Hermes AI Agent

Getting started and operations guide for the AWS Marketplace direct AMI.

Attribution: This product independently packages Hermes Agent, developed by Nous Research under the MIT license. It does not claim authorship of the upstream project.

Costs and external services

The software charge is USD 0.02 per running instance-hour and includes a five-day free software trial for one instance. EC2, EBS, data transfer, Telegram connectivity, and third-party model-provider usage are separate. The trial automatically converts to hourly billing. Stop or terminate unused instances and review AWS Cost Explorer, EC2 service quotas, EBS quotas, and your model-provider quota.

Hermes requires outbound HTTPS access to Telegram and the selected model provider. Prepare a supported provider API key, the exact provider model ID, a Telegram bot token, your numeric Telegram user ID, an EC2 key pair, and a subnet with outbound HTTPS.

Launch and configure

1. Subscribe to Hermes AI Agent in AWS Marketplace and choose the current direct AMI.
2. Choose an EC2 key pair and allow inbound TCP 22 only from your trusted IPv4 CIDR, normally a single address ending in /32. No inbound Telegram port is required.
3. The Marketplace source AMI is unencrypted for ingestion compatibility. If encryption is required, enable EBS encryption by default in the launch Region before creating the instance, or configure an encrypted root volume in your approved launch automation.
4. Connect as ubuntu, enter a private root shell, and run the commands below. The prompts keep credentials out of shell history.

sudo -i
read -rsp "OpenAI API key: " LLM_API_KEY; echo
read -rsp "Telegram bot token: " BOT_TOKEN; echo
read -rp "Telegram user ID: " CUSTOMER_TELEGRAM_ID
export LLM_API_KEY BOT_TOKEN CUSTOMER_TELEGRAM_ID
export LLM_PROVIDER=openai
export LLM_MODEL=gpt-5
bash /opt/hermes/bin/provision-hermes.sh
unset LLM_API_KEY BOT_TOKEN CUSTOMER_TELEGRAM_ID
exit

For another supported provider, change LLM_PROVIDER and LLM_MODEL together. Optional settings include LLM_BASE_URL, AGENT_NAME, DM_POLICY, ADDITIONAL_USERS, and CUSTOMER_TIMEZONE. Keep DM_POLICY=allowlist unless anyone who finds the bot should be allowed to consume your provider quota.

Verify and use Telegram

hermes --version
sudo systemctl status hermes-gateway --no-pager
sudo tail -n 80 /var/log/deploy-ec2.log
sudo tail -n 80 /home/ubuntu/.hermes/logs/gateway.log

Confirm that EC2 status checks pass, the service is active, and the gateway log reports a Telegram connection without provider, model, or token errors. Open the bot in Telegram, select Start, and send a message. If Hermes suggests /sethome, run it once to direct scheduled job results and cross-platform messages to that chat.

Scheduled jobs

Hermes includes a persistent cron scheduler. This example creates a harmless local job and lets the gateway ticker execute it every minute:

mkdir -p ~/.hermes/scripts
printf '#!/bin/bash\ndate -u\n' > ~/.hermes/scripts/time-check.sh
chmod 700 ~/.hermes/scripts/time-check.sh
hermes cron create "every 1m" --no-agent --script time-check.sh \
  --deliver local --name time-check
hermes cron status
hermes cron list --all
hermes cron runs JOB_ID --limit 5

Replace JOB_ID with the ID printed by the create command. Use hermes cron pause JOB_ID, hermes cron resume JOB_ID, hermes cron run JOB_ID, and hermes cron remove JOB_ID to manage it. Local results are stored beneath ~/.hermes/cron/output.

Security, backup, and rotation

No proprietary data store is used. Back up only required files from /home/ubuntu/.hermes through an approved encrypted process; backups containing .env contain credentials. Rotate a provider key or Telegram token by running the provisioner with new values, verifying the gateway, and then revoking the old credential.

Recovery and upgrades

Restart with sudo systemctl restart hermes-gateway and inspect with sudo journalctl -u hermes-gateway -n 100 --no-pager. For recovery, launch the current AMI, provision fresh credentials, and restore only the required protected state. A Marketplace version uses a pinned Hermes release; upgrades require launching the newer version and validating migrated state. There is no guaranteed in-place upgrade path. Browser automation dependencies are not installed in the current image.

Support

For AMI packaging, hardening, deployment, or billing support, email info@softwaresushi.com. For upstream Hermes Agent issues, use the upstream issue tracker.