The messaging gateway and bot mode
The gateway takes the agent out of the terminal and puts it where people already are — Telegram, Discord, Slack, WhatsApp, Signal, Teams, email and dozens more. The docs speak of 25+ platforms; the feature set varies by platform (voice, for instance, exists on some and not others).
Technically the gateway is a single background process: it handles every configured platform, session routing, scheduling and delivery.
The most important part of the gateway is not its features but its access control. The default the docs give is unambiguous: every user who is not on an allowlist or paired by DM is denied. The check order is:
- a per-platform "allow all" flag
- the list approved through DM pairing
- the platform allowlist (for example
TELEGRAM_ALLOWED_USERS) - the global allowlist (
GATEWAY_ALLOWED_USERS) - the global "allow all" (
GATEWAY_ALLOW_ALL_USERS) - default: deny
If no allowlist is configured at all, the bot answers nobody and logs a warning at startup.
| Mechanism | How it works | When it fits |
|---|---|---|
| Platform allowlist | User IDs are listed in `.env` | A small, stable set of users |
| DM pairing | An unknown user gets a code; the owner approves with `hermes pairing approve` | When users are not known in advance |
| Admin vs user | Admins run every slash command; users only the explicitly allowed ones | A bot in a team channel |
| Per-platform toolset | Each platform gets its own tool set (`hermes-telegram` and so on) | To switch the terminal off in a bot |
The design of pairing codes is worth noticing: 8 characters from an alphabet with look-alikes removed, cryptographic randomness, a one-hour expiry, one request per user per ten minutes, at most three pending codes per platform, a one-hour lockout after five failed attempts, and codes never written to logs. This is built as real access control, not as a convenience.
Even so, the most important warning is simple: setting `GATEWAY_ALLOW_ALL_USERS=true` on a bot with terminal access is effectively opening the machine to everyone.
Practice. Set up a Telegram bot, but make two decisions deliberately: (1) let TELEGRAM_ALLOWED_USERS contain only your own ID, and (2) disable the terminal toolset for that platform with hermes tools. Then ask the bot for something that needs the terminal. Done means: the bot does not do it, and you can explain why.
📚 Sources and documentation
- Messaging platformsofficialhermes-agent.nousresearch.com
The platform list, service installation and access control.
- Bot modeofficialhermes-agent.nousresearch.com
- Security: authorization tiers and pairingofficialhermes-agent.nousresearch.com
The check order, the code design and the production hardening checklist.