OpenClaw vs OpenHuman vs Hermes Agent: Three Ways to Self-Host a Personal AI

OpenClaw, OpenHuman, and Hermes Agent keep getting lined up against each other on GitHub Trending, HN, and YouTube roundups, as if they're three flavors of the same thing. They aren't. The difference between them isn't their feature lists. It's when each one gets to know you.

OpenHuman assembles a model of you before you ever type a prompt. OpenClaw learns what you tell it, session by session, across whatever chat app you message it from. Hermes sits in between: it reacts to you like OpenClaw, but it keeps a persistent memory that grows every time you use it. That axis, more than star counts or channel lists, is what decides which tool you actually want.

Here's the comparison on that axis, plus the security dimension that matters if you're going to run OpenClaw, and where each one runs once you've picked.

The Short Version

• The tools differ on one axis: when the agent gets its context. OpenHuman is memory-first (it proactively ingests your data on a 20-minute loop). OpenClaw is session-reactive (it knows what you tell it). Hermes is reactive but keeps a persistent, self-improving skill graph across sessions.
• OpenClaw is the multi-channel reach play, with about 30 messaging platforms, the biggest ecosystem (380K+ GitHub stars), and by far the heaviest CVE history. Safe to self-host if you keep it off the public internet and authenticate it; risky if you deploy it the lazy way.
• OpenHuman is for people who want the agent to already know them: proactive memory across 100+ integrations, a desktop app paired with a headless server core you can run on a VPS. It is still the youngest of the three and GPL-3.0 licensed, but it already has at least one reported CVE, so treat "young project" as a reason to verify patches, not as a clean security record.
• Hermes Agent is the server-native pick from a credible research org (Nous Research), with scheduled jobs, subagent delegation, a built-in learning loop, and an MIT license. It has a smaller CVE footprint than OpenClaw, but not a blank one, so the security framing should be "fewer known issues," not "none found."

The Difference That Decides Which One You Want

Ask each tool the same question, "what do you know about me right now, before I say anything?", and you get three different answers. That's the whole comparison in one question.

OpenHuman answers before you ask. It runs a 20-minute polling loop against 100+ OAuth-connected services (Gmail, Notion, GitHub, Slack, Calendar, and so on) and 5,000+ MCP servers, pulling your data in and compressing it into a scored Markdown structure it calls a Memory Tree, stored in local SQLite and mirrored as an Obsidian vault. By the time you open a conversation, it's already built a model of your life. Its own tagline, "a brain that builds a local-first memory of your life," is the architecture, not marketing.

OpenClaw answers with whatever you've told it this session. It's a gateway: one daemon process routes inbound messages from your chat apps to agent instances, and context accumulates reactively through those sessions and its plugin system. It knows what's happened in the conversation and what its tools have surfaced. It is not sitting in the background ingesting your inbox.

Hermes answers with what it's learned so far. Like OpenClaw, it's reactive; it responds to messages and scheduled events rather than proactively fetching your data. But it runs a closed learning loop: it creates skills from experience, refines them while it operates, and maintains a persistent user model across sessions. So it doesn't know your whole life the way OpenHuman does, but it isn't starting from zero every session either. Architecturally it lands between the other two.

Once you see the split this way, the rest of the comparison falls into place. The per-tool sections below are really just "what each answer costs you and buys you."

OpenClaw: The Multi-Channel Gateway

Start with reach, because that's OpenClaw's whole pitch: you message it from WhatsApp, and it answers. Same from Telegram, Slack, Discord, Signal, iMessage, Teams, Matrix, and a dozen more, with about 30 messaging platforms treated as first-class channels. If your mental model of a personal AI is "the thing I text from my phone," OpenClaw is built for exactly that.

Under the hood it's a TypeScript/Node gateway daemon: one Gateway process handling channels, sessions, tools, and routing to isolated agent instances, with a web dashboard at localhost:18789. On top of that sits a skills/plugin system with a big community registry, voice modes (wake word and continuous voice on mobile), Docker/SSH/sandbox backends, and Live Canvas, an agent-driven visual workspace. It's MIT-licensed and the most-starred of the three by a wide margin, at 380K+ on GitHub, which means the biggest ecosystem and the most third-party skills, for better and worse (more on the worse in a second).

