agentlytics
Comprehensive analytics dashboard for AI coding agents — Cursor, Windsurf, Claude Code, VS Code Copilot, Zed, Antigravi…
Browser-native side panel for Hermes Agent — connect web context to your local Hermes runtime.
git clone https://github.com/abundantbeing/hermes-browser-extension.gitabundantbeing/hermes-browser-extensionBrowser-native side panel for Hermes Agent — connect active web context through a local gateway, Hermes Cloud, or a self-hosted remote gateway.
Created by Jon Komet (
@abundantbeing). Community extension for Hermes Agent by Nous Research.
Public alpha v0.2.0 · Load unpacked · Local / Hermes Cloud / Remote · Full Hermes runtime tools
Not on the Chrome Web Store yet.
Hermes Browser Extension is not a browser chatbot. It is a Chrome/Edge/Chromium side panel for the real Hermes Agent runtime. Choose a local gateway, attach to a signed-in Hermes Cloud agent tab, or connect to a self-hosted remote API/dashboard. Local and remote API connections can use the models, tools, skills, sessions, memory, and MCP servers already configured in Hermes; Cloud and dashboard-ticket connections are intentionally Chat-only.
This repo is specifically for the Hermes Browser Extension: the Chrome/Edge/Chromium side-panel integration for Hermes Agent.
Hermes Assist adds a compact, site-aware drafting panel beside supported text composers. It recognizes 31 writing environments and adapts its primary action to the surface—such as Draft a reply, Draft a post, or Draft a message—while preserving useful site-specific actions.
Every model-backed action runs through the connected Hermes Agent. When the gateway advertises per-session model locking, Hermes Assist sends the exact selected provider/model and fails closed if Hermes does not acknowledge it. Released gateways without that contract use the active model configured in Hermes Agent and receive no unsupported override fields. Results are reviewed before use. Safe plain-text composers can apply a draft only after an explicit user action; framework-owned structured editors default to preview/copy. Hermes Assist never clicks Send/Post/Submit, navigates, purchases, or operates the page autonomously.
Private surfaces use per-site context controls and conservative defaults. Browser context remains bounded, redacted, labeled as untrusted, and visible to the user before it is sent.
| Side panel | Theme settings | Local agents |
|---|---|---|
![]() |
![]() |
![]() |
| Browser behavior | Page-only context | Hermes compatibility |
![]() |
![]() |
![]() |
Open the extension's full view for canonical Hermes sessions, model/runtime control, rich messages, generated media, and accurate session context telemetry in a browser-native workspace.
Hermes Web Alpha currently uses token-backed Local or Remote API connections. Hermes Cloud Preview and ticketed remote-dashboard transports remain Chat-only in the side panel; live full-view dashboard handoff is not shipped yet.
Start a fresh canonical Hermes Web session
Choose from nine themes with Light and Dark modes
Read rich Hermes responses while canonical history stays attached
http://127.0.0.1:8642./meta / /metadata / /head for truthful captured-page metadata analysis: it reports only what the Browser context actually contains and explicitly calls out metadata classes that were not captured.Alt+H by default, customizable at chrome://extensions/shortcuts)./summarize, /explain, /rewrite, /tabs, and /action-items.[tool] markdown appended into answers.NoneType/int() traceback class.debugger, nativeMessaging, cookies, history, bookmarks, checkout, navigation, or autonomous browser-control permissions in v0.2.0. The downloads permission is used only when the user explicitly saves generated images or artifacts. Hermes Assist can place a reviewed draft into a supported focused composer only after an explicit user action and never submits it.npm run build:firefox.| Surface | Supported in v0.2.0 | Fallback / note |
|---|---|---|
| Chrome / Edge / Chromium 114+ side panel | Yes | Primary public support target. |
| Brave / Comet / Chromium forks | Best-effort | Must expose the Chromium Side Panel API and extension clipboard permissions for Copy Diagnostics. |
| Firefox | Preview package | npm run build:firefox produces dist/firefox/ with Firefox-specific manifest adaptation. Chrome/Edge/Chromium remain the primary public support target. |
| Safari | Not shipped | Browser-family diagnostics exist, but no Safari package is included. |
| Local Hermes API server | Yes | Default path: http://127.0.0.1:8642. |
| Hermes Cloud | Yes, Trusted Dashboard Attach | Requires an active signed-in HTTPS Hermes Cloud agent tab. Uses a single-use WebSocket ticket and enforces Chat-only context. This is not a general cookie import or background account-discovery flow. |
| Remote API server | Yes, explicit URL/token only | Use trusted LAN/Tailscale/VPN or HTTPS reverse proxy; do not expose Hermes naked to the internet. |
| Self-hosted remote dashboard WebSocket | Best-effort | Select Remote gateway with an HTTPS dashboard URL and no API key. Chat/session/model path only; REST-only profile/skills/image-upload surfaces remain unavailable. |
| Hermes Web full view | Local/Remote API alpha | Requires a token-backed Local or Remote API connection. Cloud Preview and ticketed remote-dashboard transports remain Chat-only in the side panel. |
| Browser Context Protocol | Yes | Extension emits typed hermes.browser.context.v2 turn envelopes while retaining the v1 prompt compatibility path. |
| Hermes Assist | Yes, site-aware preview/review | 31 writing environments are recognized. Safe plain-text composers may apply after explicit review; structured/private surfaces can fall back to copy-only. Hermes Assist never submits. |
| Companion plugin | Optional functional context cache | companion-plugin/ provides read-only tools/hooks for sanitized Browser context; not required for normal extension use. |
| Browser control / Runs UI / debugger / nativeMessaging | No | Deferred until supportability, action policy, approvals, and logs exist. |
git clone https://github.com/abundantbeing/hermes-browser-extension.git cd hermes-browser-extension npm install npm run build
The loadable extension is generated at:
dist/
chrome://extensions or edge://extensions.dist/ folder — not the repo root and not extension/.After code updates, run npm run build again and click Reload on the Hermes Browser Extension card in the browser extensions page.
