How-To Guide
How to Set Up Hermes Agent Browser Automation
Configure Hermes browser automation with Browser Use, cloud or local Chrome, real-profile snapshots, macOS Keychain recovery, CDP, and an evidence-backed smoke test.
Quick answer
Run hermes tools, enable Browser Automation, and choose a browser source. Current installs default to Browser Use CLI 3.0 and browser_exec when the CLI and terminal access are available; confirm with /browser use status and name sessions for concurrent work. Use /browser use off for built-in tools, or /browser connect from the interactive CLI for your own Chrome or Brave. Test one read-only page with a final URL, screenshot, and console check before adding login state or side effects.
Hermes Agent browser automation supports cloud, self-hosted, and local backends. Choose the backend by network and trust boundary: cloud execution for public sites, Camofox for self-hosted anti-detection and optional profile persistence, local Chromium for zero-key operation, or /browser connect when you want Hermes to act inside a dedicated Chrome, Brave, Chromium, or Edge session you can watch. The page is represented as an accessibility tree, while screenshots, vision, and console output supply evidence when the DOM is not enough.
Managed cloud · API costs included · Skill library · Cancel anytime
Before you start:
- ☑Hermes Agent installed and passing
hermes doctor - ☑The Browser Automation toolset enabled in the active profile; start a new session after changing toolsets
- ☑Browser Use CLI 3.0 runnable for the default
browser_execdriver, plus terminal tool access; otherwise Hermes uses the built-in browser tools - ☑Provider credentials only for the cloud backend you choose, or a paid Nous Portal subscription for Tool Gateway access
- ☑Local
agent-browserand Chromium available for local mode or hybrid private-URL routing - ☑A dedicated browser profile and explicit approval boundary for authenticated or side-effecting workflows
Steps
- 1
Choose browser only when interaction matters
Use
web_search,web_extract, RSS, an API, or MCP for simple retrieval. Use browser automation when the answer depends on rendered JavaScript, cookies, login state, buttons, forms, dialogs, responsive layout, screenshots, or console errors. - 2
Enable Browser Automation and inspect the driver
Run
hermes tools, enable Browser Automation, and choose the browser source. Current installs use Browser Use CLI 3.0 as the default driver when it is runnable and terminal access is enabled. In the interactive CLI, run/browser use status; use/browser use offonly when you need the built-in browser tools. - 3
Name sessions when browser work can overlap
Browser Use mode exposes
browser_exec. Pass a distinct session name for every parallel subagent or simultaneous chat. Each name gets isolated harness state and, on cloud backends, a separate browser. Leave the session unnamed only for serial work. - 4
Configure the selected cloud or self-hosted backend
Choose the browser source separately from the driver. For Browserbase set
BROWSERBASE_API_KEYplusBROWSERBASE_PROJECT_ID; for Browser Use cloud authenticate withbrowser-use auth loginorBROWSER_USE_API_KEY; for Firecrawl setFIRECRAWL_API_KEY; for Camofox setCAMOFOX_URL. Lightpanda and local Chromium are keyless local choices. Keep secrets in the active profile environment. - 5
Connect your own Chrome or Brave browser when needed
Start an interactive Hermes CLI session and run
/browser connect. Use/browser statusto verify the CDP attachment and/browser disconnectto detach. This command is CLI-only: Web UI, Telegram, Discord, and other gateway chats treat it as ordinary text. - 6
Run a read-only smoke test
Ask Hermes to open a harmless public page, report the title and final URL, take a screenshot, and list console errors. Confirm navigation, accessibility-tree element references, vision, and console output before testing authentication or forms.
- 7
Verify hybrid local and cloud routing
If a cloud provider is configured, test a public URL and
http://localhost:<port>. Hermes should keep the public URL in the cloud and route localhost/LAN targets to a local Chromium sidecar. Do not weaken private-address protections just to make a cloud browser reach your LAN. - 8
Add persistence only when the workflow needs it
For Camofox, set
browser.camofox.managed_persistence: trueat the correct nested config path, restart Hermes, log in manually, end the task, and confirm a new task remains signed in. Persistence works only if the Camofox server honors stable user-ID profiles. - 9
Gate side effects and define success evidence
Require explicit approval before purchases, submissions, messages, uploads, account changes, or destructive actions. Every production run should report tested URL, viewport, actions, final state, screenshot path, console errors, and blocker.
