← Back to compare

Receipt vs Hermes Agent: Self-Directed Autonomy or Organizational Governance

Receipt vs Hermes Agent: Self-Directed Autonomy or Organizational Governance

Hermes Agent learns on its own and answers to the person who runs it. Receipt gives those controls to the organization and records each tool call its gateway handles.

Hermes Agent can finish a hard task, work out what made it succeed, and save the method as a skill for next time. That is useful. It also raises a question of AI agent governance that older assistants never faced: when an agent edits its own playbook, who approves the change?

Hermes leaves that call to the operator who runs the agent. Receipt gives it to the organization the agent works for. This Receipt vs Hermes comparison follows that split through identity, credentials, tool access, skills and the record.

The question is now practical. Hermes documents how to run one Telegram bot for a whole team, and Receipt is built around agents that many people share. Once a second person can instruct an agent, someone has to decide whose authority it uses.

What Is Hermes Agent?

Hermes Agent is an MIT-licensed agent from Nous Research, written in Python. It runs on a laptop, a small server or serverless infrastructure. People reach it from a terminal UI, a desktop app or a local web dashboard. A messaging gateway connects it to Telegram, Discord, Slack, WhatsApp, Signal, email, Microsoft Teams and more.

It registers more than 70 tools, including subagents and scheduled jobs, and works as an MCP client and a stdio MCP server. Shell commands run locally by default, or on six other backends such as Docker, SSH and cloud sandboxes. Dozens of model providers are supported, local models included.

Its defining feature is a learning loop. When the agent works out a non-trivial workflow, it saves the method as a skill and patches it later. An optional write-approval setting, off by default, stages those changes for human review. It also keeps small, bounded memory files.

Safety layers include dangerous-command approvals, deny rules and hooks that can block a tool call. Nous offers a paid Nous Portal subscription for models and tools, and Hermes Cloud for hosted instances. The project is pre-1.0 and releases often. It suits individuals and small teams who want a self-hosted AI agent they fully control.

What Is Receipt?

Receipt is Kentron's hosted agent platform at app.kentron.ai. Its unit of control is the organization, which has owner, admin and member roles and is split into workspaces that hold connections to business systems.

People ask for work from web chat, Slack or Microsoft Teams. Substantive requests become durable background runs. A supervisor model plans each run, and OpenAI's Codex CLI carries out each task in its own sandbox container, removed when the task ends.

Most connected-app calls go through Receipt's gateway. Owners and admins, or members they authorize, choose which operations each connection exposes, and writes stay off until enabled. Each gateway tool call is written to a SHA-256 hash-chained receipt before the provider is called, and refused if that record cannot be written.

Only owners and admins can change the organization's skill catalog. Each version is recorded as a receipt, runs receive skills read-only, and agents do not write their own. Receipt runs only as a hosted service, with OpenAI models for background runs and Anthropic as a web chat option on the customer's own key.

The Architectural Difference

The two products differ in where the controls sit relative to the agent.

In Hermes, the controls live with the agent. The operator's Hermes home holds the configuration, a .env file of API keys, enabled toolsets, approval settings, memory, skills and session history. The agent process reads all of it, and through its skill tool it can rewrite part of it. Nous is candid about the consequence. The project's security policy says, "The only security boundary against an adversarial LLM is the operating system." Approval gates, scanners and allowlists inside the process count as heuristics, not containment.

Authority follows the same shape. The agent acts with the operator's accounts and keys, and anyone on a gateway allowlist borrows them. The policy is explicit: "Within the authorized set, all callers are equally trusted." People who need different permissions are advised to run separate instances.

Receipt moves the controls out of the run. The agent works in a sandbox, but its calls to connected apps normally go through a gateway that applies the organization's settings. On each call, the gateway re-checks the requester's workspace membership and the connection's operation allowlist. It writes an intent receipt, and only then calls the provider. Organization skills arrive read-only, so the run cannot rewrite them. Only owners and admins can change skills, and connections need that role or an explicit grant.

Each design has a cost. Hermes gives the operator complete control and complete responsibility for hardening and oversight. Receipt takes that flexibility away from the agent and the individual user, and hands the decisions to workspace owners and organization admins.

Receipt vs Hermes Agent

The table sets out where each control sits.

DimensionReceiptHermes Agent
TenancyOrganizations with roles, split into workspacesOne operator per install; separate instances for separation
Whose authorityActs for the requester over workspace-owned connectionsThe operator's accounts, keys and bot tokens
Caller separationMembership re-checked on every gateway callAll allowlisted callers share the same capabilities
Tool accessAdmins enable operations per connection; writes off by defaultOperator enables toolsets and filters MCP tools
CredentialsAttached server-side on gateway calls; sandboxes hold an OpenAI key.env file or secret manager, loaded into the agent process
SkillsAdmin-managed, versioned, receipted, mounted read-onlyWritten and patched by the agent; review optional
Checks before actingOptional approval before a run; blocklist and secret checksDangerous-command approvals, deny rules, blocking hooks
ExecutionKentron-hosted container per task; no outbound network policyOperator's machine by default; Docker, SSH or cloud sandboxes
Record and replayHash-chained receipts; replay rebuilds state, never re-runsSQLite sessions and logs; search, export, opt-in rollback
ModelsOpenAI for background runs; Anthropic in web chat on your keyDozens of providers, including local models

A Real-World Example

A support team wants an agent that triages new tickets, looks up each customer in the CRM, drafts replies and gets better at triage over time.