Settings exposes the same three product-level choices as Hermes Desktop:
| Connection mode | Use it for | Transport and boundary |
|---|---|---|
| Local gateway | Hermes running on this machine | Local API server, default http://127.0.0.1:8642, with a scoped browser token or API_SERVER_KEY. |
| Hermes Cloud | A signed-in Hermes Cloud agent open in a normal browser tab | Trusted Dashboard Attach mints a short-lived, single-use WebSocket ticket from the active HTTPS agent tab. Chat-only; no page text, selected text, open-tab context, or attachments are sent. |
| Remote gateway | A self-hosted Hermes backend on another machine or behind a trusted proxy | With a key: remote API server. Without a key: signed-in HTTPS dashboard ticket/WebSocket. |
Existing installations migrate automatically: prior local-api settings become Local gateway, while prior remote-api and remote-dashboard settings remain Remote gateway. A legacy remote dashboard is never silently relabeled as Hermes Cloud.
Local-only is the safest default. Put this in ~/.hermes/.env on the machine running Hermes:
API_SERVER_ENABLED=true API_SERVER_HOST=127.0.0.1 API_SERVER_PORT=8642 API_SERVER_KEY=<your-api-server-key> API_SERVER_CORS_ORIGINS=chrome-extension://<your-extension-id>
Start or restart the gateway:
hermes gateway run
Verify the API server:
HERMES_GATEWAY_URL=http://127.0.0.1:8642 HERMES_API_TOKEN='<your-api-server-key-or-browser-token>' curl "$HERMES_GATEWAY_URL/health" curl -H "Authorization: Bearer $HERMES_API_TOKEN" "$HERMES_GATEWAY_URL/v1/models"
Then in the extension side panel:
http://127.0.0.1:8642.API_SERVER_KEY.https:// page and ask: Summarize this page in one sentence.For a remote Hermes machine, bind the API server to a reachable trusted interface and keep CORS narrow:
API_SERVER_ENABLED=true API_SERVER_HOST=0.0.0.0 API_SERVER_PORT=8642 API_SERVER_KEY=<your-api-server-key> API_SERVER_CORS_ORIGINS=chrome-extension://<your-extension-id>
Use a private same-LAN/Tailscale/VPN host with HTTP, or put the API server behind a trusted HTTPS reverse proxy for public/proxied access. Do not expose the Hermes API server naked to the public internet. The Hermes API server can access the real Hermes runtime and tools.
Examples:
http://192.168.1.50:8642
http://hermes-desktop.local:8642
https://hermes.example.com
In the extension side panel:
http:// or https://.With a key present, Remote means Remote API server and does not force HTTPS. With the key blank, Remote means Remote dashboard WebSocket and requires an https:// dashboard URL.
Hermes Cloud Preview uses Trusted Dashboard Attach:
The extension binds trust to that exact active tab and HTTPS origin, verifies the tab again before minting, mints a short-lived single-use WebSocket ticket in the page, and verifies the WebSocket handshake before reporting success. The ticket is kept in memory only and is never persisted or logged. Cloud never falls back to localhost or a stored Local API token.
Hermes Cloud is Chat-only in this release. Browser page text, selected text, open-tab context, and attachments are disabled for this mode. The extension does not read dashboard cookies, store a Cloud password, or add cookies or nativeMessaging permissions.
If the connected Cloud agent does not expose /api/auth/ws-ticket, /api/ws, or the required session/model RPC methods, the extension reports the missing capability and leaves Local/Remote settings untouched. Update that agent's Hermes runtime using the official Hermes Agent installation and update docs. It never redirects Cloud to 127.0.0.1 as a fallback.
