Hermes
Hermes is the agent I talk to from my phone. It is an open source agent runtime running Claude Haiku, connected to Hub over MCP, so a message like what is due today reads the tasks I see at my desk. The agent itself was not the hard part. The hard part was deciding what it is allowed to reach.
- 2026
- Agents
- MCP
- Self-hosted
In short
- My part
- Configuration and the permission model. The runtime is Nous Research's Hermes Agent.
- Model
- Claude Haiku 4.5
- Tools
- 9 of Hub's 13, by allow list
- Who can talk to it
- One Telegram account
- Network
- No open port and no domain: it connects outwards by long polling
- Shape
- One Docker Compose file, secrets kept outside the repository
A short allow list
Hub's MCP server offers 13 tools. Hermes is given 9: the daily briefing, tasks, notes, the ClickUp tasks assigned to me and the list of brands. The four it does not get are the ones that compose project contracts and read the prompt library. Those belong to a coding session at a desk, with a repository open, not to a chat on a phone.
It has its own token. If the server it runs on is ever compromised, that token is replaced and my Claude Code connection keeps working.
Nothing to knock on
A bot does not need to be reachable. Hermes connects out to Telegram and waits, so the service publishes no port and has no domain, and the runtime's web panel is switched off. Only one Telegram account is answered. Sessions, memory and scheduled jobs sit on a volume, so a redeploy does not wipe them.