If you've read our OpenCode vs OpenClaw comparison, note that OpenCode is a separate project: OpenClaw itself is this always-on personal-agent gateway, not a repo-focused coding CLI.

The strength here is easy to state: nothing else in this comparison comes close on channel reach or ecosystem size. The catch is that all that surface area (23 channels, a huge third-party skill registry, a dashboard that wants to be reachable) is also attack surface. Which is its own section.

OpenClaw's Security Record: What "Self-Hosted" Actually Requires Here

The community CVE tracker for OpenClaw (jgamblin/OpenClawCVEs) now reports 543 OpenClaw CVEs from a direct CVE List V5 scan, while the OpenCVE database lists 500+ entries under the OpenClaw vendor tag. Treat the exact count as moving data, not a fixed scorecard; the important point is that OpenClaw has a much heavier public CVE footprint than OpenHuman or Hermes.

Two are worth naming because they define the risk. CVE-2026-32922 (CVSS 9.9, critical) is a privilege escalation documented by ARMO, where a single API call turns a pairing token into full admin access with remote code execution. CVE-2026-25253 (CVSS 8.8, high) is a cross-site WebSocket hijacking flaw: a malicious webpage can steal your auth token and run code on your host from a single link. It was patched in v2026.1.29 and drew advisories from multiple organizations including Microsoft. There was also a supply-chain event, sometimes called ClawHavoc, where malicious skills were planted in the community skill registry; one audit of 2,857 skills found 341 malicious, and one bad skill reached #1 in the registry while shipping a macOS stealer payload.

Here's the part that reframes all of it, though: the biggest real-world risk isn't the CVEs, it's deployment. A large proportion of the OpenClaw instances found exposed on the public internet were running with no authentication at all, because operators reconfigure port 18789 for remote access without adding authentication (the shipped default binds to loopback and requires auth). Many of the tracked CVEs are patched in current versions. What isn't patched by an update is a wide-open instance sitting on a public IP.

Pro tip. Harden before you expose anything. Don't bind OpenClaw's dashboard to 0.0.0.0. Keep port 18789 on localhost and reach it through an SSH tunnel (ssh -L 18789:localhost:18789 you@your-vps), or put it behind an authenticated reverse proxy. Verify these settings against OpenClaw's current docs before you go live; defaults change between releases.

My read: OpenClaw's CVE count is a reason to deploy it carefully, not a reason to write it off. It's the most widely deployed of the three precisely because it's the most capable, and "widely deployed by people who leave the door open" is what produces headline numbers. Run it locked down and updated, and most of the scary stats stop describing your box.

OpenHuman: Memory-First, Desktop-Plus-Server

The thing to understand about OpenHuman is that it's two pieces. openhuman-core is a headless Rust JSON-RPC server that runs as a standalone Docker container on a configurable port (check the repo for the current default). The desktop app, a Tauri build (React + Rust), is a separate client that talks to that core. The core can live on a VPS while the desktop client connects to it remotely, which is the self-host model that makes it relevant here: always-on server, thin client on your laptop.

What that core is doing is the memory work described earlier: 100+ OAuth integrations plus 5,000+ MCP servers feeding the 20-minute auto-fetch loop, compressed via a token-reduction step (TokenJuice, claimed up to 80% reduction) into the Memory Tree and Obsidian vault. Security posture is solid on paper for a young project, with AES-256-GCM encryption at rest, Argon2id key derivation, OS keychain integration, and tool sandboxing via Docker/Bubblewrap/Firejail/Landlock. At least one CVE is now reported for OpenHuman: CVE-2026-55743, a shell tool sandbox/allowlist bypass affecting versions through 0.54.0. So the right read is not "no record yet," but "young project, fast-moving security posture, verify the patched version before deployment."