Identity. In Hermes, the operator connects a bot to the support channel and allowlists the team. Each teammate gets a separate session, but all of them share the operator's capabilities. In Receipt, each teammate links a Receipt account, and a run acts for whoever asked, through the support workspace's connections. The CRM still sees the account that connected it.

Credentials. Hermes loads the CRM key from the operator's .env file into the agent process. An optional egress proxy keeps model-provider keys out of Docker sandboxes. Receipt holds the CRM credential in its integration server and attaches it on gateway calls. That is a default path, not a sealed boundary. The sandbox holds an OpenAI key, and its token can fetch stored workspace credentials when a task needs a connector.

Tool access and policy. The Hermes operator picks toolsets and approval settings. In the default smart mode, an auxiliary model can approve low-risk commands, and a hook could block CRM writes. In Receipt, CRM reads are on by default, and the gateway refuses writes until an admin enables them. The workspace can also require approval before each run starts.

Learning. Hermes learns that refund tickets need an order lookup first and patches its triage skill, staged for review if the operator opted in. In Receipt, an admin saves the triage skill as a recorded version, and runs cannot change it. There is no review step; control comes from who can save.

Execution. The Hermes operator chooses a backend and hardens it. Receipt runs each task in a container it hosts and removes.

Investigation. For a disputed reply, the Hermes operator searches session history and logs on the host. In Receipt, the Slack answer links to the run's replay, where each CRM call has a receipt naming the requester and workspace.

Where Hermes Agent Wins

Hermes is free, MIT-licensed software that you can read, change and run without asking anyone. You pay only for the models and machines you pick.

Model choice is wide open: dozens of providers, local models, and a one-command switch. It runs anywhere from a laptop to serverless sandboxes that sleep when idle. The project collects no telemetry, and conversations, memory and skills are stored in a local folder.

The learning loop is genuine. An agent that turns experience into reusable skills gets more useful over time, and Receipt has nothing comparable.

Reach is broad too: more than 70 tools, scheduled jobs, and channels Receipt does not serve, such as Telegram, WhatsApp and Signal. Command safety is finely configurable, with deny rules that hold even in YOLO mode and hooks that fail closed on timeout. The threat model says plainly which layers contain the agent and which are heuristics. For one person, or a small team whose members trust each other, Hermes is more flexible than Receipt.

Where Receipt Wins

Receipt is built for many people with different access under one organization. Connections belong to workspaces, and admins choose the operations each one exposes. The gateway runs a tool call only for a member of the workspace that owns the connection. Hermes treats every authorized caller alike and points teams that need separation to separate instances.

Skill changes have an owner. Only organization owners and admins can create, version, enable or delete a skill. Each change is recorded as a hash-chained receipt naming who made it, and runs cannot rewrite the files.

The record comes first. A gateway tool call is written to a receipt before the provider is called. Run state is rebuilt by folding receipt streams, so a run's history and its state come from the same data. The replay view walks a run step by step without re-running it.

There is also no agent infrastructure for the team to run or harden, though the team cannot tune it either.

The limits matter. Receipts are unsigned hash chains, tamper-evident when verified. They cover gateway calls, not model calls or sandbox shell commands. Sandboxes are containers on a shared host with no outbound network policy. Approval covers a whole run, not each step, and a skill goes live when saved.

Which Should You Choose?

Choose Hermes Agent if you are one person or a small team whose members trust each other. It fits when you want any model, a self-teaching agent and data on your own machines. You also need to be ready to own the hardening.

Choose Receipt if several people with different access need agents to act in shared business systems. It fits when the organization should decide which operations and skills apply, and when you need to show who asked for what.

Use both when the line is clear: Hermes as a personal assistant, Receipt for shared systems. Hermes is an MCP client and Receipt hosts an MCP server, so Hermes could in principle use a Receipt workspace's tools. Kentron has not tested that pairing, and its receipts would name the operator rather than each teammate.

Conclusion

AI agent skills are standing instructions, and whoever can change them sets policy. On a personal agent that is the operator, and the Hermes learning loop is a clear advantage: the agent improves without anyone filing a request. On a shared agent, the same edit changes how a whole team works, so it needs an owner and a history. Hermes is built for an agent that teaches itself. Receipt is built for an organization that decides what its agents follow. Choose by asking who your agent works for.

Hermes Agent details are based on its official documentation and announcements as of October 7, 2026; Receipt details reflect the product as shipped on that date. Both change quickly, so check the sources below for current behavior.

Sources