Hogpass vs Hermes

Credit first. Hermes is built by Nous Research, MIT licensed, and it is the only agent we know of shipping a real closed learning loop: it writes skills from experience, improves them while using them, and searches its own past conversations. Our agents do not do that, and it runs on more backends than we offer.

Now the part that decides which one a company can deploy. Hermes' SECURITY.md says it outright: "the only security boundary against an adversarial LLM is the operating system." That is a clear and correct statement of a single-user design. It also means the credentials are in the room with the model. OneCLI's architecture exists to delete that room.

Honest but wrong, versus wrong for any reason

Hermes protects you from an agent that is honest but wrong. The approval gate, the deny rules, the blocklists: all of it screens what the model emits, inside the process the model influences. Hermes says so itself, classing every one as a heuristic rather than a boundary. That is right for a single operator who wants a net under their own mistakes.

OneCLI protects you from an agent that is wrong for any reason at all: a poisoned web page, a skill nobody read, a model having a bad day. The enforcement point is outside the sandbox. The agent boots with placeholder keys, the network refuses any egress that is not the gateway, and the real credential is spliced in on the way out after the request is checked. No prompt to talk around, no key file to read.

How they differ

Hermes

Who it is for

Built for

onecli

A company. One agent per employee, provisioned centrally, with an org above it

Hermes

One person. A single-tenant personal agent, by explicit design

Neither is a compromised version of the other. They are answers to different questions.

Identity

onecli

Every agent is tied to an employee, and its access is scoped to what that person already has

Hermes

No per-user model inside an instance: "within the authorized set, all callers are equally trusted"

Hermes' own guidance for capability separation is to run a separate instance per person, which is the fleet problem restated.

Tenancy

onecli

Multi-tenant. One deployment holds the whole org, with users, teams, and per-person scoping inside it

Hermes

Single-tenant by design. One operator per instance, so forty people means forty instances to run and update

This is the difference between software you install and software you operate. Forty instances is forty of everything: upgrades, keys, and logs.

Credentials

What the agent holds

onecli

Placeholders. Real keys are injected at the wire and never enter the sandbox, including the model key

Hermes

Real credentials, in a credential file and in process memory

The largest difference on the page. Everything else follows from it.

If the agent is compromised

onecli

There is nothing to exfiltrate. The attacker inherits the agent's policy, not its keys, and every request they attempt is still checked

Hermes

Credentials are stripped from shell, MCP, and code-execution subprocesses, which Hermes calls a reduction in casual exfiltration and explicitly not containment. Anything in-process, skills and plugins included, can read them

Skills run arbitrary Python at import. A stolen key stays valid until someone notices.

Model keys

onecli

Also a placeholder. The gateway substitutes the real token per request, so model spend is metered and attributable per employee

Hermes

A real provider key or Portal token in the environment

Most platforms exempt the model key. It is the one with a live balance attached.

Enforcement

Where the boundary is

onecli

The network. The sandbox sits on an internal network with exactly two reachable destinations, so bypassing the gateway is impossible rather than merely discouraged

Hermes

The operating system, by their own statement. In-process screening is documented as heuristics that "are not boundaries"

Hermes is right that in-process screening cannot contain an adversarial model. Ours sits outside the process.

What gets checked

onecli

Every outbound request, whatever produced it: an MCP tool call, a CLI, curl in a shell, or code the agent wrote a second ago

Hermes

Shell commands matched against dangerous-pattern lists and globs, plus file-write path denylists

A pattern list over shell strings is structurally incomplete, as Hermes notes. See why agent guardrails belong at the network layer.

Human approval

onecli

The request is held at the gateway. It cannot proceed until someone approves, and the hold is enforced outside the agent

Hermes

An in-loop prompt to the operator, with smart mode using an auxiliary LLM to auto-approve low-risk commands. Container backends skip the checks entirely

An approval the agent's own process can steer around is a speed bump. One at the wire is a stop.

Off switch

onecli

No YOLO mode exists. Policy is set by the org, not the agent's user, and the agent cannot widen its own scope

Hermes

--yolo, /yolo, HERMES_YOLO_MODE=1, or approvals.mode: off disable prompts for the session, above a small hardline blocklist

A control the end user can switch off is not one an organization can rely on.

Where Hermes wins

Self-improvement

onecli

Shared skills and per-agent instructions, authored by people

Hermes

Autonomous skill creation, self-improving skills, agent-curated memory, and cross-session recall

Hermes' best feature, and we have no equivalent.

Licence and price

onecli

Apache-2.0 outside the ee/ directories and free to self-host, including on your own hardware; the hosted product is priced per user and agent

Hermes

MIT throughout, free, with an optional Nous Portal subscription for models and managed tools

For one person Hermes is cheaper and always will be. MIT is also the more permissive licence, with no equivalent of our ee/ carve-out.

The gateway word means two different things

Both products say "gateway" and mean opposite things, which is the most common confusion between them. The Nous Tool Gateway routes web search, images, and TTS through Nous' infrastructure so you do not need five API accounts. Their docs put it right: "the gateway isn't a lock-in, it's a shortcut." OneCLI's gateway is an enforcement layer over everything: a checkpoint every outbound packet must pass, whether it is headed for a Nous endpoint, the GitHub API, or something the agent found five seconds ago. A request the policy denies never leaves the box.

Their security policy describes our architecture

For the posture it calls whole-process wrapping, Hermes' own policy recommends NVIDIA OpenShell and describes what that buys: declarative filesystem, network, and process policy, with credentials injected from a provider store that never touch the sandbox filesystem. That is our architecture, written by them, as the thing to bolt on when the agent reads content the operator does not control, which for a company agent is always. The difference is assembly: with Hermes it is an operator project repeated for every employee, and with OneCLI it is the product.

When to use which

Common questions