Direct answer: choose Hermes AgentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary when your team wants 1 model subscription for every tool through Nous Portal, your server runs Python, and you need the official WhatsApp path through the Cloud APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary. Choose OpenClaw when your team runs Node.js, needs multi-user sessions on 1 shared gateway, and prefers a project stewarded by a foundation with no paid tier. Both are MIT open source, run on your server, and connect to Telegram, Discord, Slack, and WhatsApp.

Main condition: this comparison uses both projects' official pages on 19 September 2026 and 2 observations of our own: Hermes Agent v0.21.3, which we installed in an Ubuntu 24.04 container, and OpenClaw 2026.9.2, which runs on a Rama Digital production server. Limit: both projects release every week. The security claims below are each vendor's claims about itself and about its competitor, not the result of our audit. We do not compare answer quality, because it follows the model you pick, not the agent.

We read the Hermes Agent documentation (Migrate from OpenClaw, Security, FAQ, Nous Portal), the OpenClaw documentation (What is OpenClaw, Install, WhatsApp, Why OpenClaw, and the OpenClaw and Hermes Agent page), the GitHub API for both repositories, and the Nous Portal plans page on 19 September 2026.

The problem: 2 similar projects, 2 stories that needle each other

Hermes Agent and OpenClaw answer the same need: an AI assistant that runs on your own machine and answers from chat. The Hermes documentation ships a hermes claw migrate command that moves an OpenClaw setup over. The OpenClaw documentation has a Why OpenClaw page that compares itself with Hermes on governance and trust boundaries. A reader who searches "hermes vs openclaw" gets 2 vendor narratives, not a table of facts. We described the shift of Indonesian market interest from OpenClaw to Hermes in our analysis of OpenClaw and Hermes Agent trends in Indonesia (Indonesian), and the move itself in our article on migrating from OpenClaw to Hermes Agent (Indonesian). This article is the table of facts.

Diagram comparison table of Hermes Agent and OpenClaw on 8 rows: maker, license, runtime, install, WhatsApp, security, migration, and GitHub
The comparison summary from each project's official pages on 19 September 2026. The bottom strip holds the Rama Digital recommendation with its condition and 1 limit: both projects release every week.

How both work and where they differ

Architecture: a Python core or a Node.js gateway

Hermes Agent is a Python agent with a CLI, a TUI, a desktop app, and a messaging gateway; the WhatsApp bridge and the browser use Node.js. Its official installer provides Python 3.11 through uv and Node.js 26. OpenClaw is a Node.js gateway that its documentation calls the "always-on control plane", requires Node 24.16 or 26.1 and newer, and installs channels as plugins, for example @openclaw/whatsapp. Source: the Hermes Installation documentation and the OpenClaw Install page, 19 September 2026.

Models and cost: a Nous Portal subscription or your own API keys

Both are free and model-agnostic. Hermes offers Nous Portal as its recommended path: 1 OAuth login for 200+ models plus the Tool Gateway, with Plus $20, Super $100, and Ultra $200 per month on the plans page of 19 September 2026. OpenClaw sells no plan; its documentation states the Foundation is funded by donations with no paid tier, hosted service, or token. On both you can still use Anthropic, OpenAI, or OpenRouter keys, or a local model. Source: the Nous Portal plans page and the What is OpenClaw page.

WhatsApp: 2 paths in Hermes, 1 path in OpenClaw

Hermes provides the Baileys bridge through a QR code and the official WhatsApp Business Cloud API adapter through a webhookWebhookAn automatic message one system sends to another the moment something happens, for example an incoming WhatsApp message.Open the glossary. OpenClaw calls WhatsApp "production-ready via WhatsApp Web (Baileys)" through a plugin with QR login, with no Cloud API channel on its channel page. For a bot that serves customers, the Hermes Cloud API path is a difference you can verify. Details are in our Hermes Agent for WhatsApp article. Source: the Hermes Cloud API documentation and the OpenClaw WhatsApp documentation.

Security: each vendor's claims, read as claims

Hermes names the defaults approvals.mode: smart, a hardline blocklist, a gateway that denies every user without an allowlist, and states that real isolation comes from the docker or ssh backend. The Why OpenClaw page quotes the Hermes SECURITY.md, "The only security boundary against an adversarial LLM is the operating system", then explains that OpenClaw separates a trusted gateway from execution that can move to a sandbox, a node, or a cloud worker. The same page admits that OpenClaw's sandbox and exec approvals are off by default and must be configured. The 2 claims do not cancel each other: Hermes locks commands through approvals in 1 process, OpenClaw locks through architecture once you switch it on. Source: the Hermes security guide and the Why OpenClaw page.

Governance and funding

Hermes is built by Nous Research, a venture-funded company; the Why OpenClaw page cites a TechCrunch report from July 2026 about a funding round and the $20 to $200 per month Hermes tiers as the business model. OpenClaw is stewarded by the OpenClaw Foundation, an independent 501(c)(3) with donors including Amazon, GitHub, Microsoft, NVIDIA, and OpenAI according to its own page. The OpenClaw documentation states that OpenAI does not own the project. Both projects are MIT with no differently licensed enterprise edition. Source: the Governance section of Why OpenClaw.

Migration: 1 documented direction

The hermes claw migrate command reads ~/.openclaw/, shows a preview, then moves SOUL.md, MEMORY.md, USER.md, skills, models, MCPMCPA standard that lets an AI program use your tools and data under clear permissions.Open the glossary servers, TTS, and platform tokens; cron jobs and hooks are archived to be recreated. API keys move only when you add --migrate-secrets. WhatsApp must be re-paired through a QR code. The OpenClaw documentation had no import tool from Hermes on 19 September 2026. Source: the Migrate from OpenClaw guide.

Comparison table from the official pages

Item you can verifyHermes AgentOpenClaw
MakerNous Research, a venture-funded companyOpenClaw Foundation, a 501(c)(3)
LicenseMITMIT
Software costFree; optional Nous Portal from $20 per monthFree; no paid tier
RuntimePython 3.11+, Node.js for bridges and the browserNode.js 24.16+ or 26.1+
1-line installinstall.sh from hermes-agent.nousresearch.cominstall.sh from openclaw.ai
Desktop appHermes Desktop for macOS Apple Silicon, Windows, LinuxWindows Hub and a macOS menu bar app
WhatsAppBaileys (QR) or the official Cloud APIBaileys (QR) through a plugin
Security defaults per the documentationsmart approvals, blocklist, gateway deny-allDM pairing; sandbox and exec approvals off by default
Multi-user on 1 gatewaySeparate profiles; admin and user tiers per platformMulti-user sessions with creator, owner, and roles
Migrationhermes claw migrate from OpenClawNo import from Hermes in the documentation
Telemetry per the documentationNoneA daily version check, can be switched off
GitHub on 19 September 2026246,927 stars, 51,802 forks, release v0.21.3 (14 September)390,059 stars, 82,010 forks, release 2026.9.5 (19 September)

Sources: both projects' documentation and the GitHub API on 19 September 2026. Star counts show attention, not quality.

Prerequisites before you decide

  • 1 identical repeated task to test on both.
  • 1 Ubuntu VPS or 2 separate containers so the 2 agents do not share a .env.
  • 1 identical model provider, for example OpenRouter or Anthropic, so the comparison is fair.
  • 1 person who owns the server and reads enough Python and Node.js to read a log.
  • The list of required channels: Telegram, WhatsApp, Slack, or email.

Step 1: Decide who uses it and through which channel

Write 3 lines: who the users are, which channel, and whether outside customers join the chat. When outside customers join through WhatsApp, the official Cloud API path becomes a requirement, and only Hermes documents it. When only the internal team joins through Telegram or Slack, both qualify.

The GitHub page of NousResearch/hermes-agent with 247 thousand stars, the MIT license, and the latest release v0.21.3
The Hermes Agent repository on 19 September 2026. (1) 247 thousand stars and 51.8 thousand forks. (2) The MIT license. (3) The latest release v0.21.3, 4 days before the screenshot.

Verify: the 3 lines are in the team decision document, and the customer WhatsApp need is answered yes or no.

Step 2: Match the runtime with the person who owns the server

When your server owner uses Python every day, the Hermes log, config.yaml, and its venv will feel familiar. When they use Node.js, openclaw.json, npm plugins, and openclaw doctor are closer to their habits. In our test, openclaw status on the Rama Digital production server showed the gateway as a systemd user service, 2 agents, and telemetry switched off.

Terminal showing openclaw --version 2026.9.2 and the openclaw status table with gateway, systemd service, agents, telemetry, and sessions
Our observation on 19 September 2026 on a Rama Digital production server. (1) Gateway service: systemd user, enabled, running. (2) Sessions: 101 active with the default model. Host name, IP, and PID are masked.

Verify: the server owner can run hermes doctor or openclaw doctor and explain 3 of its warning lines without a web search.

Step 3: Read both vendors' security claims, then write your own configuration

Open both security pages and record 3 values per agent: the command approval mode, the user restriction method, and the execution isolation method. For Hermes: approvals.mode, the per-platform allowlist, terminal.backend. For OpenClaw: exec approvals and sandbox mode, the pairing DM policy, and a sandbox or node for execution. Write the values you choose, not the defaults.

The Why OpenClaw documentation page with the explanation of the foundation, donors, and the trust boundary
The Why OpenClaw page on 19 September 2026. (1) The title and the mission statement. (2) The paragraph about the OpenClaw Foundation and its donors. This page holds OpenClaw's claims about itself and about Hermes; read it as vendor claims.

Verify: 6 values are written down, and the sandbox or isolation backend is switched on for whichever agent you pick, because neither switches it on by default.

Step 4: Test the same task for 1 week

Install both in 2 containers or 2 separate users with the same model provider. Run the same task every day, for example a summary of 3 customer emails and a draft reply. Record 4 numbers per day: time to finish, tool calls, tokens, and how many times a human had to step in. The Hermes install guide is in our tutorial for installing Hermes Agent on an Ubuntu VPS.

Terminal showing hermes --version with Hermes Agent v0.21.3, install method git, Python 3.12.3, and Up to date
The Hermes Agent v0.21.3 we installed on 19 September 2026 for this test. (1) The version and the upstream commit. (2) The Up to date status. Record both agents' versions on day 1 of the test, because both release every week.

Verify: 5 days of data per agent in 1 shared table.

Step 5: Decide, then migrate when needed

Pick the agent whose output the team uses with the fewest human interventions and a cost you can explain. When you move from OpenClaw to Hermes, run hermes claw migrate --dry-run first, read the preview, then migrate without --migrate-secrets and enter the API keys by hand. When you stay on OpenClaw, close the Hermes test by removing its container.

The GitHub page of openclaw/openclaw with 390 thousand stars and the latest release 2026.9.5
The OpenClaw repository on 19 September 2026. (1) 390 thousand stars and 82 thousand forks. (2) The License link. (3) The latest release 2026.9.5, published on the day of the screenshot.

Verify: 1 agent runs in production, the other is removed, and the decision is written with a date and both versions.

A simulated 1-week test at a fictional consulting firm

This table is a simulation with dummy data. Konsultan Arah Kompas tested the task "summarise 3 customer emails and draft replies" on both agents with the same model provider.

DayHermes AgentOpenClawChecker note
Monday3 summaries, 1 draft rejected3 summaries, 1 draft rejectedBoth needed a reply-style example
TuesdayA reply-style skill createdThe AGENTS.md file updatedBoth drafts accepted
Wednesday1 approval prompt: an attachment deletedThe command ran without a prompt, sandbox not on yetThe OpenClaw sandbox was switched on that day
ThursdayTelegram message 2 minutes after the emailTelegram message 2 minutes after the emailSame
FridayUpdated to a new version, gateway restartedUpdated to a new version, gateway restartedBoth released that week
Total5 days, 12 tool calls per day5 days, 11 tool calls per dayDifference under 10%

The numbers in this table are an illustration. What decides this simulation is not the numbers but Wednesday: the agent that ran a risky command without a prompt is the agent whose configuration you had not written yet.

Decision checklist

  1. Users, channel, and outside-customer status are written down. Owner: the business owner. Evidence: 3 decision lines.
  2. The runtime matches the server owner. Owner: the server owner. Evidence: they can read both agents' doctor logs.
  3. 6 security values are written and isolation is switched on. Owner: the server owner. Evidence: config.yaml or openclaw.json.
  4. The same model provider on both tests. Owner: the process owner. Evidence: 1 provider name in the table.
  5. 5 days of data per agent with 4 numbers per day. Owner: the process owner. Evidence: 1 table.
  6. The model provider's privacy policy is reviewed; Nous Portal Privacy Mode is enabled when used. Owner: the data owner. Evidence: the settings page.
  7. The decision is written with the date and both agents' versions. Owner: the business owner. Evidence: 1 document.
  8. Stop criterion: when nobody will own the server for either agent, install neither; use a normal chat app.

The Indonesian market signal

In our keyword research of 19 September 2026, "hermes agent" recorded 14,800 searches per month in Keyword Planner with a rising trend, and Google Trends Indonesia showed interest in "hermes agent" rising since April 2026 while "openclaw" fell from its peak. These numbers describe attention, not quality. We describe the method in the trends article linked above. Rama Digital recommendation: decide from your own 1-week test, not from the trend, because your team will own the server.

Frequently asked questions

Is OpenClaw owned by OpenAI? No. The OpenClaw documentation states the project is stewarded by the OpenClaw Foundation, an independent 501(c)(3), and OpenAI is 1 of several donors with no control over the roadmap.

Does Hermes Agent require Nous Portal? No. Nous Portal is the vendor-recommended path, but the official FAQ lists OpenRouter, OpenAI, Anthropic, Google, and local models through Ollama or vLLM as supported providers.

Can I run both at the same time? Yes, in separate users or containers with different bot tokens. Never share 1 Telegram token or 1 WhatsApp number between 2 gateways, because both will fight over the messages.

Which one is more secure? Both state that real isolation is something you switch on: Hermes through the docker or ssh terminal backend, OpenClaw through sandbox mode and nodes. The Hermes default uses smart approvals; the OpenClaw default leaves sandbox and exec approvals off. The more secure one is the one whose configuration you wrote and tested.

How do I move from OpenClaw to Hermes? Run hermes claw migrate --dry-run for a preview, then hermes claw migrate. Without --migrate-secrets, API keys stay behind. Cron jobs and hooks are archived to be recreated, and WhatsApp is re-paired through a QR code.

Is there a tool to move from Hermes to OpenClaw? Not in the OpenClaw documentation as of 19 September 2026. A move in that direction means copying SOUL.md, memory, and skills by hand, then setting up the channels from scratch.

Next step

The 1-week test gives you a decision you can defend with versions and dates. The limits that stay: both projects change every week, and security depends on the configuration you write. When your team picks Hermes, the Hermes Agent Installation Service installs it on a VPS with the provider, gateway, and SOP in 2 to 5 working days. When your team picks OpenClaw, the OpenClaw Installation Service does the same. When you want us to run the 1-week test with you, book a 60-minute Technical Scoping Session.

Sources