Provider credentials | Standard: terminate at the LLM proxy, never in the container. BYOK: your key goes into your container by design | Stored on the host, readable by the agent process — as its own source documents |
| Approvals | Approval modes enforced by the control plane and resolved in chat | In-process approval system that you configure |
| Audit | Application audit events, with dashboard views and export | Local logs and session state on your machine |
| Teams | Account roles and invites | None — designed for one person |
| Model access | Managed model access included on Standard, or bring your own keys | Bring your own keys or your own endpoints |
| Self-improving skills | Not shipped today | Yes — the agent writes and revises its own skills |
| Backups, upgrades, uptime | Ours to run | Yours to run |
| Certifications | None today | None claimed |
| Where it runs | Falkenstein, Germany | Wherever you put it |
When self-hosting Hermes is the right choice
Often, honestly. Specifically:
- You want the source. It is MIT, it is readable, and you can change any part of it. We cannot offer that.
- Your data must not leave your machine. If the requirement is that nothing transits a third party's infrastructure, then a self-hosted agent on hardware you control is the answer and no managed service can be.
- You already run infrastructure. If you maintain a Docker host with backups and monitoring anyway, one more service is a small marginal cost and you keep full control of the configuration.
- You want the self-improving skills loop today. It is their capability lead and it is real.
- You have provider rates worth protecting. Enterprise pricing you negotiated stays yours when you run the agent yourself. Our BYOK plan is the middle path if you want managed hosting on your own keys.
- It is a personal agent for one person. That is what Hermes is designed for, and it is good at it.
If you do self-host — Hermes or anything else — the things worth doing are running it as a dedicated user inside a container rather than as yourself, keeping approvals switched on, scoping the provider key to a dedicated project with a spend cap, and assuming that anything the agent reads can influence what it does next.
When KiwiClaw is the right choice
- You don't want to operate it. Backups, image upgrades, uptime, and keeping the browser stack working is the product rather than a chore you inherit.
- You want an isolation boundary you didn't have to build. A gVisor container per tenant, capabilities dropped, egress controls, on infrastructure that is not your laptop.
- You want provider keys out of the agent's reach. On the Standard plan they terminate at our proxy.
- More than one person needs access. Account roles, invites, and audit events exist; Hermes has no multi-user model.
- You want it reachable where you already are. WebChat, Telegram, Slack, and Discord, configured from a dashboard rather than from adapters you host.
- You would rather have one predictable bill than a provider invoice plus a VPS invoice plus your own time.
What we learned from their code, and are happy to say so
We read Hermes closely before writing this page. Several parts of it are better than what most projects ship, and pretending otherwise would be dishonest:
- Their provider layer classifies failures with orthogonal recovery bits — retryable, should-compress, should-rotate-credential, should-fall-back — instead of a flat list of error codes. That is the right shape, and it has shaped how we are designing our own routing layer.
- Tool results from untrusted sources such as web fetches, browser output, and MCP servers are wrapped in an explicit data-not-instructions frame, with a delimiter designed so that attacker-controlled content cannot forge or close it early.
- MCP child processes receive an allow-listed environment rather than inheriting the parent's, so a third-party server does not pick up API keys by accident.
- Their SECURITY.md is more candid than most commercial security pages — ours included, on our worse days.
Reusing MIT-licensed code carries attribution obligations, and we treat porting as a deliberate, licensed act rather than a shortcut. Where their design has influenced ours, we will say so.
What we are not claiming
- We do not host Hermes Agent. KiwiClaw runs its own engine with OpenClaw lineage. If you specifically want Hermes hosted for you, we are not that product today.
- We are not claiming Hermes is insecure. It is a personal agent with a documented single-tenant threat model and it is accurate about it. This comparison is between a design intended for one person's machine and a design intended to be operated on other people's behalf.
- We are not claiming certification. No SOC 2 report, no HIPAA BAA. See the security page.
- We are not claiming self-improving skills. That is theirs today, not ours.
Frequently Asked Questions
Does KiwiClaw host Hermes Agent?
No. KiwiClaw runs its own hardened engine with OpenClaw lineage. We studied Hermes closely and admire parts of it, but hosting it is not something we offer.
Is Hermes Agent insecure?
No — it is a single-tenant personal agent with an unusually honest description of its own threat model. Its documentation states that the operating system is the security boundary, which is true of most self-hosted agents. The real question is not whether it is secure, but whether you want to be the one providing that boundary.
Can I run Hermes Agent and KiwiClaw at the same time?
Yes, they are unrelated systems. Some people keep a self-hosted agent for local work on their own files and use a managed agent for anything that runs unattended or that other people need to reach.
Which one has better model handling?
Hermes has the more mature failure-recovery layer today, and we have said so publicly. KiwiClaw's managed plan gives you model access without handling provider keys and enforces spend caps at the proxy before a request is forwarded. They solve different halves of the problem.
What does KiwiClaw cost compared to self-hosting Hermes?
Hermes is free software; the cost is a machine to run it on, your provider spend, and your time. KiwiClaw is $15/mo BYOK or $39/mo Standard with managed model access included. Below a few hours of maintenance a month, self-hosting is cheaper. Above that, usually not.