Now available

Meet Hermes

v0.16 — The Surface Release

The AI agent that grows with you. Now on your desktop, in your browser, and in your terminal.

Get Started View on GitHub
874
Commits
542
Merged PRs
399
Issues Closed
170+
Contributors
What Changed

What's new in v0.16

Six major improvements, each solving a real problem users reported. Click any card to see the details.

Before (v0.15)
CLI-only. Users had to open a terminal, type commands, and navigate a text-based interface. Intimidating for non-technical users and impossible on shared or managed machines without terminal access.
After (v0.16)
One-click install on macOS, Linux, and Windows. Drag-and-drop files directly into the chat. Cmd+K (Ctrl+K) command palette for instant navigation. In-app model picker with platform search. Concurrent multi-profile sessions. Full Simplified Chinese translation out of the box.
Impact: Hermes goes from a terminal tool to a real application anyone can use — designers, PMs, managers, and developers alike.
Before (v0.15)
Setting up messaging channels (Telegram, Discord, Slack) or MCP servers required SSH-ing into your machine and manually editing config.yaml files. Adding credentials meant copy-pasting API keys into YAML. No visual way to see what was configured.
After (v0.16)
Full browser-based admin panel. Point-and-click setup for Telegram, Discord, and Slack channels. MCP catalog browser with one-click install. Credential management UI. Webhook configuration. Memory settings with visual controls. Access from any device on your network.
Impact: Zero-config messaging setup from any device — no terminal required, no YAML editing, no SSH.
Before (v0.15)
Complex multi-step wizard that required choosing providers, configuring API keys, selecting models, setting up profiles, and more before you could send your first message. Many users gave up during setup.
After (v0.16)
Two paths: Quick Setup (sign in to Nous Portal, pick a model, start chatting — three steps) or Full Setup for power users who want granular control over every setting. Most users go from install to first message in under 30 seconds.
Impact: Install to first message in seconds, not minutes. The #1 barrier to adoption — setup complexity — is now optional.
Before (v0.15)
Scrolling through long lists of models across different providers. No search. Catalog was static — new models required a manual update. Finding a specific model variant meant reading through dozens of names.
After (v0.16)
Type a few letters and fuzzy search across all platforms simultaneously. The model catalog refreshes hourly with new releases. New models available: deepseek-v4-flash, MiniMax-M3 (1M context window), and qwen3.7-plus.
Impact: Find any model in milliseconds. New models appear automatically without manual updates.
Before (v0.15)
No way to take back messages on Telegram or Discord. Once you sent a message and the agent acted on it, there was no reversal. On CLI, a basic undo existed but was limited and inconsistent across interfaces.
After (v0.16)
/undo backs up N user turns and reverses them. Works uniformly across CLI, TUI, Telegram, Discord, and all other messaging platforms. /undo 3 reverts your last 3 messages. Each platform maintains its own undo stack.
Impact: Mistakes become reversible. Users can experiment freely knowing any action can be undone — across every interface.
Before (v0.15)
Bloated default skill list included redundant and dead skills. Spotify skill duplicated a native plugin. Linear skill duplicated MCP integration. Stale skills like kanban-codex-lane, debugging-hermes-tui-commands, and domain-orphans still loaded by default, bloating the prompt and slowing startup.
After (v0.16)
Removed: Spotify (replaced by native plugin), Linear (replaced by MCP), kanban-codex-lane, debugging-hermes-tui-commands, and stale domain orphan skills. Heavy skills moved to optional. New curator feature lets you prune unused built-in skills too — load only what you actually use.
Impact: Lighter prompt, faster startup, less noise. The agent loads faster and wastes fewer tokens on irrelevant instructions.
Before vs After

What v0.16 changes at a glance

A side-by-side comparison of the most significant improvements from v0.15 to v0.16.

