Hermes Agent untuk Lanjut: Arsitektur, Security, Enterprise, dan Performance

┌─────────────────────────────────────────────────────────┐
│                   Presentation Layer                     │
│   CLI │ TUI │ Dashboard │ Gateway (Telegram/Slack/...)  │
├─────────────────────────────────────────────────────────┤
│                 Orchestration Layer                      │
│              AIAgent (run_agent.py)                      │
│   Prompt Assembly → Provider → Parse → Execute → Loop   │
├─────────────────────────────────────────────────────────┤
│               Tool & Extension Layer                     │
│   Tool Registry │ Skills │ Plugins │ MCP Servers         │
└─────────────────────────────────────────────────────────┘

~/.hermes/
├── config.yaml          # Konfigurasi utama (provider, model, features)
├── .env                 # Environment variables (API keys, tokens)
├── SOUL.md              # System prompt / personality definition
├── memories/            # Persistent memory (Markdown files per profile)
├── skills/              # Procedural memory (skill documents)
├── plugins/             # Python plugin packages
├── sessions/            # Conversation history per session
├── profiles/            # Isolated profile directories
├── cron/                # Scheduled task definitions
├── mcp_servers.yaml     # MCP server configurations
└── hermes-agent/        # Git checkout of hermes-agent repo

# ~/.hermes/config.yaml
credential_pools:
  openrouter:
    - api_key: sk-or-key-1
    - api_key: sk-or-key-2
    - api_key: sk-or-key-3
  anthropic:
    - api_key: sk-ant-key-a
    - api_key: sk-ant-key-b

credential_pool_strategies:
  openrouter: round_robin
  anthropic: least_used

# ~/.hermes/config.yaml
model:
  default: anthropic/claude-sonnet-4    # Primary model untuk task kompleks
  fast: openai/gpt-4.1-mini            # Untuk task ringan (summarization, classification)
  fallback: openai/gpt-4.1             # Fallback jika primary gagal

provider_routing:
  order:
    - anthropic
    - openai
    - google
  allow_fallbacks: true

# Install dan pull model
ollama pull hermes3:70b

# Konfigurasi di ~/.hermes/config.yaml
provider: ollama
model:
  default: hermes3:70b
  base_url: http://localhost:11434

# ~/.hermes/config.yaml
parameters:
  temperature: 0.7          # Kreativitas (0.0-1.0)
  max_tokens: 4096          # Max output tokens per response
  top_p: 0.9                # Nucleus sampling threshold

Create → Load from disk → Inject to system prompt → Agent follows instructions
  → Agent optionally improves skill via skill_manage tool → Save back to disk

# Skill: Advanced Code Review

## When to Use
- User asks for code review on PR or diff
- Detecting security vulnerabilities in codebase
- Performance optimization suggestions needed

## Prerequisites
- Must have access to git repository
- Requires `gh` CLI for GitHub integration
- Git repository must be on a branch with changes

## Steps
1. Run `git diff main...HEAD` to get all changes
2. For each changed file:
   a. Analyze code patterns and architecture decisions
   b. Check for security issues (SQL injection, XSS, auth bypass)
   c. Evaluate performance implications (N+1 queries, memory leaks)
3. Generate structured report with severity levels

## Error Handling
- If git diff fails: fall back to `git log --oneline -20`
- If file is binary: skip and note in report
- If GitHub API rate limited: use local git only

## Conditional Logic
- IF changes include Dockerfile: also run container security scan
- IF changes include migrations: verify rollback safety
- IF more than 50 files changed: delegate to subagent per directory
- IF changes affect auth module: require manual approval

## Output Format
- Severity: Critical/High/Medium/Low
- File path and line numbers for each finding
- Suggested fix with code example
- Overall risk score (1-10)

# Skill: Multi-Step Research Pipeline

## Chain Definition
1. **[deep-research]** — Gather information from multiple sources
2. **[fact-check]** — Verify claims against authoritative sources
3. **[summarize]** — Create executive summary
4. **[publish]** — Format and save to output directory

## Handoff Protocol
- Each step outputs to /tmp/research-step-N.md
- Next step reads previous output as input context
- On failure: retry once, then skip and note gap in final report

## Quality Gates
- Step 1 must find at least 3 sources — otherwise abort
- Step 2 must verify 80%+ claims — otherwise re-run with broader search
- Step 3 summary must be under 500 words — otherwise re-summarize