- 10
Schedule only a stable, idempotent check
After manual verification, pair the browser workflow with Hermes cron, a pinned profile/provider/model/workdir, and an explicit delivery target. Alert on meaningful failures or state changes instead of every successful page load.
- 11
Choose live CDP or a real-profile snapshot
Use /browser connect from the interactive CLI when you deliberately want a dedicated visible Chromium process. Use browser.use_real_profile when a local browser task needs a managed copy of existing login state. On multi-profile machines, set browser.real_profile_pin to Default or the exact Profile N directory so Hermes cannot silently act as the wrong identity.
Pro Tips
- 💡Treat the driver and browser source as separate choices:
/browser use statusidentifies Browser Use mode, whilehermes toolsidentifies the local or cloud browser source. - 💡Use a distinct
browser_execsession name for parallel subagents and simultaneous chats so tabs, daemon state, and cloud sessions do not collide. - 💡Lightpanda is the fast, low-memory local engine; Hermes automatically falls back to Chrome for unsupported actions.
- 💡Browserbase credentials take priority if both Browserbase and Browser Use keys are present; explicitly select the intended provider in setup.
- 💡Use a dedicated
--user-data-dirwhen manually launching Chrome or Brave with remote debugging so an already-running normal browser cannot swallow the debug flags. - 💡Hybrid routing is on by default for localhost, loopback, LAN,
.local,.lan, and.internaltargets; public-to-private redirect tricks remain blocked. - 💡The correct Camofox persistence path is
browser.camofox.managed_persistence, not a top-levelmanaged_persistencekey. - 💡Ask for screenshot paths, final URLs, console errors, and explicit no-overflow checks; a click without verified state is not completion.
- 💡Keep formal deterministic browser tests for CI. Use Hermes for exploratory QA, operational workflows, investigation, and evidence-backed scheduled monitoring.
- 💡If both Browserbase and Browser Use credentials exist, Browserbase takes priority; record the effective backend before debugging.
- 💡Use
/browser connectonly from the interactive CLI, not from Telegram, Discord, WebUI, or another gateway chat. - 💡When a cloud session expires, create a fresh session; do not retry the same stale CDP endpoint indefinitely.
- 💡Inside Docker,
127.0.0.1means the current container. Use the shared-network service name or a supported host alias.
Troubleshooting
❌ `browser_exec` is missing or Hermes shows the built-in browser tools
✅ Run /browser use status in the interactive CLI. Browser Use mode requires a runnable Browser Use CLI and terminal access. A locked-down messaging profile intentionally retains the built-in tools.
❌ Parallel agents overwrite each other’s browser tabs or state
✅ Assign a unique session name to every browser_exec call. The unnamed default daemon is shared and is intended for one-at-a-time work.
❌ Browser tools are missing after setup
✅ Confirm Browser Automation is enabled for the active profile, then start a new Hermes session. Tool changes do not modify the current session's tool schema.
❌ Cloud browser credentials are rejected
✅ Check only the selected backend's key and project fields without printing them. Run a minimal public navigation before adding proxies, stealth, persistence, or scheduled jobs.
❌ `/browser connect` does nothing in Telegram, Discord, or Web UI
✅ That command is implemented only by the interactive CLI. Open hermes in a terminal, run /browser connect, and verify with /browser status.
❌ Chrome or Brave never opens port 9222
✅ Launch a separate browser process with --remote-debugging-port=9222 and a dedicated --user-data-dir. An existing normal browser process may otherwise open the new window without the debug port.
❌ A cloud browser cannot open localhost
✅ Install the local agent-browser sidecar and keep hybrid routing enabled. Hermes should route private and loopback URLs locally rather than sending them to the cloud provider.
❌ Camofox loses login state after every task
✅ Put managed_persistence: true under browser.camofox, fully restart Hermes, and verify the Camofox server version persists profiles by stable user ID. Hermes cannot force persistence if the server creates a fresh context every time.
❌ A page loads but the workflow still fails
✅ Inspect the final URL, accessibility snapshot, screenshot, native dialog state, and browser_console output. A transport-level page load does not prove the CTA, form, checkout, or app state worked.
