| title | NemoClaw Quickstart with Hermes | |||
|---|---|---|---|---|
| sidebar-title | Quickstart with Hermes | |||
| description | Install NemoClaw, launch a Hermes sandbox, and run your first Hermes prompt. | |||
| description-agent | Installs NemoClaw, selects Hermes, launches a sandbox, and runs the first prompt. Use when setting up NemoHermes or running Hermes inside OpenShell. | |||
| keywords |
|
|||
| content |
|
|||
| skill |
|
|||
| agent-variants |
|
Create a sandboxed Hermes agent, then chat with it from the dashboard or terminal.
The nemohermes command is the NemoClaw CLI with Hermes pre-selected.
Copy this starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want it to guide the installation.
The prompt points the agent to Use NemoClaw Docs with Your Coding Agents, this quickstart, the Markdown docs, and the optional nemoclaw-user-guide skill.
It asks the agent to confirm Hermes before it runs commands that create a sandbox or receive credentials and to use the checked-in local credential helper and form only after you approve the exact command that receives credentials.
If you prefer to control setup directly, use Set Up with the Interactive Installer on Your Terminal.
If you use the coding-agent prompt in the preceding section, you can skip this procedure or keep it as reference. The prompt directs your coding agent to this quickstart, so it has the full setup context.
Review the [Prerequisites](prerequisites) before you begin. Run the hosted installer.```bash
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_AGENT=hermes NEMOCLAW_SANDBOX_NAME=my-hermes bash
```
<Note>
On supported platforms other than N1x, the installer can display `Run express install with these settings? [Y/n]:` before ordinary onboarding.
N1x instead displays `Run the Deferred N1x preview with these settings? [Y/n]:`.
Press Enter to use the recommended express install mode for that platform.
This mode applies preset settings and runs the remaining onboarding non-interactively.
Express install mode preserves the explicit Hermes selection in the install command.
On supported non-N1x express platforms, enter `n` if you want to select a sandbox name, an inference provider, and a model interactively.
On N1x, entering `n` stops installation because the Deferred managed-vLLM preview is the only admitted onboarding path.
Refer to [Use Docker and supported platforms](#use-docker-and-supported-platforms) for more information.
</Note>
The install command creates the `my-hermes` sandbox used in the commands that follow.
If you accept Express setup, wait for the installer to finish, then continue with **Confirm the Sandbox Is Ready**; Express selects the provider and model non-interactively.
If the installer does not offer Express setup, or if you enter `n` at the Express prompt on a supported non-N1x host, choose an inference provider and model, then provide its credential when prompted.
For that interactive path, skip optional web search and messaging setup on a first run, then accept the suggested network policy tier.
```bash
nemohermes my-hermes status
```
```bash
nemohermes my-hermes dashboard-url --quiet
```
Alternatively, start Hermes from the terminal.
```bash
nemohermes launch my-hermes
```
`nemohermes launch` runs the complete preflight or, on Linux, validates an existing fixed 24-hour launch-readiness lease before it starts `hermes` in your terminal.
On macOS, `launch` runs the complete preflight every time and does not publish a launch-readiness lease.
On Linux, if the recorded configuration or live runtime has changed, NemoClaw durably invalidates prior evidence before it runs the complete preflight.
If old evidence might remain acceptable and cannot be invalidated, `launch` stops before preflight or recovery and tells you to repair the secure OS per-user runtime authority or NemoClaw state permissions.
To open a sandbox shell first and start Hermes yourself, run these commands instead.
```bash
nemohermes my-hermes connect
hermes
```
Use these details when your first-run path needs more control.
The Hermes wizard supports the same inference provider choices as the OpenClaw quickstart. Refer to [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) for provider requirements, model choices, and local-server setup.Hermes supports Tavily for web search, not the NemoClaw Brave Search path.
Select it during onboarding and provide `TAVILY_API_KEY` when prompted.
The wizard can also configure supported messaging channels and managed Nous tool gateways when you authenticate through Nous Portal OAuth.
Refer to [Choose Messaging Channels](../manage-sandboxes/messaging-channels/choose-messaging-channels) and [Network Policies](../network-policy/approve-network-requests) before enabling those services.
```bash
export NEMOCLAW_AGENT=hermes
export NEMOCLAW_NON_INTERACTIVE=1
export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
export NEMOCLAW_SANDBOX_NAME=my-hermes
export NVIDIA_INFERENCE_API_KEY=<your-key>
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
```
If NemoClaw is already installed, run `nemohermes onboard`.
Use `nemohermes onboard --resume` to continue an interrupted onboarding session or `nemohermes onboard --fresh` to discard it and start again.
Refer to [Previous onboarding session failed](../reference/troubleshooting#previous-onboarding-session-failed) for recovery details.
```bash
export NEMOCLAW_AGENT=hermes
export NEMOCLAW_SANDBOX_NAME=my-hermes
export CHAT_UI_URL="https://hermes.example.com:18789"
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
```
NemoClaw derives the forwarded dashboard port from `CHAT_UI_URL`, binds it for remote access when the origin is non-loopback, and prints the final dashboard URL in the ready summary.
Otherwise, leave it unset and use SSH port forwarding for remote access.
```bash
ssh -L 18789:127.0.0.1:18789 <user>@<host>
ssh -L 8642:127.0.0.1:8642 <user>@<host>
```
These commands forward the default ports.
Replace them with the sandbox's own ports when `openshell forward list` reports different values.
Configure API clients with the base URL `http://127.0.0.1:8642/v1` after forwarding the API port.
Run `nemohermes my-hermes gateway-token --quiet` to retrieve the API bearer token.
Pass the token in the client's `Authorization` header.
Do not append an OpenClaw `#token=` fragment to either URL.
Treat the dashboard as a local management UI and protect it before you expose it on a shared network.
```bash
nemohermes my-hermes logs --follow
nemohermes my-hermes snapshot create --name before-change
nemohermes inference set --model <model> --provider <provider> --sandbox my-hermes
```
Use `nemohermes my-hermes destroy` only when you intend to remove the sandbox.
Refer to [Recover and Rebuild Sandboxes](../manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) for the recovery workflow.
DGX Spark, qualifying DGX Station, and Windows Subsystem for Linux (WSL) hosts can offer the recommended express install mode after the third-party software notice.
N1x can offer a Deferred preview after the notice, but full physical NemoClaw Express E2E validation is pending.
N1x remains outside the supported-platform set until that validation passes and the platform matrix status is promoted.
Press Enter at the express install prompt to apply preset settings, switch the remaining onboarding to non-interactive mode, and select the managed local inference path for that platform.
On N1x, accept the preview prompt to apply those settings as explicit Deferred preview intent.
On supported non-N1x express platforms, enter `n` to continue with interactive onboarding when you want to select the agent or other settings yourself.
On N1x, declining the preview or setting only `NEMOCLAW_NO_EXPRESS=1` stops installation before onboarding.
Accept the preview, or set `NEMOCLAW_PROVIDER=install-vllm` before installation to provide the required explicit managed-vLLM intent.
The first Hermes build can take several minutes because NemoClaw builds the Hermes sandbox base image when it is not already cached.
The N1x preview selects one-host managed vLLM with `nvidia/Qwen3.6-35B-A3B-NVFP4`.
Refer to [Set Up vLLM](../inference/local-inference/set-up-vllm) for managed model profiles and headless setup.
Refer to [Set Up vLLM on Two DGX Stations](../inference/local-inference/set-up-vllm-on-two-dgx-stations) for the Deferred paired workflow.
Refer to [Platform Support](../reference/platform-support) for current validation status.
The default Hermes sandbox name is `hermes`.
Use a distinct name, such as `my-hermes`, when you run Hermes and OpenClaw sandboxes side by side.
NemoClaw prevents same-name reuse when an existing sandbox uses a different agent.
```text
Sandbox name [hermes]: my-hermes
```
The provider options and credential variables match the standard NemoClaw quickstart.
Refer to [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) for provider-specific prompts.
Hermes offers Tavily Search and does not support the NemoClaw Brave Search path.
When you enable Tavily Search, provide `TAVILY_API_KEY`.
NemoClaw validates the key, stores it in a sandbox-scoped OpenShell provider, writes `web.backend: tavily` into the Hermes configuration, and writes only an OpenShell resolver placeholder into the generated environment.
When you authenticate through Nous Portal OAuth, the wizard can also prompt for managed Nous tool gateways such as web search, image generation, audio, browser automation, and managed code execution.
Those choices add matching Hermes policy presets to the sandbox.
If you select Tavily Search and the managed Nous web gateway, Tavily becomes the Hermes web search and extract backend.
NemoClaw removes `nous-web` from the effective managed-tool selection while preserving selected Nous image, audio, browser, and code tools.
API-key mode is inference-only and does not enable managed tool gateways.
After you select a provider and model, review the summary and confirm the build.
NemoClaw writes Hermes configuration into `/sandbox/.hermes`, routes model traffic through `inference.local`, and starts the Hermes gateway inside the sandbox.
The Hermes image includes runtime dependencies for supported NemoClaw messaging integrations, the API service, and its health endpoint.
The base image does not include unsupported Hermes integrations.
<Note>
Hermes uses an agent-specific baseline policy that allows the Hermes binary and Python runtime to reach required Nous Research service endpoints, PyPI, NVIDIA inference endpoints, and selected messaging APIs.
</Note>
```bash
export NEMOCLAW_AGENT=hermes
export NEMOCLAW_NON_INTERACTIVE=1
export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
export NEMOCLAW_SANDBOX_NAME=my-hermes
export NEMOCLAW_WEB_SEARCH_PROVIDER=tavily
export TAVILY_API_KEY=<your-tavily-key>
export NVIDIA_INFERENCE_API_KEY=<your-key>
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
```
Use the provider variables from [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) when you choose another provider.
Set `NEMOCLAW_WEB_SEARCH_PROVIDER=none` to disable web search explicitly.
When the selector is unset, Hermes enables Tavily automatically when `TAVILY_API_KEY` is available and ignores `BRAVE_API_KEY`.
Changing or disabling Tavily requires sandbox recreation because the backend, credential attachment, and policy selection are build-time inputs.
Rerun onboarding with the new selection and accept recreation, or pass `--recreate-sandbox`.
Hermes exposes its browser dashboard on port `18789` and forwards its OpenAI-compatible API on port `8642` for local clients.
When another sandbox or a host listener already holds either port, NemoClaw allocates the next free port in that port's range.
The ready summary names the port this sandbox uses, and the examples below use the default ports.
The dashboard assets are built into the sandbox image, so the dashboard starts without running `npm` as the sandbox user under `/opt/hermes`.
Dashboard chat uses the prebuilt `/opt/hermes/ui-tui` bundle.
To recover the dashboard manually, use `hermes dashboard --tui --skip-build` so recovery does not try to rebuild assets under root-owned installation paths.
Set `NEMOCLAW_HERMES_DASHBOARD_TUI=1` before onboarding only when you want Hermes' optional in-browser TUI tab.
```text
──────────────────────────────────────────────────
NemoHermes is ready
Sandbox: my-hermes
Model: nvidia/nemotron-3-super-120b-a12b (NVIDIA Endpoints)
Access
Hermes Agent Dashboard
Port 18789 must be forwarded before opening this URL.
http://127.0.0.1:18789/
Hermes Agent OpenAI-compatible API
Port 8642 must be forwarded before connecting.
http://127.0.0.1:8642/v1
──────────────────────────────────────────────────
```
The onboard flow starts both port forwards automatically.
For a new sandbox, NemoClaw reserves the selected dashboard loopback port through sandbox preparation and the image build.
If another listener claims the port before NemoClaw binds the reservation, NemoClaw selects another port before changing sandbox resources.
If OpenShell reports `sandbox is not ready`, NemoClaw waits 5 seconds and retries the affected forward up to three times.
These retries preserve the existing sandbox and selected host port.
NemoClaw releases the reservation immediately before OpenShell starts the dashboard forward.
If forwarding then fails, onboarding removes the new sandbox and tells you to resolve the reported error before retrying.
The Hermes dashboard URL does not include an OpenClaw `#token=` fragment.
`nemohermes my-hermes dashboard-url --quiet` returns `http://127.0.0.1:18789/` when the default local forward is active.
Check the API health endpoint from the host.
```bash
curl -sf http://127.0.0.1:8642/health
```
If that command cannot connect after a reboot or terminal restart, restart the forward.
```bash
openshell forward start --background 8642 my-hermes
```
Configure OpenAI-compatible clients with `http://127.0.0.1:8642/v1`.
Hermes uses API header authentication for client requests.
Do not append an OpenClaw `#token=` fragment to the endpoint.
```bash
nemohermes my-hermes status
nemohermes my-hermes logs --follow
nemohermes my-hermes snapshot create --name before-change
nemohermes my-hermes rebuild
```
`nemohermes inference set` changes the active model or provider without rebuilding the sandbox.
It updates the OpenShell inference route and patches `/sandbox/.hermes/config.yaml` without restarting Hermes.
```bash
nemohermes inference set --model <model> --provider <provider>
```
If the installer changes your Linux Docker group membership, run the printed newgrp docker command before you rerun it.
If nemohermes is unavailable after installing, reload your shell profile or follow the Hermes troubleshooting steps.
- Choose an Inference Provider explains how to choose or change a model and provider.
- Commands explains the
nemohermesalias and its options. - Create and Restore Snapshots explains how to preserve sandbox state.
- Monitor Sandbox Activity explains how to inspect OpenShell events and sandbox logs.