Hermes Agent

How-To Guide

How to Set Up Hermes Agent Browser Automation

Configure Hermes browser automation with Browser Use, cloud or local Chrome, real-profile snapshots, macOS Keychain recovery, CDP, and an evidence-backed smoke test.

Quick answer

Run hermes tools → Browser Automation to select the browser source, then /browser use status in the interactive CLI to inspect the driver. A saved browser.cloud_provider choice is explicit; changing a key does not switch it. Start with isolated packaged Chromium or the selected cloud source, verify one public page and one disposable field read-back, then add approved login state only if needed.

Hermes Agent browser automation supports cloud, self-hosted, and local backends. Choose the backend by network and trust boundary: cloud execution for public sites, Camofox for self-hosted anti-detection and optional profile persistence, local Chromium for zero-key operation, or /browser connect when you want Hermes to act inside a dedicated Chrome, Brave, Chromium, or Edge session you can watch. The page is represented as an accessibility tree, while screenshots, vision, and console output supply evidence when the DOM is not enough.

Get Hermes running without the setup →

$49/mo or $39/mo billed yearly · AI included · 14‑day guarantee

Before you start:

  • ☑Hermes Agent installed and passing hermes doctor
  • ☑The Browser Automation toolset enabled in the active profile; start a new session after changing toolsets
  • ☑The bundled Browser Use harness available in Hermes’s own Python environment, plus terminal access for browser_exec; Camofox uses the built-in tools
  • ☑Provider credentials only for the cloud backend you choose, or a paid Nous Portal subscription for Tool Gateway access
  • ☑Local agent-browser and Chromium available for local mode or hybrid private-URL routing
  • ☑A dedicated browser profile and explicit approval boundary for authenticated or side-effecting workflows

Steps

  1. 1

    Choose browser only when interaction matters

    Use web_search, web_extract, RSS, an API, or MCP for simple retrieval. Use browser automation when the answer depends on rendered JavaScript, cookies, login state, buttons, forms, dialogs, responsive layout, screenshots, or console errors.

  2. 2

    Enable Browser Automation and inspect the driver

    Run hermes tools and select Browser Automation. Hermes ships the Browser Use harness as a Python dependency, including in Desktop, and offers browser_exec when terminal access is available. Run /browser use status in the interactive CLI. Camofox and surfaces without terminal access use the built-in tools; a missing harness should be repaired through the Hermes update path.

  3. 3

    Confirm the saved browser source

    Choose the source in hermes tools → Browser Automation. This writes browser.cloud_provider; once selected, adding another provider key does not change it. A missing key for the selected source produces an error instead of a silent provider switch. Nous Tool Gateway can be a source used by the Browser Use driver. Confirm the active Hermes profile before changing credentials.

  4. 4

    Name sessions when browser work can overlap

    Give each independent browser_exec workflow a distinct session name and reuse that name on every later call in that workflow. Current Hermes isolates both harness state and the browser per name, locally and in the cloud. Using a new name on every call would lose the workflow context.

  5. 5

    Configure the selected cloud or self-hosted backend

    After selecting the source, supply only its required credentials: BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID for Browserbase, BROWSER_USE_API_KEY for Browser Use cloud, or FIRECRAWL_API_KEY for Firecrawl. Camofox uses CAMOFOX_URL. Ordinary local browsing uses packaged Chromium with a clean profile, so it needs neither a cloud key nor your normal Chrome window. Follow the API-key safety guide and never print secret values.

  6. 6

    Connect your own Chrome or Brave browser when needed

    Start an interactive Hermes CLI session and run /browser connect. Use /browser status to verify the CDP attachment and /browser disconnect to detach. This command is CLI-only: Web UI, Telegram, Discord, and other gateway chats treat it as ordinary text.

  7. 7

    Run a read-only smoke test

    Open https://example.com and require the final URL, visible H1, screenshot and console result. Then use a disposable form: set one harmless field to HERMES-BROWSER-CHECK, read its value back independently and do not submit. A screenshot alone cannot prove input or a saved record. Use the browser troubleshooting guide if either check fails.

  8. 8

    Verify hybrid local and cloud routing

    If a cloud provider is configured, test a public URL and http://localhost:<port>. Hermes should keep the public URL in the cloud and route localhost/LAN targets to a local Chromium sidecar. Do not weaken private-address protections just to make a cloud browser reach your LAN.

  9. 9

    Add persistence only when the workflow needs it

    For Camofox, set browser.camofox.managed_persistence: true at the correct nested config path, restart Hermes, log in manually, end the task, and confirm a new task remains signed in. Persistence works only if the Camofox server honors stable user-ID profiles.

  10. 10

    Gate side effects and define success evidence

    Require explicit approval before purchases, submissions, messages, uploads, account changes, or destructive actions. Every production run should report tested URL, viewport, actions, final state, screenshot path, console errors, and blocker.