# Test skill dengan dedicated profile
hermes profile create skill-test
hermes --profile skill-test chat "Test: gunakan skill code-review pada file test.py"

# Atau dengan workspace target yang terisolasi
hermes --workspace-target /tmp/test-project chat "Review this code using advanced-review skill"

# ~/.hermes/plugins/audit_plugin.py
from hermes.plugins import Plugin, PluginContext
import json

class AuditPlugin(Plugin):
    def __init__(self, ctx: PluginContext):
        self.ctx = ctx
        # Register custom tool yang tersedia untuk agent
        ctx.register_tool(
            name="custom_audit_search",
            description="Search audit logs by keyword",
            parameters={"query": {"type": "string"}},
            handler=self.search_logs
        )
        # Subscribe ke lifecycle hooks
        ctx.on("before_prompt", self.log_prompt)
        ctx.on("on_tool_call", self.log_tool_call)
        ctx.on("after_response", self.log_response)
        ctx.on("on_error", self.log_error)
        ctx.on("on_shutdown", self.cleanup)

    def log_prompt(self, prompt: str) -> str:
        """Intercept prompt sebelum dikirim ke LLM"""
        with open("/var/log/hermes/audit.log", "a") as f:
            f.write(f"PROMPT: {prompt[:200]}...\n")
        return prompt  # Return modified atau original prompt

    def log_tool_call(self, tool_name: str, args: dict):
        """Intercept setiap tool call"""
        with open("/var/log/hermes/audit.log", "a") as f:
            f.write(f"TOOL: {tool_name} ARGS: {json.dumps(args)[:500]}\n")

    def log_response(self, response: str) -> str:
        """Post-process LLM response sebelum dikirim ke user"""
        with open("/var/log/hermes/audit.log", "a") as f:
            f.write(f"RESPONSE: {response[:200]}...\n")
        return response

    def log_error(self, error: Exception):
        """Handle errors dalam agent loop"""
        with open("/var/log/hermes/audit.log", "a") as f:
            f.write(f"ERROR: {str(error)}\n")

    def cleanup(self):
        """Cleanup saat agent shutdown"""
        pass

    def search_logs(self, query: str):
        """Custom tool implementation"""
        return {"results": [], "query": query}

from hermes.plugins import MemoryProvider

class PostgresMemoryProvider(MemoryProvider):
    def store(self, key: str, value: str, metadata: dict):
        """Store memory entry ke PostgreSQL"""
        # Implementation: INSERT INTO memories (key, value, metadata, created_at)
        pass

    def retrieve(self, query: str, limit: int = 5) -> list:
        """Retrieve relevant memories dengan semantic search"""
        # Implementation: SELECT * FROM memories ORDER BY similarity(query, value) LIMIT N
        pass

    def search(self, query: str) -> list:
        """Full-text search across memories"""
        # Implementation: SELECT * FROM memories WHERE value @@ plainto_tsquery(query)
        pass

# ~/.hermes/config.yaml
tts:
  command: "edge-tts --voice id-ID-ArdiNeural"

stt:
  command: "whisper --model base"

shell_hooks:
  on_file_change: "eslint --fix $FILE"

5. MCP Advanced Usage

Model Context Protocol (MCP) memungkinkan Hermes terhubung ke external tool servers. Hermes berfungsi sebagai MCP client yang auto-discovers tools dari server dan meregistrasikannya alongside built-in tools. Mendukung tiga transport: stdio (local process), SSE (HTTP/Server-Sent Events), dan Streamable HTTP. Advanced usage mencakup custom MCP server creation, multi-server orchestration, tool filtering, dan debugging.

Multi-Server MCP Configuration

Konfigurasi berikut menunjukkan bagaimana menghubungkan Hermes ke beberapa MCP server secara simultan — masing-masing dengan tool filtering yang berbeda:

# ~/.hermes/mcp_servers.yaml
servers:
  # Server 1: GitHub integration via stdio
  github:
    command: npx
    args: ["-y", "@modelcontextprotocol/server-github"]
    env:
      GITHUB_TOKEN: ${GITHUB_TOKEN}
    tools:
      allow:
        - create_issue
        - list_repos
        - create_pull_request
      block:
        - delete_repo        # Blokir operasi berbahaya

