# Hermes ↔ Grok Bot operator manual

Wire an existing [Nous Research Hermes Agent](https://github.com/NousResearch/hermes-agent) into the Grok Bot app over a private Tailscale net. Hermes stays the brain. Grok Bot is the front door.

This repo is the operator write-up. The comms code lives upstream:

- Bridge: https://github.com/shagghiesuperstar/hermes-grok-bridge
- SSH Relay template: https://x.ai/bot/NVF3Rx9T7jkQPsqYjeDn-
- API Fleet template: https://x.ai/bot/5KLpaL-JIM2q629kbTh5L
- Fleet Ops template: https://x.ai/bot/rzq0UV2MmBsvVR1EspZE-

## Start here

1. Read [MANUAL.md](MANUAL.md) (full TOC).
2. Pick **SSH Relay** if Hermes is Desktop-primary (no gateway).
3. Pick **Native API (:8642)** if the gateway + API server are already up and you want parallel fleet asks.
4. Add identity bots per host. Optional: one Chief of Staff + Fleet Ops.

## Hard rules

- Tailscale only. No Funnel. No public bind on `:8642`.
- Never commit `API_SERVER_KEY`, SSH private keys, or vault tokens.
- Do not let Grok write Hermes memory plugins (Hindsight, Graphiti, Omega, MEMORY.md) unless you have an explicit memory plan.
- Account-scoped MCP is visible to every Grok Bot on the account. Confine identity bots in their system prompt.

## Clone

```bash
git clone https://gitea.vps1.afterthedemo.com/Tony_tech/hermes-grokbot-manual.git
```