Buckle vs Hermes
Hermes is a personal agent that learns as you use it. Buckle does the chores your team forgets.
Updated
The short version
- Buckle
- Does the chores nobody remembers (docs, dependencies, cloud, monitoring, SEO) and creates the PR. Its agents run in sandboxes that hold no credentials.
- Hermes
- The best-engineered open-source personal agent, with skills that improve themselves. Single-tenant by its own description, with credentials in the box with the agent.
How they differ
Who it is for
Built for
BuckleA team's stack: the chores nobody remembers across docs, code, cloud, monitoring and SEO, delivered as pull requests
HermesOne person. A single-tenant personal agent, by explicit design
Identity
BuckleYes: Every agent is tied to an employee, and its access is scoped to what that person already has
HermesNo: No per-user model inside an instance: "within the authorized set, all callers are equally trusted"
Hermes' own guidance for capability separation is to run a separate instance per person, which is the fleet problem restated.
Tenancy
BuckleYes: Multi-tenant. One deployment holds the whole org, with users, teams, and per-person scoping inside it
HermesNo: Single-tenant by design. One operator per instance, so forty people means forty instances to run and update
Credentials
What the agent holds
BuckleYes: Placeholders. Real keys are injected at the wire and never enter the sandbox, including the model key
HermesNo: Real credentials, in a credential file and in process memory
If the agent is compromised
BuckleYes: There is nothing to exfiltrate. The attacker inherits the agent's policy, not its keys, and every request they attempt is still checked
HermesPartly: Credentials are stripped from shell, MCP, and code-execution subprocesses, which Hermes calls a reduction in casual exfiltration and explicitly not containment. Anything in-process, skills and plugins included, can read them
Skills run arbitrary Python at import. A stolen key stays valid until someone notices.
Model keys
BuckleYes: Also a placeholder. The gateway substitutes the real token per request, so model spend is metered and attributable per employee
HermesNo: A real provider key or Portal token in the environment
Most platforms exempt the model key. It is the one with a live balance attached.
Enforcement
Where the boundary is
BuckleYes: The network. The sandbox sits on an internal network with exactly two reachable destinations, so bypassing the gateway is impossible rather than merely discouraged
HermesPartly: The operating system, by their own statement. In-process screening is documented as heuristics that "are not boundaries"
Hermes is right that in-process screening cannot contain an adversarial model. Ours sits outside the process.
What gets checked
BuckleYes: Every outbound request, whatever produced it: an MCP tool call, a CLI, curl in a shell, or code the agent wrote a second ago
HermesPartly: Shell commands matched against dangerous-pattern lists and globs, plus file-write path denylists
A pattern list over shell strings is structurally incomplete, as Hermes notes.
Human approval
BuckleYes: The request is held at the gateway. It cannot proceed until someone approves, and the hold is enforced outside the agent
HermesPartly: An in-loop prompt to the operator, with smart mode using an auxiliary LLM to auto-approve low-risk commands. Container backends skip the checks entirely
Off switch
BuckleYes: No YOLO mode exists. Policy is set by the org, not the agent's user, and the agent cannot widen its own scope
HermesNo: --yolo, /yolo, HERMES_YOLO_MODE=1, or approvals.mode: off disable prompts for the session, above a small hardline blocklist
Where Hermes wins
Self-improvement
BuckleNo: Shared skills and per-agent instructions, authored by people
HermesYes: Autonomous skill creation, self-improving skills, agent-curated memory, and cross-session recall
Hermes' best feature, and we have no equivalent.
Price
BucklePartly: A hosted product, priced per user and agent, with a free plan. Not open source
HermesYes: MIT throughout, free, with an optional Nous Portal subscription for models and managed tools
When to pick which
Pick Hermes when
- You are one person and want the most capable personal agent, for free
- The learning loop is the point: skills that write and improve themselves
- You want it in Telegram, WhatsApp, or Signal
- You want MIT-licensed code to fork, and are comfortable owning the security posture
Pick Buckle when
- You want docs, dependencies, cloud, monitoring and SEO kept current without anyone owning the chore
- The agent must never hold a credential, because you cannot vet every skill and web page it reads
- You need per-request control: block the destructive call, hold the sensitive one for a human
- You want one deployment for the whole org, self-hosted on the Enterprise plan if you prefer
Common questions
Isn't Hermes' Docker backend the same as your sandbox?
Same technology, smaller part of the problem. A container stops a bad command from reaching the host, but the credentials went into the container with the agent. Ours holds none.
Both say "gateway". Is it the same thing?
No. The Nous Tool Gateway routes web search, images, and TTS through Nous' infrastructure so you need fewer API accounts. Buckle's gateway is an enforcement point every outbound request must pass.
Does Buckle have Hermes' self-improving skills?
No. Our skills are authored by people and shared across the org.