Run a Hermes coding agent

Label a GitHub issue, get a pull request. Hermes Agent with your own model key, from the provider you choose.

This template runs Hermes Agent by Nous Research as a coding agent on Dockhold, with your own model key from any provider Hermes supports. You put a label on a GitHub issue in one repository; the agent works on the issue and opens a pull request with its change. You review and merge. It keeps running when your laptop is closed.

Hermes Agent is open source under the MIT license. The template installs it unmodified from its release tag when the image is built. The template is Dockhold's, not Nous Research's. Looking for Hermes in Telegram, Discord or Slack instead? That is the Hermes chat agent.

1. Make two keys

• Model key. An API key from the provider whose model you want, for this app alone, so you can see its spend and revoke it on its own. OpenRouter gives one key for models from many providers. Set a spend limit on the key at the provider if it offers one.
• GitHub token. On GitHub, open Settings, Developer settings, Personal access tokens, Fine-grained tokens, and generate a new token. Under Repository access pick Only select repositories and choose the one repository the agent works on. Under Permissions set Contents, Issues and Pull requests to Read and write.

2. Open the deploy link

Start from the hermes-coding-agent-starter template. Open the deploy link and sign in if asked.

3. Size it, add App storage, make it private

Under App size, pick 1 GB ($10 a month, a paid size). Under App storage, turn it on and pick 10 GB: it holds the checkout, the agent's home folder and the task log. Under Visibility, pick Private. The agent only calls out to GitHub and your model provider, so nothing needs to reach it, and its status page, which shows your repository and issue titles, stays yours. If you don't see Visibility yet, make the app private on its Access tab once it is deployed.

4. Add your secrets, the repository and the model

Under Environment, in the Secrets list, click New secret for each value, tick it, and set its Env var name as below. Give the entries names that belong to this app, because secrets are shared across your apps by name and two apps that share an entry would share a key.

Then add two plain variables: AGENT_REPO with the repository as owner/name, for example octo-org/website, and AGENT_MODEL with the model as your provider names it. If your key is not from OpenRouter, also set AGENT_PROVIDER:

For custom, set AGENT_BASE_URL to the endpoint's https:// address, for example https://api.openai.com/v1. Every provider the template accepts is listed in its providers.json. Providers that sign in through a browser or a cloud account are not offered, since an app that runs unattended cannot sign in.

5. Deploy

Click Deploy and wait until the app shows as running. Its address shows a status page with the repository, the label and the next poll. A private app asks you to sign in first: create a token on the app's Access tab and paste it into the password field.

6. Hand it an issue

In the repository on GitHub, create a label named agent. Open an issue that describes one change, and add the label. Within 10 minutes the agent picks it up, removes the label and works on it. Follow it on the app's Activity tab. When it is done, a pull request is open and the issue has a comment with its link.

How it works

• Every 10 minutes the app lists the open issues that carry the label, oldest first, and claims one by removing the label.
• It fetches your default branch into App storage, makes the branch agent/issue-<number> and runs Hermes on it with a fresh configuration, so nothing carries over from the last task. The prompt is the issue's title and body, plus your repository's AGENTS.md if it has one.
• When the agent is done, the app commits the change, pushes that branch and opens a pull request with the agent's summary, Closes #<number>, the model and the tokens used. It never pushes any other branch and cannot merge; you do.
• One task runs at a time. A task cut short by a restart goes back in the queue on its own.

Security

An agent does what an issue says. An issue runs only when its author has write access to the repository, and issue comments are never read. Review every pull request the agent opens the way you would review a stranger's.

The agent never sees the GitHub token. It is limited to one repository and stays in the app's own program; the agent's processes cannot read it. The agent can read your model key, since it needs it to work, so use a key for this app alone.

Nothing in the checkout is loaded but AGENTS.md. Hermes settings, plugins, MCP servers, hooks and other instruction files in your repository are ignored, so a change to the repository cannot change what the agent runs.

The Dockhold token is optional. With it, the agent gets the Dockhold MCP server and can deploy what it builds to your account. Create it under API tokens in the dashboard sidebar as Read & deploy, or Read-only if the agent only needs to look. It works on every app in your account, not only this one.

Pin what runs. Build again on the app page rebuilds from the template's latest commit. To control exactly what code holds your keys, click Use this template on GitHub and deploy your own copy.

Settings

Change one on the app's Variables tab and click Restart.

Costs

• The app: 1 GB is two 512 MB units, $10 a month. See pricing. If a task runs out of memory while it installs or tests your repository, raise the size on the app's Size tab.
• The model: you pay your provider directly with your own key. Dockhold never pays for it, resells it or adds to it.
• Hermes reports tokens, not money, so each pull request shows the model and the tokens used. Each task stops at AGENT_MAX_TURNS steps or AGENT_TASK_MINUTES. For a hard cap on spend, set a limit on the key at your provider.

The full reference (what App storage holds, every limit, upgrading) is in the template's README.

Credits

Hermes Agent is made by Nous Research and released under the MIT license.

Next

• Run a coding agent with Claude Code
• All templates
• All recipes