  # Server 2: Database access via SSE
  database:
    url: "https://mcp-db.example.com/sse"
    headers:
      Authorization: Bearer ${DB_TOKEN}
    tools:
      allow:
        - query
        - insert
      block:
        - drop_table         # Blokir DDL destructive
        - truncate

  # Server 3: Internal API via Streamable HTTP
  internal_api:
    url: "https://internal.example.com/mcp"
    transport: streamable-http
    headers:
      X-API-Key: ${INTERNAL_API_KEY}

Membuat Custom MCP Server

Membangun MCP server sendiri memungkinkan Anda mengekspos internal tools dan resources ke Hermes. Berikut contoh MCP server yang mengekspos codebase analysis dan security scanning:

# my_mcp_server.py
from mcp import Server
import os

server = Server("my-custom-tools")

@server.tool()
async def analyze_codebase(path: str) -> dict:
    """Analyze codebase structure and quality metrics"""
    files = []
    for root, dirs, filenames in os.walk(path):
        for f in filenames:
            if f.endswith('.py'):
                files.append(os.path.join(root, f))
    return {
        "total_python_files": len(files),
        "files": files[:20],  # Limit output untuk mencegah overwhelming context
        "directories": len(set(os.path.dirname(f) for f in files))
    }

@server.tool()
async def run_security_scan(target: str) -> dict:
    """Run security vulnerability scan pada target path"""
    # Implementation: integrate dengan bandit, safety, atau custom scanner
    return {"vulnerabilities": [], "score": 95}

@server.resource("config://app")
async def get_app_config():
    """Expose application configuration sebagai MCP resource"""
    return {"version": "1.0", "env": "production"}

if __name__ == "__main__":
    server.run(transport="stdio")

MCP Management Commands

# Tambahkan server ke config
# Edit ~/.hermes/mcp_servers.yaml

# List semua connected MCP servers
hermes mcp list

# List semua tools dari semua servers
hermes mcp tools

# Test koneksi ke specific server
hermes mcp test <server-name>

# Debug MCP communication
hermes --log-level debug mcp list

Troubleshooting MCP

Masalah	Kemungkinan Penyebab	Solusi
Server tidak start	Command/args salah di config	Cek mcp_servers.yaml syntax dan path
Tools tidak muncul	Allow/block list memblokir	Periksa filter di config, cek hermes mcp tools
Permission denied	Env variables tidak ter-set	Cek ${VAR} di config, pastikan .env ter-load
Timeout	Network issue untuk remote server	Cek connectivity; gunakan stdio untuk lokal
Server crash	Unhandled exception di server code	Cek server logs; tambahkan error handling

Gotchas:

• hermes mcp serve hanya mendukung stdio — untuk HTTP MCP server, perlu adapter terpisah
• MCP server yang crash tidak auto-restart — gunakan process manager seperti systemd atau supervisor
• Tool filtering (allow/block) hanya di client side — server masih expose semua tools ke semua client
• Streamable HTTP transport lebih baru — beberapa MCP server belum support
• MCP sampling memungkinkan server meminta LLM calls nested — potensi security concern yang perlu di-mitigate

6. Multi-Agent Orchestration

Hermes mendukung multi-agent orchestration melalui delegate_task tool yang spawn isolated child agents. Setiap subagent punya conversation, terminal session, dan toolset sendiri. Hanya final summary yang kembali ke parent — intermediate tool calls tidak masuk context window parent, yang menghemat token secara signifikan.

Pola Multi-Agent

Supervisor Pattern — Parent menganalisis task, decompose menjadi subtasks, delegate ke specialized subagents, dan sintesize results:

Parent Agent (Supervisor)
├── Subagent A: Research task
├── Subagent B: Code implementation
├── Subagent C: Testing & validation
└── Subagent D: Documentation writing

Parallel Research Pattern — Multiple subagents meneliti topik berbeda secara simultan, results digabung di akhir.