  11. 11

    Schedule only a stable, idempotent check

    Use the cron setup and recovery guide only after manual browser acceptance. Plan for expired cookies, unavailable 2FA and locked source profiles: an unattended run may need to report a blocker. Set an explicit delivery target and reconcile previous results before retrying writes. The monitoring guide defines useful evidence; managed hosting changes who operates the runtime, not the target site’s access rules.

  12. 12

    Choose live CDP or a real-profile snapshot

    Use /browser connect in the interactive CLI for an approved live Chromium session, or browser.use_real_profile for a managed snapshot. Pin browser.real_profile_pin to the intended directory. Read the first result: real_profile_unavailable means a fresh browser without your copied logins. On Windows, save work and fully quit the source browser if its cookie database is locked. On macOS/Linux, cookies can copy while locked password/autofill files are skipped. Verify the intended identity read-only before any authenticated action. See the signed-out recovery checklist and official real-profile behavior.

  13. 13

    Verify consent withdrawal separately from account revocation

    After turning browser.use_real_profile off, the documented snapshot cleanup occurs on the next browser use. Do not equate this local cleanup with revoking website sessions. If credentials were exposed, use the account provider’s revocation controls. browser.real_profile_autoclose only permits an offer to close a locking browser; save work and explicitly approve any profile-bound close action.

Pro Tips

  • 💡Treat the driver and browser source as separate choices: /browser use status identifies Browser Use mode, while hermes tools identifies the local or cloud browser source.
  • 💡Use a distinct browser_exec session name for parallel subagents and simultaneous chats so tabs, daemon state, and cloud sessions do not collide.
  • 💡Lightpanda is the fast, low-memory local engine; Hermes automatically falls back to Chrome for unsupported actions.
  • 💡A saved browser.cloud_provider selection controls the cloud source. Keys provide access; they do not switch an existing selection. Credential autodetection applies only when no selection has been saved.
  • 💡Use a dedicated --user-data-dir when manually launching Chrome or Brave with remote debugging so an already-running normal browser cannot swallow the debug flags.
  • 💡Hybrid routing is on by default for localhost, loopback, LAN, .local, .lan, and .internal targets; public-to-private redirect tricks remain blocked.
  • 💡The correct Camofox persistence path is browser.camofox.managed_persistence, not a top-level managed_persistence key.
  • 💡Ask for screenshot paths, final URLs, console errors, and explicit no-overflow checks; a click without verified state is not completion.
  • 💡Keep formal deterministic browser tests for CI. Use Hermes for exploratory QA, operational workflows, investigation, and evidence-backed scheduled monitoring.
  • 💡Use /browser connect only from the interactive CLI, not from Telegram, Discord, WebUI, or another gateway chat.
  • 💡When a cloud session expires, create a fresh session; do not retry the same stale CDP endpoint indefinitely.
  • 💡Inside Docker, 127.0.0.1 means the current container. Use the shared-network service name or a supported host alias.
  • 💡Use browser.headed: true to watch local browsing on a machine with a display. A display-less host remains headless; the lack of a visible window does not prove that navigation failed.

Troubleshooting

❌ Adding a key did not change the browser provider

✅ Reopen hermes tools → Browser Automation and select the intended source. browser.cloud_provider wins over credential autodetection. Correct that source’s missing credentials without printing them, then repeat a public smoke test.

❌ `browser_exec` is missing or Hermes shows the built-in browser tools

✅ Run /browser use status in the interactive CLI. Browser Use mode requires a runnable Browser Use CLI and terminal access. A locked-down messaging profile intentionally retains the built-in tools.

❌ Parallel agents overwrite each other’s browser tabs or state

✅ Assign a unique session name to every browser_exec call. The unnamed default daemon is shared and is intended for one-at-a-time work.

❌ Browser tools are missing after setup

✅ Confirm Browser Automation is enabled for the active profile, then start a new Hermes session. Tool changes do not modify the current session's tool schema.

❌ Cloud browser credentials are rejected

✅ Check only the selected backend's key and project fields without printing them. Run a minimal public navigation before adding proxies, stealth, persistence, or scheduled jobs.

❌ `/browser connect` does nothing in Telegram, Discord, or Web UI

✅ That command is implemented only by the interactive CLI. Open hermes in a terminal, run /browser connect, and verify with /browser status.

❌ Chrome or Brave never opens port 9222

✅ Launch a separate browser process with --remote-debugging-port=9222 and a dedicated --user-data-dir. An existing normal browser process may otherwise open the new window without the debug port.

❌ A cloud browser cannot open localhost

✅ Install the local agent-browser sidecar and keep hybrid routing enabled. Hermes should route private and loopback URLs locally rather than sending them to the cloud provider.

❌ Camofox loses login state after every task

✅ Put managed_persistence: true under browser.camofox, fully restart Hermes, and verify the Camofox server version persists profiles by stable user ID. Hermes cannot force persistence if the server creates a fresh context every time.

❌ A page loads but the workflow still fails

✅ Inspect the final URL, accessibility snapshot, screenshot, native dialog state, and browser_console output. A transport-level page load does not prove the CTA, form, checkout, or app state worked.