If you run Hermes elsewhere and only expose the OAuth-gated dashboard, select Remote gateway, enter the dashboard's https:// URL, and leave the API key blank. With no key, the extension connects over the dashboard's /api/ws socket instead of the REST API server. This remains a Remote gateway connection; it is not automatically relabeled as Hermes Cloud.
Auth uses a single-use WebSocket ticket minted from a signed-in dashboard tab:
Limitations in this mode: image attachments are inline-only, and the skills/profiles lists are unavailable because those are REST-only and the dashboard's REST surface is not reachable cross-origin.
After a Local or Remote API connection, the side panel loads from the connected Hermes gateway:
/v1/models — all providers/models Hermes can enumerate, including provider-qualified IDs./api/sessions — recent Hermes sessions grouped by source./v1/skills — slash-command skill suggestions in the composer./v1/profiles — profile picker when the gateway exposes profile metadata./v1/capabilities — feature flags such as audio transcription and Browser upload support.The DOM/context chip should show a non-zero page-context count on normal readable pages. Browser internal pages such as chrome://extensions are intentionally restricted.
Context compression remains owned by Hermes Agent, using each runtime's effective context_length and configured compression threshold. The Browser and Web surfaces display the authoritative persisted/live fields when available: last_prompt_tokens, threshold_tokens, context_length, usage_percent, and compression_count.
You can ask Hermes to help install it:
Install Hermes Browser Extension from https://github.com/abundantbeing/hermes-browser-extension. Clone it, run npm install, run npm run build, then use computer use to open chrome://extensions, enable Developer mode, and load the dist folder unpacked. Help me choose Local gateway, Hermes Cloud through my active signed-in agent tab, or a self-hosted Remote gateway. Do not reveal, print, screenshot, or commit any API key or WebSocket ticket.
Hermes Browser Extension is intentionally conservative in v0.2.0:
debugger, nativeMessaging, cookies, history, or bookmarks permissions. downloads is limited to explicit user-requested generated-image/artifact saves.See SECURITY.md, PERMISSIONS.md, DATA-FLOW.md, and PRIVACY.md for details.
Make sure you loaded dist/, not the repo root. The selected folder must contain manifest.json directly.
The browser is still using an old unpacked folder or an unpacked extension card that was not reloaded. For v0.2.0, the source manifest, built dist/ manifest, and release archive should all contain manifest.json version 0.2.0.
Fix:
npm run build locally.chrome://extensions or edge://extensions.dist/ folder.Open Settings → Support diagnostics → Copy Diagnostics and paste the report into the GitHub issue or support thread.
The copied block includes version/build, browser family, gateway origin, connection state, runtime capability flags, selected model/provider, context mode, extractor mode, and last visible error. It intentionally excludes API keys, bearer tokens, cookies, page text, selected text, tab titles, and full tab URLs.
Check that Hermes Gateway/API server is running and reachable from the browser:
curl http://127.0.0.1:8642/health # or, for remote mode: curl http://<trusted-remote-host>:8642/health
If /v1/models fails, check API_SERVER_KEY, the extension's stored API key/browser token, and API_SERVER_CORS_ORIGINS. For remote mode, the browser extension origin (chrome-extension://<id>) must be allowlisted on the Hermes machine.
v0.2.0 separates gateway reachability from upstream Hermes runtime/tool failures. If /health works but Hermes raises a runtime traceback, the Browser stays connected and shows the warning instead of turning the whole connection red.
For tracebacks like int() argument must be a string, a bytes-like object or a real number, not 'NoneType', check the Hermes Agent logs on the machine running the gateway. If the traceback mentions computer_use or cua-driver, run:
hermes computer-use doctor
That diagnostic belongs to the Hermes runtime/tool layer, not to Browser extension packaging or Chrome permissions.
Hermes Browser Extension does not request browser-control permissions and does not drive pages itself. Native desktop control comes from Hermes Agent's computer_use toolset via cua-driver.
On the machine running Hermes, verify computer use directly:
hermes tools list hermes computer-use status hermes computer-use doctor
If doctor says the driver is missing:
hermes computer-use install
Then start a fresh Hermes session with the toolset enabled:
hermes -t computer_use chat
Common blockers from the Hermes docs:
0 charsOpen a normal https:// page and refresh context. Browser internal pages (chrome://, edge://, extension pages, devtools, etc.) are restricted by design.
Chromium side panels can suppress microphone permission prompts. Hermes Browser Extension handles this with capability-gated voice modes:
Suggested flow:
If Chromium still says the mic is blocked, click Open microphone settings in the voice tab and set Microphone to Allow for chrome-extension://<the Hermes extension id>/, then return to the voice tab and try again.
Use Manual setup and choose Local gateway, Hermes Cloud, or Remote gateway. Local/Remote API connections use a Gateway URL and API key; Cloud and dashboard-ticket connections require the signed-in HTTPS dashboard tab. The native Desktop approval flow is still evolving during alpha.
This repo includes two Hermes review runners:
npm run review:watch — local poller for open PRs/issues. This works now from a machine that can reach Hermes and is authenticated with gh.npm run review:event — GitHub-event runner for future GitHub Actions/webhook wiring. It expects GITHUB_EVENT_NAME, GITHUB_EVENT_PATH, and GITHUB_REPOSITORY.The local poller checks open PRs and issues, computes a stable signature from PR head SHA or issue title/body, and only reviews changed targets. It upserts one bot comment per PR/issue with a stable marker. PR diffs and issue bodies are treated as untrusted input.
Local setup:
# Uses gh auth token, local API_SERVER_KEY from ~/.hermes/.env, # and http://127.0.0.1:8642 by default. npm run review:watch
Optional overrides:
HERMES_REVIEW_REPO=abundantbeing/hermes-browser-extension HERMES_REVIEW_GATEWAY_URL=http://127.0.0.1:8642 HERMES_REVIEW_API_KEY=<api-server-key-or-scoped-token> HERMES_REVIEW_MAX_TARGETS=3 HERMES_REVIEW_STATE_FILE=~/.hermes/hermes-browser-review-state.json
For a GitHub-hosted Actions runner later, HERMES_REVIEW_GATEWAY_URL must be reachable from GitHub. A runner cannot reach http://127.0.0.1:8642 on your personal machine; use a remote Hermes API server behind Tailscale/VPN/HTTPS or a self-hosted GitHub runner on the same network. Pushing .github/workflows/* also requires a GitHub token with workflow scope.
Dry-runs:
npm run review:watch:dry-run GITHUB_EVENT_NAME=pull_request_target \ GITHUB_EVENT_PATH=./event.json \ GITHUB_REPOSITORY=abundantbeing/hermes-browser-extension \ GITHUB_TOKEN=<github-token> \ npm run review:event:dry-run
npm test npm run check:js npm run check:manifest npm run verify npm run build npm run package
Project layout:
extension/
manifest.json MV3 extension manifest
app.html Hermes Web full-page workspace
app.css Hermes Web shell and conversation styling
app.js canonical sessions, models, tools, media, and full-view runtime
background.js side panel behavior
content.js page context collector
sidepanel.html side panel UI
sidepanel.css side panel styling
sidepanel.js Hermes API client + UI state
voice-dictation.* visible extension voice recorder fallback for blocked side-panel mic capture
request-permissions.* visible extension mic-permission helper page
sidepanel-preview.html static visual QA preview
assets/ local Hermes fonts, icons, and imagery
lib/browser-context-protocol.mjs versioned read-only browser context protocol helpers
lib/runtime-events.mjs stable runtime/tool event names for Browser UI normalization
lib/support-diagnostics.mjs redacted Copy Diagnostics support report helpers
lib/connection-modes.mjs versioned Local / Cloud / Remote schema and compatibility migration
lib/connection-controller.mjs generation-safe connection state controller
lib/connection-dispatch.mjs maps Local / Cloud / Remote settings to the correct connect action
lib/cloud-agent-tab.mjs trusted signed-in Cloud tab selection and validation
lib/image-viewer.mjs generated-image lightbox state and zoom controls
lib/common.mjs shared prompt/context/security utilities
companion-plugin/ optional fail-soft Browser companion plugin with read-only context cache tools/hooks
scripts/
build.mjs copies extension/ to dist/
build-firefox.mjs produces the Firefox preview package at dist/firefox/
check-manifest.mjs validates required manifest assets/permissions
hermes-review-github-event.mjs PR/issue event runner for GitHub Actions/webhooks
hermes-review-watch.mjs local PR/issue review poller
package.mjs creates artifacts/hermes-browser-extension.tar.gz
tests/
common.test.mjs utility behavior tests
Hermes Agent is an open-source project by Nous Research. Hermes Browser Extension is a community extension by Jon Komet that connects through a local gateway, Hermes Cloud agent tab, or self-hosted remote gateway. It is designed to live at the edge of the ecosystem without adding core tool-schema footprint.
Useful links:
External contributions that have shipped are credited in CONTRIBUTORS.md.
Built by Jon Komet (@abundantbeing).
MIT. See LICENSE.
more like this
Comprehensive analytics dashboard for AI coding agents — Cursor, Windsurf, Claude Code, VS Code Copilot, Zed, Antigravi…
Firefox and Chrome extensions to prevent Google from making links ugly.
search projects, people, and tags