Pipeline Pattern — Output dari satu subagent menjadi input subagent berikutnya, membentuk processing pipeline:

Stage 1: Data Collection (Subagent A)
    ↓ output file
Stage 2: Analysis (Subagent B)
    ↓ output file
Stage 3: Report Generation (Subagent C)

Batch Delegation dengan Tool Restrictions

Parent bisa membatasi tools yang tersedia untuk subagent — ini krusial untuk security dan fokus:

# Single delegation dengan restricted toolset
delegate_task(
    task="Analyze the security vulnerabilities in /src/auth/ directory",
    context="Focus on SQL injection, XSS, and authentication bypass patterns",
    tools=["terminal", "read_file", "search_files"],  # Hanya tools yang diperlukan
    output_file="/tmp/security-analysis.md"
)

# Parallel batch delegation — multiple tasks sekaligus
delegate_task(
    tasks=[
        {"task": "Review PR #42 for performance issues", "context": "Focus on N+1 queries and memory usage"},
        {"task": "Review PR #43 for security vulnerabilities", "context": "Focus on auth and input validation"},
        {"task": "Review PR #44 for code style", "context": "Focus on naming conventions and structure"}
    ],
    parallel=True
)

Multi-Instance dengan Profiles

Untuk task yang benar-benar independent, jalankan multiple agent instances dengan profile terpisah:

# Parallel instances dengan profile terpisah
hermes --profile coding-assistant chat "Fix the bug in auth.py" &
hermes --profile researcher chat "Research latest security best practices" &
hermes --profile reviewer chat "Review the open PRs" &

Error Recovery Strategy

Multi-agent systems perlu error handling yang robust:

• Subagent failure tidak crash parent — parent menerima error summary dan bisa mengambil keputusan
• Parent bisa retry dengan parameter berbeda atau delegate ke subagent lain
• Timeout per subagent configurable — prevent hanging tasks yang menghabiskan resource
• Parent bisa fallback ke single-agent mode jika delegation repeatedly fails

Gotchas:

• Subagent tidak share state dengan parent — perlu explicit handoff via files di filesystem
• Parallel delegation bisa habiskan token budget cepat — setiap subagent punya full conversation sendiri
• Terminal session isolation berarti subagent tidak bisa akses parent's working directory changes
• Progress reporting di messaging gateway bisa spammy jika banyak subagents berjalan bersamaan

7. Automation & CI/CD Integration

Hermes punya built-in cron scheduler dan webhook platform untuk automation. Cron jobs mendukung natural language dan cron expressions, dengan skill attachment dan multi-platform delivery. CI/CD integration memungkinkan Hermes berjalan dalam GitHub Actions dan GitLab CI sebagai automated code reviewer, tester, dan deployer.

Advanced Cron Configuration

# Membuat cron job via agent conversation
cronjob(
    action="create",
    name="daily-security-scan",
    schedule="0 9 * * 1-5",  # Weekdays at 9am
    prompt="Run security scan on /src directory, save report to /tmp/security-report.md, and send summary to Slack #security channel",
    skills=["code-review", "security-scan"],
    delivery="slack:#security"
)

# Edit jadwal dan prompt
cronjob(
    action="edit",
    name="daily-security-scan",
    schedule="0 8 * * *",  # Ubah ke 8am setiap hari
    prompt="Updated prompt dengan instruksi baru..."
)

# Trigger manual run untuk testing
cronjob(action="trigger", name="daily-security-scan")

# Pause dan resume tanpa menghapus konfigurasi
cronjob(action="pause", name="daily-security-scan")
cronjob(action="resume", name="daily-security-scan")

GitHub Actions Integration

# .github/workflows/hermes-review.yml
name: Hermes Code Review
on:
  pull_request:
    types: [opened, synchronize]

permissions:
  contents: read
  pull-requests: write

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # Full history untuk diff analysis

      - name: Install Hermes
        run: |
          curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

      - name: Run Review
        env:
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          hermes chat "
            Review the changes in this PR.
            Focus on: security, performance, code quality.
            Post review comments on the PR.
            Save detailed report to review-report.md.
          " --workspace-target $GITHUB_WORKSPACE

      - name: Upload Report
        uses: actions/upload-artifact@v4
        with:
          name: review-report
          path: review-report.md

Long-Running Background Tasks

# Jalankan task di background
hermes --background chat "Research and compile report on AI safety trends 2026"

# Monitor progress
hermes jobs list
hermes jobs status <job-id>

# Notification otomatis saat selesai

Automation Blueprints — copy-paste patterns untuk common workflows:

• Daily digest: Monitor sources → compile → deliver ke Slack/Email
• Code quality pipeline: Scan → analyze → report → suggest fixes
• Content pipeline: Research → draft → review → publish
• Monitoring: Check services → alert on anomalies

Gotchas:

• Cron jobs berjalan di process yang sama dengan interactive session — bisa interfere satu sama lain
• Natural language scheduling kadang salah interpret — lebih aman pakai cron expression eksplisit
• GitHub Actions integration perlu API key management yang hati-hati — gunakan GitHub Secrets
• Long-running tasks bisa timeout jika provider rate-limited
• Webhook-triggered actions perlu input validation untuk prevent prompt injection

Bagian III: Operasional & Enterprise (Tier 3)

8. Advanced Memory Management

Hermes memiliki sistem memory persisten yang menyimpan pengetahuan lintas session dalam format Markdown. Setiap profile punya memories terpisah, memungkinkan isolasi konteks antar use case. Sistem mendukung multiple memory providers dan context compression untuk mengelola token budget secara efektif.

Dual Memory Model

Hermes menggunakan dua jenis memory yang saling melengkapi:

• Procedural Memory (Skills): Pengetahuan tentang cara melakukan sesuatu — di-inject ke system prompt sebagai instruksi
• Episodic Memory (Memories): Pengetahuan dari pengalaman — disimpan sebagai Markdown files di ~/.hermes/memories/ dan di-retrieve berdasarkan relevansi

Memory Provider Options

Provider	Tipe	Kelebihan	Kekurangan
SQLite + FTS5	Local DB	Default, zero-config, cepat	Tidak ada semantic search
Honcho	AI-native	Cross-session user modeling, semantic	Perlu API key, external dependency
mem0	Vector DB	Semantic search, scalable	Setup lebih kompleks
holographic	Experimental	Research-grade	Kurang stabil

Memory Provider Configuration

# ~/.hermes/config.yaml
memory:
  provider: honcho  # Options: sqlite, honcho, mem0, holographic, byterover, retaindb
  sqlite:
    path: ~/.hermes/memory.db
    fts5: true                   # Full-text search enabled
  honcho:
    api_key: ${HONCHO_API_KEY}
    user_id: "default"
  retention:
    max_entries: 10000
    auto_cleanup: true
    cleanup_threshold: 9000      # Cleanup saat entries melebihi ini

Context Compression Configuration

# ~/.hermes/config.yaml
context:
  max_tokens: 200000
  auto_compact: true
  compression:
    strategy: summarize          # Options: summarize, drop, sliding_window
    model: openai/gpt-4.1-mini  # Model murah untuk kompresi
    target_tokens: 50000         # Target setelah kompresi
    preserve_tool_results: true  # Jangan summarize tool outputs — kritis untuk kontinuitas
    preserve_recent: 10          # Preserve 10 most recent messages

Memory Maintenance

hermes memory stats                                    # Lihat statistik memory
hermes memory export --output memories-backup.md       # Export untuk backup
hermes memory import --input memories-backup.md        # Import dari backup
hermes memory cleanup --older-than 30d                 # Cleanup entries lama

Gotchas:

• Memory files bisa jadi sangat besar seiring waktu — perlu periodic cleanup
• Context compression bisa kehilangan nuansa — preserve_tool_results: true penting untuk task teknis
• Cross-profile memory sharing tidak tersedia secara built-in — perlu manual export/import
• Memory provider switching tidak migrate data otomatis — perlu manual migration
• FTS5 search kurang efektif untuk semantic search — pertimbangkan Honcho atau mem0

9. Security Hardening

Hermes memiliki 7-layer defense model yang mencakup approval workflows, sandboxing, credential protection, prompt injection defenses, dan access controls. Lima sandbox backend tersedia: local, Docker, SSH, Singularity, dan Modal.

7-Layer Defense Model

Layer 1: Approval Workflows — Agent minta approval untuk destructive operations
Layer 2: Sandboxing — Isolated execution environment (Docker, SSH, dll.)
Layer 3: Credential Protection — .env files, env vars, credential pools
Layer 4: Prompt Injection Defense — Input validation dan sanitization
Layer 5: Access Controls — Tool filtering, restricted toolsets per profile
Layer 6: Audit Logging — Semua tool calls dan operations di-log
Layer 7: Network Isolation — Domain allowlist/blocklist, proxy configuration

