Herm
A terminal-native AI coding agent that runs in containers by default, executing tasks safely without approval interruptions.
- Source repo
- aduermael/herm
- Stars
- ★ 231
- Last updated
- 1mo ago
- License
- MIT
- Primary language
- Go
- FA score
- 50/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformOpenAI API · Claude API
- You'll need
- Typical use
- A developer on macOS or Linux who wants an AI to modify project code directly without granting broad host filesystem access—container isolation exposes only the working directory.
- Main limitation
- The default mode requires Docker (Docker Desktop or OrbStack); without a container runtime you must fall back to other isolation methods.
- Source review
- 50/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
Herm is a model-agnostic, general-purpose AI agent hosted at aduermael/herm under the MIT license. It natively supports multiple isolation methods: Docker containers (the CLI default), an in-process Unix-like sandbox, and host sandboxes such as sandbox_exec on macOS or bubblewrap on Linux. The CLI runs on your host while the agent executes inside containers restricted to your current working directory, eliminating permission prompts. Herm supports many providers—Anthropic, OpenAI, Gemini, Grok, OpenRouter, Ollama, Azure OpenAI, Vertex AI, and Bedrock—and lets you mix models within a session. It also writes Dockerfiles dynamically to build per-project environments on demand. Beyond the CLI, the repository develops a native iOS/macOS app (SwiftUI) with an in-process sandbox and a Luau-scriptable runtime for fully on-device task execution. System prompts, skills, and tools are all open source with no hidden instructions.
Running herm launches the CLI on your host while the agent itself executes inside a Docker container, able to read only files in your current working directory. When a task needs extra dependencies, it extends the container environment by writing Dockerfiles dynamically, scoped per project. The agent calls LLM provider APIs you configure (Anthropic, OpenAI, Gemini, Grok, OpenRouter, Ollama, Azure OpenAI, Vertex AI, Bedrock), and you can assign different models to the main agent, exploration, and vision tasks. Isolation is backed by the external submodules langdag (LLM client/orchestration) and cpsl (native sandbox backend). Installation is via an install script or Homebrew; the CLI is written in Go (the repo contains go.mod), and the iOS/macOS app lives under app/apple/.
- A developer on macOS or Linux who wants an AI to modify project code directly without granting broad host filesystem access—container isolation exposes only the working directory.
- Teams that want to combine multiple model providers (e.g., Grok as the main agent, Haiku for exploration, Gemini for vision) without vendor lock-in.
- Security-conscious users who want execution isolation via containers, in-process sandboxes, or sandbox_exec/bubblewrap host sandboxes, without constant approval clicks.
- Users who want to audit or customize system prompts, skills, and tools—everything is open source and forkable.
- iOS/macOS developers interested in a fully on-device agent with a Luau-scriptable runtime (still in development, not yet on the App Store).
How do you install or deploy this agent?
Prerequisites: macOS or Linux (arm64/amd64); Docker (via Docker Desktop or OrbStack) for the default container-based isolation. Install with either:
sh
curl -fsSL https://hermagent.com/install.sh | shor via Homebrew:
sh
brew tap aduermael/herm
brew install hermYou can also build from source following the Setup instructions in CONTRIBUTING.md.
How do you use this agent?
- Install and make sure Docker is running (required for the default container mode).
- From your project directory, run:
herm
- Configure credentials for your chosen LLM provider (Anthropic, OpenAI, Gemini, Grok, OpenRouter, Ollama, Azure OpenAI, Vertex AI, or Bedrock).
- The agent executes inside a container limited to your current working directory; it writes Dockerfiles dynamically to build needed environments without approval prompts. Note: the README does not document the exact provider credential setup commands—consult the repository docs or CONTRIBUTING.md for details.
What are this agent's strengths and limitations?
- Containerized by default: the agent can only touch files in the current working directory, with no permission-prompt interruptions—a clear security model.
- Genuinely multi-provider: mix Anthropic, OpenAI, Gemini, Grok, and other models in one session, assigning models per task.
- Self-building environments: dynamically written Dockerfiles scoped per project reduce manual environment setup.
- Multiple isolation options: containers, an in-process Unix-like sandbox, or sandbox_exec/bubblewrap host sandboxes.
- Full transparency: system prompts, skills, and tools are all open source—auditable and forkable.
- The default mode requires Docker (Docker Desktop or OrbStack); without a container runtime you must fall back to other isolation methods.
- Only macOS and Linux (arm64/amd64) are supported—no Windows.
- The iOS/macOS app is not yet on the App Store and cannot serve as a coding agent in that form.
- Benchmarks against Claude Code, Codex, and Grok Build are still on the roadmap; no published performance evidence yet.
- Provider credential configuration steps are not documented in the README, adding onboarding friction for new users.
How does this agent compare with similar options?
The roadmap explicitly plans to benchmark Herm against Claude Code, Codex, Grok Build, and other coding agents, naming its direct peers. Herm's differentiators are containerized-by-default execution without approval interruptions and fully open prompts, skills, and tools.
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| Herm This agent | 50 · Major gaps | ★ 231 | 1mo ago | Go | OpenAI API · Claude API |
| The Pope Bot | 68 · Some gaps | ★ 1.9k | 4mo ago | JavaScript | Codex · Claude Code · OpenAI API · Claude API |
| ZhikunCode | 56 · Major gaps | ★ 497 | 4d ago | Java | OpenAI API · Claude API |
| Codeg Multi-Agent Coding Workspace | 45 · Major gaps | ★ 3.7k | today | Rust | Codex · Claude Code · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
README claims container-by-default isolation scoped to the current working directory, giving least privilege basic support; but 'no permission prompts' means user confirmation is skipped by default (1); multi-provider data flow has some transparency, yet how credentials are passed into containers is undocumented; large indirect dependency set with no security policy; external effects visible (curl|sh installer, Pages deploy) but install.sh content not provided for review; no rollback evidence; THIRD-PARTY-NOTICES and MIT support attribution. Deductions reflect missing supporting files, not inference.
README, go.mod, and CI workflows are broadly self-consistent (Go 1.24, submodules, test badges); dependencies pinned; but no evidence of failure messages/error handling in supplied files (1).
Audience and constraints are clearly stated (terminal coding agent, macOS/Linux, iOS/macOS app, Docker requirement); but no detail on trigger precision or command semantics.
Clear project structure, multiple install paths, MIT license with third-party notices, and stated known limitations; but the LICENSE copyright line is a placeholder '[Author Name]' — a concrete defect; no CHANGELOG, versioning only via tags; maintenance rests on one unverified individual (1).
Multi-provider model mixing and self-building Dockerfiles give real marginal value (2); but output usability and cost/benefit are unsupported in the files.
README claims map onto the repository structure (prompts/, tools/, install.sh), and facts vs inference are cleanly separated; but claim traceability is limited to static files with no executed evidence, and CI badge results cannot be independently verified.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Container execution with no permission prompts by default: filesystem scope is claimed but network access and write boundaries cannot be verified statically.
- Installer uses curl | sh; install.sh content was not in the reviewed files — inspect hermagent.com/install.sh manually before running.
- LICENSE copyright is a placeholder '[Author Name]'; attribution is incomplete.
- Multi-provider routing sends prompts and code to multiple LLM vendors; assess data flow for sensitive projects.
- Large dependency tree with no SECURITY.md or dependency audit config — run your own vulnerability scan.
- No documented rollback/undo mechanism for changes made inside containers.