❌ A CAPTCHA or protected flow blocks progress

✅ Use only authorized provider capabilities and access. If human interaction is required, capture the state and pause or report the blocker; do not guess success or bypass site rules.

❌ Browser Use or another cloud backend returns 502 after the session was idle

✅ Start a fresh browser task and test one public URL. Check provider status and quota, shorten work into checkpoints, and update Hermes if the install predates current expired-session cleanup.

❌ A local app or SearXNG works on the host but connection is refused in Docker

✅ Do not use container-local 127.0.0.1 for a host or sibling service. Use a shared-network service name or supported host alias and verify the URL from the Hermes runtime.

❌ The browser opens but clicks use missing or wrong elements

✅ Take a new accessibility snapshot after navigation, modals, or major DOM changes. Element references belong to the snapshot that created them.

❌ The visible page looks correct but the workflow still failed

✅ Inspect browser console errors and the final network/business result. Require a screenshot plus the expected created record, message, or confirmation before reporting success.

❌ Real-profile browsing opens signed out on macOS

✅ Update Hermes, verify the pinned source directory, and inspect real_profile_unavailable. Current macOS/Linux behavior copies cookies while skipping locked password/autofill files; those skipped files alone do not require quitting Chrome. An unreadable cookie database or invalid pin can yield a fresh signed-out browser. Verify identity read-only; never delete cookie databases or change Keychain permissions as a first response.

❌ Nous Portal model works, but browser automation does not

✅ Confirm the active profile and selected source in hermes tools. Browser Use mode can drive the Nous Tool Gateway cloud browser; verify its entitlement and terminal access rather than adding an unrelated Browser Use cloud key. Start a fresh session after toolset changes and test one public URL.

FAQ

Why does Hermes show browser_exec instead of separate browser tools?

Browser Use mode is the current default when Browser Use CLI 3.0 is runnable and terminal access is available. It combines browser work into one browser_exec tool. Use /browser use status to inspect the mode or /browser use off to force built-in tools.

How do I run two Hermes browser tasks at once?

Give every browser_exec call a different session name. Named sessions isolate the local harness daemon and cloud browser so parallel agents or chats do not share tabs and state.

What is Lightpanda used for?

Lightpanda is a fast, low-memory local browser engine designed for machine workloads. Hermes falls back to Chrome automatically when an action is not supported.

Do I need Browserbase for Hermes browser automation?

No. Hermes also supports Browser Use, Firecrawl, self-hosted Camofox, local Chromium through agent-browser, and your own Chrome, Brave, Chromium, or Edge over CDP. Paid Nous Portal subscribers can use Tool Gateway browser access without separate provider keys.

How do I use my logged-in Chrome or Brave session?

Use a dedicated browser profile, start Hermes in the terminal, and run /browser connect. Treat the profile as a credential and approve side effects explicitly.

Why does `/browser connect` not work in Web UI or Telegram?

It is an interactive-CLI slash command, not a gateway command. Gateway chats send that text to the model instead of changing the browser connection.

Can Hermes use a cloud browser and test localhost in one task?

Yes. Hybrid routing sends public URLs to the cloud provider and private or loopback URLs to a local Chromium sidecar by default.

How do I persist Camofox logins?

Set browser.camofox.managed_persistence: true, restart Hermes, and verify the Camofox server honors stable per-user profiles. The setting is profile-scoped and must be nested correctly.

Can Hermes replace Playwright tests?

Hermes can run Playwright-style natural-language QA and investigate failures, but deterministic CI suites should remain formal browser tests. Use Hermes where judgment, visual evidence, and cross-tool follow-up matter.

How do I keep browser automation safe?

Use read-only checks by default, isolate profiles, keep secrets out of prompts, gate side effects, respect access controls, and require URLs, screenshots, console output, or artifacts as proof.

What is the difference between /browser connect and browser.use_real_profile?

/browser connect attaches the interactive CLI to a dedicated live Chromium process over CDP. browser.use_real_profile creates and refreshes a Hermes-managed snapshot of an existing Chromium profile for local browser tasks without directly opening the everyday profile.

Is Nous Portal browser access the same as Browser Use CLI?

No. Nous Tool Gateway is a cloud browser source; Browser Use mode is a driver that can operate that source. Verify both the saved source and effective driver rather than treating them as mutually exclusive subscriptions.

When must I close Chrome for real-profile browsing?

On Windows, a running browser can hold its cookie database with an exclusive lock; save work and fully quit it, including background processes, before retrying. On macOS/Linux, current Hermes can copy cookies while skipping locked password/autofill files. Check the actual error and login state instead of closing it automatically.

What happens if browser.real_profile_pin names a missing directory?

Hermes opens a fresh browser without your copied logins and reports the bad pin. It does not silently use the last-active profile. Correct the directory and verify identity in a fresh session before authenticated work.

Related setup and cost guides

Related Guides