Security Configuration

# ~/.hermes/config.yaml
security:
  approval:
    require_for:
      - file_delete
      - network_request
      - credential_access
      - destructive_git_ops
    auto_approve:
      - file_read
      - search
      - non-destructive_commands

  sandbox:
    backend: docker              # Options: local, docker, ssh, singularity, modal
    docker:
      image: "hermes/sandbox:latest"
      network: "none"            # Network isolation
      read_only: true            # Read-only filesystem
      memory_limit: "512m"
      cpu_limit: "1.0"

  network:
    allowed_domains:
      - "api.openai.com"
      - "github.com"
      - "pypi.org"
    blocked_domains:
      - "*.malware.com"
    proxy: "http://proxy.corp.example.com:8080"

Threat Model

Attack Vector	Risiko	Mitigation
Prompt Injection	Agent menjalankan指令 tersembunyi dalam file/code yang dibaca	Input validation, sandboxed execution, approval workflows
Credential Exfiltration	Agent tricked untuk mengirim API keys ke attacker	Network isolation, domain allowlist, credential masking in logs
Destructive Operations	Agent dimanipulasi untuk delete/corrupt files	Approval workflows, sandboxed filesystem, backup strategies
Resource Exhaustion	Agent diminta loop indefinitely atau consume excessive tokens	Token budgets, rate limiting, timeout configuration

Audit Logging

# ~/.hermes/config.yaml
audit:
  enabled: true
  log_file: ~/.hermes/audit.log
  log_level: detailed            # Options: minimal, standard, detailed
  include:
    - tool_calls
    - file_operations
    - network_requests
    - credential_access
    - prompt_inputs
    - model_responses

Gotchas:

• Docker sandbox menambah latency signifikan untuk tool execution — pertimbangkan trade-off security vs speed
• Network isolation bisa block legitimate API calls jika domain list tidak lengkap
• Approval workflows mengurangi otonomi — perlu balance antara safety dan efficiency
• Audit log bisa jadi sangat besar — perlu rotation dan cleanup otomatis
• Prompt injection defense tidak 100% efektif — selalu gunakan defense in depth

10. Performance & Scaling

Performance optimization mencakup token usage management, model routing berdasarkan kompleksitas task, context compression, dan concurrent task execution. Tanpa optimasi, biaya API bisa membengkak dengan cepat di production.

Token Optimization Strategy

# ~/.hermes/config.yaml
model:
  default: anthropic/claude-sonnet-4    # Primary — complex tasks
  fast: openai/gpt-4.1-mini            # Task ringan (5-10x lebih murah)
  fallback: openai/gpt-4.1             # Fallback saat primary gagal

optimization:
  use_fast_model_for:
    - memory_search
    - file_listing
    - simple_classification
    - context_compression
  use_default_model_for:
    - code_generation
    - complex_reasoning
    - multi_step_planning
    - security_analysis

Rate Limiting

# ~/.hermes/config.yaml
rate_limiting:
  enabled: true
  requests_per_minute: 60
  tokens_per_minute: 100000
  backoff_strategy: exponential  # Options: linear, exponential
  max_retries: 3

Monitoring & Profiling

# System health check
hermes diagnose

# Token usage monitoring
hermes stats tokens
hermes stats cost --period daily
hermes stats cost --period monthly

# Debug logging untuk profiling
hermes --log-level debug chat "test task"

# Detailed per-model breakdown
hermes stats --detailed

Trajectory Compression (untuk Training Pipeline)

Jika Anda menggunakan Hermes untuk menghasilkan training data, TrajectoryCompressor memproses completed agent trajectories: mengidentifikasi high-signal segments (tool calls, errors, decisions), summarize low-signal segments (repetitive exploration), preserve training-critical patterns, dan fit dalam target token budget.

hermes batch compress --input trajectories/ --output compressed/ --target-tokens 8000

11. Enterprise Patterns

Deployment enterprise untuk Hermes mencakup multi-profile setup untuk tim, centralized configuration management, integration dengan tools enterprise (Slack, Jira, databases), governance policies, dan disaster recovery.

