Herm
A terminal-native AI coding agent that runs in containers by default, executing tasks safely without approval interruptions.
- Source repo
- aduermael/herm
- Stars
- ★ 233
- Last updated
- 2mo ago
- License
- MIT
- Primary language
- Go
- FA score
- 52/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A developer on macOS or Linux who wants an AI to modify project code directly without granting broad host filesystem access—container isolation exposes only the working directory.
- Not a fit if
- Windows users: only macOS and Linux are supported
- Users who don't want Docker or a container runtime
- Teams needing a shipped App Store app or published benchmarks
- Source review
- 52/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
Herm is a model-agnostic, general-purpose AI agent hosted at aduermael/herm under the MIT license. It natively supports multiple isolation methods: Docker containers (the CLI default), an in-process Unix-like sandbox, and host sandboxes such as sandbox_exec on macOS or bubblewrap on Linux. The CLI runs on your host while the agent executes inside containers restricted to your current working directory, eliminating permission prompts. Herm supports many providers—Anthropic, OpenAI, Gemini, Grok, OpenRouter, Ollama, Azure OpenAI, Vertex AI, and Bedrock—and lets you mix models within a session. It also writes Dockerfiles dynamically to build per-project environments on demand. Beyond the CLI, the repository develops a native iOS/macOS app (SwiftUI) with an in-process sandbox and a Luau-scriptable runtime for fully on-device task execution. System prompts, skills, and tools are all open source with no hidden instructions.
Running herm launches the CLI on your host while the agent itself executes inside a Docker container, able to read only files in your current working directory. When a task needs extra dependencies, it extends the container environment by writing Dockerfiles dynamically, scoped per project. The agent calls LLM provider APIs you configure (Anthropic, OpenAI, Gemini, Grok, OpenRouter, Ollama, Azure OpenAI, Vertex AI, Bedrock), and you can assign different models to the main agent, exploration, and vision tasks. Isolation is backed by the external submodules langdag (LLM client/orchestration) and cpsl (native sandbox backend). Installation is via an install script or Homebrew; the CLI is written in Go (the repo contains go.mod), and the iOS/macOS app lives under app/apple/.
- A developer on macOS or Linux who wants an AI to modify project code directly without granting broad host filesystem access—container isolation exposes only the working directory.
- Teams that want to combine multiple model providers (e.g., Grok as the main agent, Haiku for exploration, Gemini for vision) without vendor lock-in.
- Security-conscious users who want execution isolation via containers, in-process sandboxes, or sandbox_exec/bubblewrap host sandboxes, without constant approval clicks.
- Users who want to audit or customize system prompts, skills, and tools—everything is open source and forkable.
- iOS/macOS developers interested in a fully on-device agent with a Luau-scriptable runtime (still in development, not yet on the App Store).
How do you install or deploy this agent?
Prerequisites: macOS or Linux (arm64/amd64); Docker (via Docker Desktop or OrbStack) for the default container-based isolation. Install with either:
sh
curl -fsSL https://hermagent.com/install.sh | shor via Homebrew:
sh
brew tap aduermael/herm
brew install hermYou can also build from source following the Setup instructions in CONTRIBUTING.md.
How do you use this agent?
- Install and make sure Docker is running (required for the default container mode).
- From your project directory, run:
herm
- Configure credentials for your chosen LLM provider (Anthropic, OpenAI, Gemini, Grok, OpenRouter, Ollama, Azure OpenAI, Vertex AI, or Bedrock).
- The agent executes inside a container limited to your current working directory; it writes Dockerfiles dynamically to build needed environments without approval prompts. Note: the README does not document the exact provider credential setup commands—consult the repository docs or CONTRIBUTING.md for details.
What are this agent's strengths and limitations?
- Containerized by default: the agent can only touch files in the current working directory, with no permission-prompt interruptions—a clear security model.
- Genuinely multi-provider: mix Anthropic, OpenAI, Gemini, Grok, and other models in one session, assigning models per task.
- Self-building environments: dynamically written Dockerfiles scoped per project reduce manual environment setup.
- Multiple isolation options: containers, an in-process Unix-like sandbox, or sandbox_exec/bubblewrap host sandboxes.
- Full transparency: system prompts, skills, and tools are all open source—auditable and forkable.
- The default mode requires Docker (Docker Desktop or OrbStack); without a container runtime you must fall back to other isolation methods.
- Only macOS and Linux (arm64/amd64) are supported—no Windows.
- The iOS/macOS app is not yet on the App Store and cannot serve as a coding agent in that form.
- Benchmarks against Claude Code, Codex, and Grok Build are still on the roadmap; no published performance evidence yet.
- Provider credential configuration steps are not documented in the README, adding onboarding friction for new users.
How does this agent compare with similar options?
The roadmap explicitly plans to benchmark Herm against Claude Code, Codex, Grok Build, and other coding agents, naming its direct peers. Herm's differentiators are containerized-by-default execution without approval interruptions and fully open prompts, skills, and tools.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Herm This agent | 52 · Major gaps | CLIFree + model costs | ★ 233 | 2mo ago | Go | OpenAI API · Claude API |
| Warren | 78 · Good | Self-hosted serviceFree + model costs | ★ 513 | 2d ago | TypeScript | Claude Code |
| Sandcastle | 63 · Some gaps | Library / SDKFree + model costs | ★ 8.9k | 3d ago | TypeScript | — |
| AgenC Core | 76 · Good | CLIFree + model costs | ★ 114 | today | TypeScript | — |
How does FollowAgents rate this agent?