Two things to weigh before you pick it. First, the license: OpenHuman is GPL-3.0, where OpenClaw and Hermes are both MIT. If you plan to fork or extend it and ship your changes, GPL's copyleft applies, which matters for a company, less so for a personal deployment. Second, the resources: the project's docs recommend 4 GB+ of RAM, with 16 GB+ for heavier use, notably more than the other two, and more still if you pair it with a local model on the same box.

One caveat on sourcing: OpenHuman's external docs site was unreachable when I checked, so the specs above come from its GitHub README, issue tracker, and repo rather than a polished docs portal. They're consistent across those sources, but if you're leaning on a specific number, re-verify it against the repo before you commit.

Hermes Agent: Server-Native With a Learning Loop

Hermes is still server-native at heart, but it no longer fits cleanly into the "no desktop app" bucket. The official docs now offer Hermes Desktop alongside the command-line install, while the agent itself can still run on a VPS, cloud VM, or other server environment. You can interact with it through messaging platforms, the desktop app, or a real terminal interface with multiline editing and slash-command autocomplete. If OpenHuman is "desktop with a server core" and OpenClaw is "gateway you text," Hermes is closer to "a server-first agent with optional desktop access."

It's built by Nous Research, which carries weight with the open-source LLM crowd and is a credibility signal for anyone evaluating longevity. Feature-wise it leans into automation: a built-in cron scheduler for scheduled jobs, subagent delegation that parallelizes work across isolated agents, 60+ built-in tools with MCP, and 300+ models including local runners. It's MIT-licensed, currently past the v0.18 "Judgment Release" line, with v0.18.2 on GitHub (July 8, 2026; v0.19.0 followed on July 20) and sits at roughly 211K GitHub stars.

The learning loop is what separates it from a plain reactive agent: it builds skills from experience and keeps a cross-session user model, so it compounds usefulness over time without doing OpenHuman-style proactive ingestion. On security, Hermes is not CVE-free. OpenCVE lists dozens of CVEs for NousResearch/hermes-agent, including issues around authentication, WebSocket/DNS rebinding, injection, path traversal, and gateway/webhook handling. That is still a lighter public record than OpenClaw's, but the right conclusion is "smaller known exposure," not "none reported."

Head-to-Head: Architecture, Security, Deployment, Cost

Here's the whole thing on one screen. Star counts and versions are as of early July 2026 and move fast, so re-check anything you're going to quote.

The cells cover the specs; two trade-offs the table doesn't capture are worth a sentence each. The security-vs-ecosystem tension pulls in opposite directions: OpenClaw's CVE history is the price of being the most-deployed, most-extended tool in the category. OpenHuman and Hermes have much smaller public CVE records, but neither should be framed as clean or untested anymore; they should be framed as younger and lighter-studied. And the desktop-vs-server split is a genuine fork: OpenHuman is still the most desktop-plus-memory-core oriented of the three, but Hermes now also offers a desktop installer, so the cleaner split is not "desktop vs no desktop"; it is "memory-first desktop/core model vs server-first agent with optional desktop access."

Which One Should You Choose?

Match the architecture to the sentence that sounds most like you:

• "I want the agent to already know me before I ask anything." Choose OpenHuman. The proactive memory model is the only one here that assembles context in the background, and nothing else replicates the 100-integration ingestion loop. You pay for it in RAM (4 GB minimum), setup effort, and a smaller, younger community.
• "I want to reach my AI from WhatsApp, Telegram, or whatever app I'm already in." Choose OpenClaw. Its 23 channels are uncontested, and the ecosystem is the deepest. You take on the security-hardening homework in exchange.
• "I want scheduled server-side jobs and a credible research org behind the project." Choose Hermes Agent. Server-native, cron built in, Nous Research pedigree, and a learning loop that compounds, with less public CVE baggage than OpenClaw but still enough reported issues to require normal update discipline.

Quick verdict. There's no single winner; this comes down to what you want the agent to be. If I had to hand out one-line picks: OpenHuman for the memory obsessive who wants an AI that reads them first, OpenClaw for maximum reach if you'll deploy it responsibly, Hermes for the person who wants a clean, server-native automation daemon and no drama. Anyone telling you one of these is objectively best hasn't clocked that they're solving three different problems.