Team Deployment Architecture

Shared Server / VPS
├── hermes (Gateway Process)
│   ├── Platform: Slack #engineering
│   ├── Platform: Discord #dev-team
│   └── Platform: CLI (SSH access)
├── Profile: team-lead
│   ├── config.yaml (full access, all tools)
│   └── memories/ (supervisor context)
├── Profile: developer-1
│   ├── config.yaml (restricted tools, sandbox enabled)
│   └── memories/ (individual project context)
└── Profile: developer-2
    ├── config.yaml (restricted tools, sandbox enabled)
    └── memories/ (individual project context)

Slack Integration

# ~/.hermes/config.yaml
gateway:
  platforms:
    slack:
      enabled: true
      bot_token: ${SLACK_BOT_TOKEN}
      app_token: ${SLACK_APP_TOKEN}
      channels:
        - "#engineering"
        - "#devops"
      features:
        code_review: true
        issue_triage: true
        daily_digest: true

Jira Integration via MCP

# ~/.hermes/mcp_servers.yaml
servers:
  jira:
    command: npx
    args: ["-y", "@modelcontextprotocol/server-jira"]
    env:
      JIRA_URL: "https://company.atlassian.net"
      JIRA_EMAIL: "agent@company.com"
      JIRA_API_TOKEN: ${JIRA_API_TOKEN}
    tools:
      allow:
        - create_issue
        - update_issue
        - search_issues
        - add_comment
      block:
        - delete_project      # Never allow project deletion

Governance Template

# ~/.hermes/config.yaml.template — Shared across team
security:
  approval:
    require_for:
      - file_delete
      - production_deploy
      - credential_access
  sandbox:
    backend: docker
  audit:
    enabled: true

rate_limiting:
  tokens_per_day: 500000      # Budget per user per day

memory:
  provider: honcho            # Centralized memory untuk team
  retention:
    max_days: 90              # Auto-cleanup setelah 90 hari

Disaster Recovery

# Backup semua data
hermes backup create --output hermes-backup-$(date +%Y%m%d).tar.gz
# Backup mencakup: config.yaml, .env, SOUL.md, memories/, skills/, plugins/, sessions/, cron jobs

# Restore dari backup
hermes backup restore --input hermes-backup-20260703.tar.gz

# Export/import specific profile
hermes profile export work --output work-backup.tar.gz
hermes profile import --input work-backup.tar.gz --name work-restored

Gotchas:

• Shared server deployment perlu process management yang baik — gunakan systemd atau Docker Compose
• Profile isolation berarti tidak ada shared knowledge antar team members tanpa Honcho
• Enterprise integration (Slack, Jira) memerlukan API key management yang terpusat dan secure
• Backup/restore tidak atomic — bisa ada data loss jika terjadi failure saat proses backup
• Governance policies perlu di-enforce di config level — tidak ada centralized policy server

Kesimpulan

Artikel ini membahas Hermes Agent dari perspektif expert — dari arsitektur internal tiga-tier hingga enterprise deployment. Kunci utama untuk menguasai Hermes di level expert:

1. Pahami arsitektur — Semua ekstensi berhubungan dengan tiga-tier architecture; tanpa pemahaman ini, troubleshooting menjadi tebak-tebakan
2. Gunakan credential pools — Rotasi API key krusial untuk production reliability dan menghindari rate limiting
3. Manfaatkan skill chaining — Bangun workflow kompleks dengan koordinasi antar step dan quality gates
4. Bangun MCP server custom — Integrasi tak terbatas dengan ekosistem tool internal dan eksternal
5. Delegasi secara parallel — Subagent isolation + batch delegation untuk throughput tinggi
6. Automate dengan CI/CD — Hermes sebagai automated code reviewer, tester, dan deployer
7. Harden security — Defense in depth, sandboxing, approval workflows, dan audit logging
8. Optimize performance — Model routing, context compression, dan rate limiting untuk cost control

Untuk informasi lebih lanjut, kunjungi dokumentasi resmi Hermes Agent.

Best Practices Summary

Berikut adalah ringkasan best practices yang telah dibahas sepanjang artikel ini, diurutkan berdasarkan prioritas dampak:

1. Selalu gunakan model routing — Jangan gunakan model mahal untuk task ringan. Konfigurasikan fast model untuk summarization dan classification, dan default model untuk code generation dan complex reasoning. Penghematan biaya bisa mencapai 60-70% di production.
2. Implementasi credential pools — Single API key adalah single point of failure. Gunakan minimal 3 key per provider dengan strategi round_robin atau least_used tergantung karakteristik workload.
3. Bangun custom MCP servers — Jangan terbatas pada MCP servers yang tersedia di komunitas. Membangun MCP server untuk internal tools memberikan integrasi yang lebih dalam dan kontrol yang lebih baik atas akses.
4. Gunakan delegation secara strategis — Parallel delegation menghemat waktu tetapi menghabiskan token. Gunakan untuk task yang benar-benar independent, dan pipeline delegation untuk task yang memerlukan koordinasi.
5. Automate review dengan CI/CD — Integrasi Hermes ke GitHub Actions sebagai automated code reviewer memberikan konsistensi dan mengurangi beban manual reviewer.
6. Monitor token usage — Set budget harian dan per-profile. Gunakan hermes stats secara rutin untuk memastikan tidak ada kebocoran token yang tidak terduga.
7. Backup secara berkala — Jalankan hermes backup create minimal mingguan. Simpan backup di lokasi terpisah dari server utama.
8. Defense in depth untuk security — Jangan hanya mengandalkan satu layer pertahanan. Kombinasikan approval workflows, sandboxing, network isolation, dan audit logging untuk proteksi menyeluruh.

Total referensi: 30 sumber dari dokumentasi resmi, DeepWiki, MCP specification, dan komunitas.

Topik yang dicover: 11 topik advanced meliputi arsitektur internal, custom provider, skill development, plugin architecture, MCP advanced, multi-agent orchestration, automation, memory management, security hardening, performance optimization, dan enterprise deployment.

Referensi

#	Sumber	URL
1	Architecture — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/developer-guide/architecture/
2	Agent Loop Internals — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/developer-guide/agent-loop
3	DeepWiki: Hermes Agent Architecture	https://deepwiki.com/NousResearch/hermes-agent
4	Skills System — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/user-guide/features/skills/
5	DeepWiki: Skills System	https://deepwiki.com/NousResearch/hermes-agent/8-skills-system
6	Plugins — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/user-guide/features/plugins/
7	DeepWiki: Plugin System	https://deepwiki.com/nousresearch-hermes-agent/hermes-agent/5.3-plugin-system
8	MCP — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/user-guide/features/mcp/
9	DeepWiki: MCP Server Integration	https://deepwiki.com/nousresearch-hermes-agent/hermes-agent/5.4-mcp-server-integration
10	MCP Specification: Sampling	https://modelcontextprotocol.io/specification/2025-06-18/client/sampling
11	Subagent Delegation — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation/
12	Delegation Patterns Guide	https://hermes-agent.nousresearch.com/docs/guides/delegation-patterns
13	Automation Blueprints	https://hermes-agent.nousresearch.com/docs/guides/automation-blueprints
14	Scheduled Tasks (Cron)	https://hermes-agent.nousresearch.com/docs/user-guide/features/cron/
15	AI Providers — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/integrations/providers/
16	Credential Pools	https://hermes-agent.nousresearch.com/docs/user-guide/features/credential-pools/
17	Provider Routing	https://hermes-agent.nousresearch.com/docs/user-guide/features/provider-routing/
18	Profiles — Hermes Agent Docs	https://hermes-agent.nousresearch.com/docs/user-guide/profiles/
19	DeepWiki: Memory and Sessions	https://deepwiki.com/NousResearch/hermes-agent/4.3-memory-and-sessions
20	DeepWiki: Honcho Integration	https://deepwiki.com/NousResearch/hermes-agent/4.4-honcho-integration
21	Context Compression Tour	https://www.intraview.ai/explore/NousResearch/hermes-agent/tours/context-compression/
22	DeepWiki: Trajectory Compressor	https://deepwiki.com/NousResearch/hermes-agent/9.3-data-generation-and-trajectories
23	Ollama Integration	https://docs.ollama.com/integrations/hermes
24	GitHub: hermes-agent-skill-authoring	https://github.com/NousResearch/hermes-agent/tree/main/skills/software-development/hermes-agent-skill-authoring
25	DeepWiki: Plugins and Memory Providers	https://deepwiki.com/NousResearch/hermes-agent/10.7-plugins-and-memory-providers
26	Use MCP with Hermes Guide	https://hermes-agent.nousresearch.com/docs/guides/use-mcp-with-hermes/
27	DeepWiki: Subagent Delegation	https://deepwiki.com/NousResearch/hermes-agent/5.7-subagent-delegation
28	Hostinger: Hermes Agent Security Guide	https://www.hostinger.com/in/tutorials/hermes-agent-security
29	ChatBotKit: Reference Architecture	https://chatbotkit.com/examples/hermes-agent-reference-architecture
30	mudrii/hermes-agent-docs	https://github.com/mudrii/hermes-agent-docs

Pertanyaan yang Sering Diajukan