Why each dimension lost points
The README says the CLI defaults to containers limited to the current work directory, while also emphasizing that no approvals are needed. This supports bounded workspace isolation but shows no risk-based confirmation mechanism, so least privilege and user confirmation score 1. The Apple configuration document specifies API base URL, token, model, environment variables, local .env exclusions, and warns that compiled client constants can be extracted; data-flow transparency and sensitive-data handling score 2. Dependencies are listed without audit or mitigation evidence, so dependency security scores 1. The CLI's containers, model providers, and APIs can have external effects, but the packet does not adequately establish authorization boundaries or rollback, so external effects score 1 and rollback 0. The MIT file still contains a placeholder author name, making attribution incomplete; source attribution scores 1.
The README, CLI entry point, Go module, and CI files are broadly consistent, and CI declares several checks, but this static packet cannot establish that they ran successfully; self-consistency scores 2. The project depends on Docker, model providers, and multiple Go modules; some environment requirements are documented, but availability and recovery are not covered comprehensively, so dependency availability scores 1. The debug entry point and CI tool report some failures and exit nonzero; failure messages score 2. This does not establish error handling elsewhere in the Agent, which is not shown.
The README targets terminal coding and multi-model users and distinguishes the iOS/macOS app's use; scenario coverage is adequate but limited, scoring 2. Documentation describes workspace isolation, Apple PCC conditions, fallback behavior, and some tool budgets, providing useful capability boundaries without exhaustively establishing them, scoring 2. Skill frontmatter gives clear use cases and some exclusions, so trigger precision scores 2. The README specifies macOS/Linux, architectures, and Docker requirements, while Apple configuration lists OS, SDK, and entitlement conditions; environment fit scores 2.
The README provides a repository map and documentation entry points, though coverage of directories is limited; information architecture scores 2. Installation offers a script, Homebrew, and source-build path with basic requirements, scoring 2. CLI and project naming are consistent in the packet, scoring 2. The README has a run example and skills include workflow examples, scoring 2; no FAQ is shown. Apple documentation explains PCC prerequisites, configuration constraints, and client-token risk, so known limitations score 2. The license text is MIT, but its copyright holder remains a placeholder, so license scores 1. A version variable and CI/Pages workflows are visible, but the packet shows no user-facing changelog or stable release policy, so versioning and changelog score 1. The repository and contribution documentation offer maintenance clues, but the sample does not establish a responsible maintainer or support commitment, so maintenance responsibility scores 1.
The terminal interface, model selection, tools, and self-building environments have a clear product purpose; static evidence supports usability but no execution was performed, scoring 2. Multi-provider support, isolation options, and container environment creation show value beyond a basic CLI, scoring 2. Docker, model APIs, and potential token charges impose setup and ongoing costs that are not quantified against benefits, so cost-benefit scores 1.
README claims about installation, platforms, and repository structure are partly corroborated by the manifest, Go module, and workflows; Apple configuration gives concrete variables and gates, scoring 2. The README, source entry point, dependency manifest, and CI provide some cross-checking, but sampled files cannot corroborate the full safety and runtime claims, scoring 1. Documentation states PCC conditions, fallback behavior, and client-key exposure risk explicitly, and labels roadmap priorities as subject to change; fact/inference separation scores 2.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- The README claims default containers can access only the current work directory and require no approvals; this sample cannot verify the implementation of that boundary or every tool's permissions.
- The Apple configuration document says compiled API tokens can be extracted from the app binary; do not treat this setup as production secret management.
- The copyright holder in LICENSE is still placeholder text; the dependency manifest alone does not establish that dependencies have been security-audited.
Maintain this project? Add the FARS badge to your README
[](https://followagents.com/en/agents/herm)<a href="https://followagents.com/en/agents/herm"><img src="https://followagents.com/badge/herm.svg" alt="FARS review"></a>Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Changelog * 06b10f99e05db1c08dcd5bc1c9a1a6b2d23573a4 Add configurable document vision to the CLI and Apple app (#92) * c6fe5301e7849d732a98179c823a33c0276fb36b Add persistent iCloud Drive mounts with RO/RW access (#81) * 5ffeaed81f0c2e328cfa48120abf5a507fab7407 Fix CPSL unsafe pointer handling (#86) * b08537cbccf21268f6c6aafbd4bea741c3aef320 Harden CPSL builds with architecture-aware Xcode caching (#94) * 2518c5034c29a5cac2261544b702570a47af8c9d Polish Apple file, calendar, and attachment UX (#95) …View on GitHub ↗ -
Release notes excerpt
Changelog * a73e77bfd72c07a80a5b3c4e9ced8bea29dbfad7 Add Apple CPSL debug app (#70) * 22655657360bd672f0f35b9f3a26176d59211de7 Add CPSL webbrowser integration (#85) * 56f117d2537e7b64d4d5fe38d16cdd391a0d5e89 Add Herm Apple chat UI with CPSL file browsing (#71) * 2f6f69a764b73d446415416860d2651249113e53 Add Swift agent integration for Apple app (#73) * 209f1178c7e0cdb77a973a1caba2bf7e2c4269a5 Add lazy agent skills support (#78) * acc3067b03cc3dbe924892d33ff7679870504133 Add voice dictation to the composer (#82) * 46889ef060dc8f074f805508348414eafcacaa14 Expand file preview support (#84) …View on GitHub ↗ -
Release notes excerpt
Changelog * 15821ed881c2eab5ab36c5f4b4f0da8c826b1a2e Add naked host sandbox mode (#68) * 0516a01dbf5a00ab8bee9d4328ed02e890dd4f6f Improve model display and config wrapping (#69)View on GitHub ↗
FAQ
Am I locked into one model provider?
Can it access all files on my machine?
Why doesn't it ask for permission constantly?
Is Windows supported?
Is the iOS/macOS app the same as the CLI?
Thanks — we use this to improve the page.