hermes-agent VS codex

NousResearch publishes a detailed security policy for Hermes Agent. It is unusually clear about what the project treats as load-bearing and what it does not. If you operate Hermes in the cloud, read it first; this post is the operator-friendly companion, not a replacement.

OpenCode seemed perfectly workable as a programming assistant. As personal assistants, they all fall short. It's too difficult to really shape their output.

I was briefly impressed with OpenClaw a few times, but ultimately was turned off by not being able to get the models to stop being so damnably verbose. I thought I made progress for a while by having it tweak its soul, iterate, switch models, iterate, switch models, fuse the results, iterate... but ultimately it's all forgotten early in each session. And then one day it killed itself by rebuilding the container it was inside.

Hermes apparently has some plagiarism issues they're trying to cover up [0] and I was deeply unimpressed with their janky, flickery CLI that force-enables a bulky obnoxious header.

Nanoclaw and nanobot seemed fine, but not notably different. There were some common bugs and glitches that caused some minor data loss while configuring nanobot. After that I just deciding to start hacking my own together.

What I really want in a harness is being able to actually control and rewrite the entire context window, like Zed's Text Threads before they obnoxiously and inexplicably removed what, to me, was their most powerful and distinguishing feature.

[0] https://github.com/NousResearch/hermes-agent/issues/10232

I've opened a design discussion to argue this out before anyone writes a line of it, because a surprise PR to a security-sensitive module is the wrong way to start. Feedback from people who've thought about supply-chain trust is what I appreciate.

Source: https://github.com/NousResearch/hermes-agent

Hermes Agent is an open-source AI agent framework.

I opened my Hermes Agent logs and found something I did not know existed: an auxiliary: block with twelve background tasks. Compression, web extraction, vision, session search, skills matching — all running silently every time I typed a message. Every task was set to provider: auto. And because I had no API keys for the fallback chain, every one silently fell back to kimi-k2.6, my one-trillion-parameter main model.

The adjacent tools worth tracking: the OpenAI Chrome plugin, BrowserCode, Autobrowse, browser-harness, Pi browser extensions, and Hermes browser skills. [13] [14] [6] [15] [16] [12] The category is logged-in browser work: support queues, internal tools, research, scraping, QA, admin ops, and anything where the useful data sits behind a session.

hermes-telemetry solves both by giving you real-time observability and automatic budget enforcement for Hermes Agent.

If you haven't encountered it yet: Hermes Agent is an open-source agentic system from Nous Research. The key differentiators that caught my attention:

OpenAI Codex: AGENTS.md

You can absolutely do that by using subprocess.run, or use the codex sdk

https://github.com/openai/codex/tree/main/sdk/python

> reduce the risk of data exfiltration

Yet, their tools such as codex are able to read ALL FILES on my PC without explicit permission unless you spawn them within a container: https://github.com/openai/codex/issues/2847

It seems like OpenAI stealing sensitive data from their customers is not a big problem for them as it has been reported as an issue for almost a year now and currently has the 2nd most upvotes among open issues (they work on issues based on upvotes, so they claim).

It would be really, really great if Codex could support MCP Prompts[0]

This would allow us to deliver standard prompts across the team without having to sync manually or with scripts; keep everyone up to date. Even allow per-user customization of "skills" via server rendering of the prompts.

AFAIK, Codex is the only major harness to not support this.

[0] https://github.com/openai/codex/issues/5059#issuecomment-453...

OpenAI's Codex CLI ships with a great editor-agent UX: shell tool, apply_patch, plan tracking, the lot. The catch — as of February 2026 it only speaks the OpenAI Responses API. Chat Completion support was dropped (codex-rs/model-provider-info/src/lib.rs: the WireApi enum has one variant, Responses). If you wanted to point it at a Chat-Completion-only endpoint — Ollama, LM Studio, your favorite Llama runner — you're out of luck.

Every edit goes through one tool: apply_patch. I standardized on it instead of a generic edit or write because Codex models are trained directly on the V4A patch format, and because structured diffs are easier to validate, retry, and explain than arbitrary file writes. V4A is OpenAI's diff envelope for Codex-family models — in Hookele, one payload can create, update, and delete files in a single call: