Hermes Desktop is an Electron GUI for Hermes Agent. Shares the same ~/.hermes/ config, sessions, skills, and memory as the CLI. Runs on macOS, Windows, Linux.

Desktop defaults to local mode (starts a local hermes dashboard backend). Remote mode turns Desktop into a thin client — agent runs on VPS, Desktop renders UI via WebSocket.

Server-side Setup

The dashboard must bind to 0.0.0.0 (not 127.0.0.1) so Tailscale IPs can reach the WebSocket endpoint. --insecure disables Host header validation which rejects non-loopback connections.

1. Restart dashboard on 0.0.0.0:

hermes dashboard --host 0.0.0.0 --port 9120 --no-open --insecure

1. Get session token (used by Desktop for auth):

# from terminal (run on VPS):
curl -s http://127.0.0.1:9120/ | grep -oP '__HERMES_SESSION_TOKEN__="\\K[^"]+'

# or open http://127.0.0.1:9120/ in browser, open console, type:
__HERMES_SESSION_TOKEN__

1. Pin the token (optional — avoids token change after restart):

# Add to ~/.hermes/.env:
HERMES_DASHBOARD_SESSION_TOKEN=<token-from-step-2>

Fixed token lets Desktop use a stable HERMES_DESKTOP_REMOTE_TOKEN that survives dashboard restarts.

Network: Tailscale

SSH tunnel (ssh -L 9120:localhost:9120) works but breaks on disconnect. Tailscale is more stable — zero port exposure, auto-reconnection.

Install native Tailscale on VPS:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Desktop connects via http://<tailscale-ip>:9120. No basic auth needed — port is only reachable inside tailnet.

tailscale serve trap: If you previously ran tailscale serve on this port, the rule persists in state and intercepts traffic silently, returning 404. Fix:

sudo tailscale serve --http=9120 off

Clash Verge conflict: If you use Clash Verge TUN mode on the same machine, it may hijack Tailscale traffic (100.64.0.0/10) and route it through the proxy, making the Tailscale IP unreachable. Fix: add bypass rules at the top of Clash config:

IP-CIDR,100.64.0.0/10,DIRECT,no-resolve
DOMAIN-SUFFIX,ts.net,DIRECT

If using Fake-IP DNS mode, also add *.ts.net to fake-ip-filter.

Desktop Client Setup

On Arch (CLI already installed):

On Windows: download .exe from https://hermes-agent.nousresearch.com/desktop.

In Desktop settings → Gateway → Remote Gateway:

• Remote URL: http://<tailscale-ip>:9120
• No auth (open inside tailnet), or use token from step 2

Experience Notes

• First connection: session list loads slowly (initial sync of all history)
• After warm-up: chat is smooth, no perceptible latency
• Both Arch and Windows work
• Thin client — all tools (terminal, file ops) execute on VPS