❌ A CAPTCHA or protected flow blocks progress
✅ Use only authorized provider capabilities and access. If human interaction is required, capture the state and pause or report the blocker; do not guess success or bypass site rules.
❌ Browser Use or another cloud backend returns 502 after the session was idle
✅ Start a fresh browser task and test one public URL. Check provider status and quota, shorten work into checkpoints, and update Hermes if the install predates current expired-session cleanup.
❌ A local app or SearXNG works on the host but connection is refused in Docker
✅ Do not use container-local 127.0.0.1 for a host or sibling service. Use a shared-network service name or supported host alias and verify the URL from the Hermes runtime.
❌ The browser opens but clicks use missing or wrong elements
✅ Take a new accessibility snapshot after navigation, modals, or major DOM changes. Element references belong to the snapshot that created them.
❌ The visible page looks correct but the workflow still failed
✅ Inspect browser console errors and the final network/business result. Require a screenshot plus the expected created record, message, or confirmation before reporting success.
❌ Real-profile browsing opens signed out on macOS
✅ Update Hermes, start a new real-profile session, and test one harmless authenticated page. Current upstream launches the signed browser binary without mock-keychain flags and refreshes the snapshot automatically. Do not delete cookies or expose profile databases while diagnosing it.
FAQ
Why does Hermes show browser_exec instead of separate browser tools?
Browser Use mode is the current default when Browser Use CLI 3.0 is runnable and terminal access is available. It combines browser work into one browser_exec tool. Use /browser use status to inspect the mode or /browser use off to force built-in tools.
How do I run two Hermes browser tasks at once?
Give every browser_exec call a different session name. Named sessions isolate the local harness daemon and cloud browser so parallel agents or chats do not share tabs and state.
What is Lightpanda used for?
Lightpanda is a fast, low-memory local browser engine designed for machine workloads. Hermes falls back to Chrome automatically when an action is not supported.
Do I need Browserbase for Hermes browser automation?
No. Hermes also supports Browser Use, Firecrawl, self-hosted Camofox, local Chromium through agent-browser, and your own Chrome, Brave, Chromium, or Edge over CDP. Paid Nous Portal subscribers can use Tool Gateway browser access without separate provider keys.
How do I use my logged-in Chrome or Brave session?
Use a dedicated browser profile, start Hermes in the terminal, and run /browser connect. Treat the profile as a credential and approve side effects explicitly.
Why does `/browser connect` not work in Web UI or Telegram?
It is an interactive-CLI slash command, not a gateway command. Gateway chats send that text to the model instead of changing the browser connection.
Can Hermes use a cloud browser and test localhost in one task?
Yes. Hybrid routing sends public URLs to the cloud provider and private or loopback URLs to a local Chromium sidecar by default.
How do I persist Camofox logins?
Set browser.camofox.managed_persistence: true, restart Hermes, and verify the Camofox server honors stable per-user profiles. The setting is profile-scoped and must be nested correctly.
Can Hermes replace Playwright tests?
Hermes can run Playwright-style natural-language QA and investigate failures, but deterministic CI suites should remain formal browser tests. Use Hermes where judgment, visual evidence, and cross-tool follow-up matter.
How do I keep browser automation safe?
Use read-only checks by default, isolate profiles, keep secrets out of prompts, gate side effects, respect access controls, and require URLs, screenshots, console output, or artifacts as proof.
What is the difference between /browser connect and browser.use_real_profile?
/browser connect attaches the interactive CLI to a dedicated live Chromium process over CDP. browser.use_real_profile creates and refreshes a Hermes-managed snapshot of an existing Chromium profile for local browser tasks without directly opening the everyday profile.
Related setup and cost guides
Hermes browser automation feature
Compare every supported backend, hybrid routing, persistence, screenshots, vision, console inspection, and safety boundaries.
Browser automation operations guide
Copy practical QA contracts and evidence requirements for real websites and logged-in workflows.
Hermes dashboard
Inspect profile, provider, session, cron, tool, log, and gateway state around browser runs.
AI agent monitoring
Monitor trigger, run, tool activity, artifact, and delivery instead of only process uptime.
Hermes security guardrails
Apply approvals and least privilege to credential-bearing sessions and browser side effects.