Area Before (v0.15) After (v0.16)
Interface CLI/TUI only Native desktop app + web admin panel
First Setup Multi-step wizard with provider config Quick Setup via Nous Portal — sign in, pick model, chat
Model Selection Scroll through static lists Fuzzy search with hourly catalog updates
Message Undo CLI only, limited functionality Works everywhere — Telegram, Discord, Slack, CLI
Skills Bloated defaults with redundant/dead skills Trimmed defaults, curator-managed loading
Dashboard Session viewer only Full admin panel — channels, MCP, credentials, webhooks
Languages English only English + Simplified Chinese
Interface
Before: CLI/TUI only
After: Native desktop app + web admin panel
First Setup
Before: Multi-step wizard with provider config
After: Quick Setup via Nous Portal — sign in, pick model, chat
Model Selection
Before: Scroll through static lists
After: Fuzzy search with hourly catalog updates
Message Undo
Before: CLI only, limited functionality
After: Works everywhere — Telegram, Discord, Slack, CLI
Skills
Before: Bloated defaults with redundant/dead skills
After: Trimmed defaults, curator-managed loading
Dashboard
Before: Session viewer only
After: Full admin panel — channels, MCP, credentials, webhooks
Languages
Before: English only
After: English + Simplified Chinese
By the Numbers

A single release cycle, fully quantified

Every number here is real. No rounding, no projections — just the actual output of 170 people shipping code.

874
Commits
In a single release cycle
542
Merged PRs
From the community
399
Issues Closed
Including 2 P0, 62 P1, 16 security-tagged
170
Contributors
Community-driven development
1,962
Files Changed
205K insertions, 46K deletions
Security

Hardened where it matters

Four targeted security fixes that address real attack vectors — not theoretical risks. Each one closes a specific class of vulnerability.

CVE-2026-48710
Starlette Version Pin
Pins the Starlette framework version to prevent exploitation of a known server-side vulnerability. Without this pin, Hermes could inherit the vulnerable version through transitive dependencies, exposing the web server to request smuggling and path traversal attacks.
SSRF Hardening
Off-Loop SSRF Prevention
Prevents server-side request forgery (SSRF) attacks that could redirect internal HTTP requests to attacker-controlled hosts. The fix enforces off-loop validation — outgoing requests are checked against a blocklist and cannot target private IPs, localhost, or internal metadata endpoints (169.254.169.254).
Subprocess Isolation
Credential Stripping
Removes API keys, tokens, and secrets from subprocess environments before execution. Previously, a compromised or misconfigured tool could leak credentials to child processes. Now, only explicitly permitted environment variables pass through to subprocesses.
Promptware Defense
Brainworm Attack Prevention
Blocks Brainworm-class prompt injection attacks at three chokepoints: tool output, recalled memory, and stored skills. Pattern-matches against ~15 known attack signatures. Scans recalled memory at load time before it enters the LLM context. Prevents injected instructions from executing as agent commands.
Architecture

Built for scale

v0.16 isn't just a feature release — it's an architectural shift. The core runtime is faster, more modular, and ready for multi-agent workloads.

Pluggable
Transport Architecture
Providers are now plugins, not hardcoded integrations. Adding a new LLM provider (Ollama, vLLM, custom endpoints) means writing a plugin, not modifying core code. The transport layer is fully abstracted — swap providers without touching agent logic.
Multi-Agent
Kanban Orchestration Platform
The new Kanban system enables orchestrator auto-decomposition — break complex tasks into subtasks automatically. Supports swarm topology for parallel execution, per-task model overrides (use fast models for simple tasks, powerful models for complex ones), and visual task tracking.
−47%
Fewer Function Calls
Per-conversation function calls reduced by 47% through smarter tool routing, batched operations, and eliminated redundant step functions. Every conversation now executes fewer round-trips to the LLM, reducing latency and cost without sacrificing capability.
4,500×
Faster Session Search
session_search is now 4,500× faster. No LLM calls, no embedding lookups, no cost — pure FTS5 full-text search over conversation history. Search thousands of past sessions in milliseconds. The old LLM-based approach is still available as a fallback for semantic queries.

Start building today

Install Hermes in one command. Free and open source under MIT.

npx hermes-agent
GitHub Documentation Community