Two more factors that should break a tie. Licensing: GPL-3.0 (OpenHuman) matters if you intend to fork and redistribute; MIT (OpenClaw, Hermes) is the freer path for that. And security tolerance: if the idea of running a tool with OpenClaw's CVE record keeps you up at night even locked down, that's a legitimate reason to pick one of the other two; just don't mistake a smaller CVE record for proof that a younger project is automatically safer.

Where to Run Each One

All three are always-on daemons; they need to be up when you're not at your desk, which rules out running them off your laptop and points at a VPS. (Shared hosting is a non-starter for all three: they need Docker, root, and long-running processes.) None of them require a GPU unless you decide to pair them with a fully local model, so a standard Linux VPS does the job.

Sizing, in generic specs: OpenClaw and Hermes are comfortable on 2 GB RAM as a baseline, moving to 4 GB if you're running lots of plugins or cron-heavy workloads. OpenHuman wants 4 GB minimum and 8 GB recommended, especially if you'll host a local model alongside the core. Give the memory-heavy option more disk headroom too; that SQLite Memory Tree grows with your history.

Once you've picked, deployment splits along the marketplace line. OpenClaw and Hermes Agent are both one-click installs on the Cloudzy marketplace, so you get a pre-configured Ubuntu box with the daemon set up and spend your time hardening and connecting channels instead of on install plumbing: OpenClaw and Hermes Agent. OpenHuman isn't a one-click app, but it's a clean fit for a Cloudzy Linux VPS: provision a box with at least 4 GB RAM, run the openhuman-core Docker container, put it behind TLS with a reverse proxy, and point your desktop client at it. Full root access and NVMe storage cover what the memory tree and the always-on loop need. Whichever one you land on, the deployment story ends the same way: a small Linux VPS you control, running the agent you chose.

Frequently Asked Questions

Is OpenClaw Safe to Self-Host?

Yes, with caveats. OpenClaw has a heavy security history, with 500+ public CVE records listed across OpenCVE and the community CVE tracker, including critical/high-severity issues, and a large proportion of publicly exposed instances run with no authentication because misconfigured deployments expose port 18789 to the internet. Many CVEs are patched in current releases, so the practical risk is mostly about how you deploy: keep it off the public internet, require authentication, reach the dashboard over an SSH tunnel, and stay updated.

What's the Difference Between OpenHuman and Hermes Agent?

OpenHuman is memory-first: it proactively ingests your data from 100+ connected services on a 20-minute loop and builds a model of you before you prompt it, and it ships a desktop app paired with a headless server core. Hermes Agent is server-native and reactive; it responds to messages and scheduled jobs rather than pre-fetching your data, but it builds a persistent skill graph across sessions through a learning loop. In short: OpenHuman knows you upfront; Hermes gets to know you over time.

How Much RAM Do I Need to Self-Host These Agents?

OpenClaw and Hermes Agent run on about 2 GB of RAM as a baseline, or 4 GB if you're running many plugins or heavy scheduled workloads. OpenHuman needs 4 GB minimum and 8 GB recommended. None require a GPU unless you pair the agent with a locally hosted model instead of an API.

Which Self-Hosted AI Agent Has the Most Messaging Integrations?

OpenClaw, with 23 messaging channels including WhatsApp, Telegram, Slack, Discord, Signal, and iMessage. Hermes Agent supports 20+ platforms, including Telegram, Discord, Slack, WhatsApp, Signal, Matrix, Mattermost, Email, SMS, Microsoft Teams, and Google Chat. OpenHuman isn't a chat router at all; it's memory-first, so it ingests data rather than routing messages.

Can These Agents Run Fully Local Without an API Key?

All three call an LLM, but you can point that LLM at a local model instead of a hosted API. Hermes Agent ships with 300+ providers including local runners; OpenClaw and OpenHuman can be paired with a local model runner such as Ollama. Running fully local usually means more RAM, and a GPU if you want reasonable speed on larger models.