Hermes Atlas

What It Does

Hermes Atlas (repo: ksimback/hermes-ecosystem, live at hermesatlas.com) is a community-curated directory that maps the ecosystem around Hermes Agent, the self-improving AI agent from Nous Research. It is not a skill you install into an agent. It is a discovery and reference resource: a single-page web app that lists 185 Hermes-related repositories across 12 categories, fetches live star counts from the GitHub API through a Redis cache, renders a sparkline and trending badge for each entry, and ships a RAG-powered chatbot ("Ask the Atlas") that answers questions about Hermes Agent grounded in an indexed corpus. The audience is anyone building with or evaluating Hermes Agent who wants to know what tools, skills, plugins, workspaces, memory providers, and deployment templates exist in the community. A markdown mirror (ECOSYSTEM.md), an llms.txt, and a 4968-line llms-full.txt make the same data consumable by AI crawlers and agents.

The Good

The live site is fully functional and fast, with real backend work behind it. A curl against hermesatlas.com returned HTTP 200 in 0.22 seconds with a 156 KB payload. All nine critical endpoints I checked (/ , /guide/ , /lists/ , /reports/ , /privacy/ , /sitemap.xml , /rss.xml , /robots.txt , /llms.txt ) returned 200. The /api/stars serverless function returned live data (NousResearch/hermes-agent at 209,389 stars, NousResearch/hermes-agent-self-evolution at 4,508, cached in Redis with a 1-hour TTL). The /api/og endpoint returned a valid 28 KB PNG for social preview cards. This is not a static mockup. It is a working web app with a backend.

The RAG chatbot answers with real source citations, not generic LLM prose. Posting {"message":"What is Hermes Agent in one sentence?"} to /api/chat returned a grounded answer ending in [Source: research/31-orange-book-complete-guide.md]. A second query, {"message":"How do I install a skill?"}, returned a five-step answer with concrete hermes skills install commands, slash-command examples, and a citation to research/docs/guides/work-with-skills.md. The retrieval layer is hybrid: a hand-written BM25 implementation (in api/chat.js, lines 88-200) complements cosine similarity over OpenAI text-embedding-3-small vectors, with MMR re-ranking and conversation-aware query rewriting. The embedding corpus is 6,858 chunks at 70.2 MB (data/chunks.json), built from 436 research markdown files. The chat response includes a metadata tag naming the model used (google/gemini-3-flash-preview-20251217), so you can see exactly what served the answer.

The engineering hygiene is well above the average community skill repo. The project ships 16 passing tests (npm test reports tests 16, pass 16, fail 0) covering the RAG scoring logic, the latest-release parser, the repos.json validator, and a build-artifacts manifest checker. There are 12 GitHub Actions workflows: a pre-merge smoke test on PRs, a post-deploy smoke test that opens a tracking issue on failure, weekly repo discovery, automated release monitoring, an audit that flags dead repos, and a chunk rebuilder. There are four issue templates (suggest-repo, suggest-documentation, report-bug, and a config). The Vercel config sets a strict Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a same-origin CORS lock on the API. The robots.txt explicitly welcomes every major AI crawler (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, and a dozen more). This is the operational rigor you expect from a funded product, delivered by a community project.

The curated dataset is structured and machine-usable. The single source of truth is data/repos.json, an array of 185 entries each with owner, repo, name, description, stars, url, official, and category fields. The 12 categories are well-balanced: Skills and Skill Registries (30), Plugins and Extensions (26), Memory and Context (25), Workspaces and GUIs (19), Developer Tools (15), Integrations and Bridges (14), Guides and Docs (13), Multi-Agent and Orchestration (11), Deployment and Infra (11), Domain Applications (9), Core and Official (6), and Forks and Derivatives (6). Supporting files add curated lists (data/lists.json), a featured-project rotation (data/featured.json), the latest Hermes release (data/latest-release.json, tracking v0.18.0 / v2026.7.1), and AI-generated per-repo summaries (data/summaries.json). Anyone building a Hermes toolfinder or dashboard can consume this JSON directly.

The Bad

The repo ships with no license file at all. The GitHub API returns license: null, and there is no LICENSE, COPYING, or LICENSE.md anywhere in the tree. Under default copyright law, that means the data (data/repos.json), the 436 research files, the ECOSYSTEM.md mirror, and the serverless code are all rights-reserved by default. Nobody has a legal grant to fork the atlas, republish the dataset, train on the research corpus, or reuse the API code. This is a serious gap for a project that describes itself as "the canonical map" of a community ecosystem and that asks the community to contribute via issues and PRs. The README, CONTRIBUTING.md, and ECOSYSTEM.md never mention licensing. If the intent is open data, the intent is not expressed anywhere a downstream consumer can rely on.

The README materially understates what the project actually contains. The README claims "80+ quality-filtered repos" and "84 quality-filtered repos (single source of truth)." The actual data/repos.json contains 185 entries, more than double the documented count. The README claims the chatbot is "grounded in 27 research files." The research/ directory contains 436 markdown files. The README claims "283 chunks." The actual data/chunks.json contains 6,858 chunks. The site has grown between two and twenty-four times past its own documentation, and the documentation was never updated. A first-time reader who trusts the README will badly underestimate the project.

The "every project security-reviewed before inclusion" claim is not borne out by the evidence. The README states each project is "security-reviewed before inclusion." The actual repos/security-review.md covers 16 repositories out of the 185 now listed. It is a README-based scan (not a code audit), it is dated 2026-04-08 (three months old at review time), and it was never refreshed as 169 more repositories were added. Of the 16 it did cover, 5 carried a WARN verdict (un-fetchable READMEs, curl-pipe-bash installers, hardcoded example credentials) that appears to have gone unresolved. The security claim is the project's strongest trust signal, and it is the one most at odds with the repository contents.

The markdown mirror is badly stale, which undercuts the agent-readable surface. ECOSYSTEM.md, which is the file an agent or crawler is most likely to consume directly, carries the header "Last updated: 2026-04-11" and "Hermes version: 0.8.0" and "57k+ stars." At review time (2026-07-05) Hermes Agent is at v0.18.0 with 209k stars. The llms.txt and llms-full.txt are fresher, but the primary markdown mirror that CONTRIBUTING.md implicitly points people at is nearly three months and ten major version bumps behind. For a resource whose value proposition is being current, this is a visible inconsistency.

The open-issue backlog is high relative to the project's age. The repo carries 60 open issues against 1,099 stars, accumulated in roughly three months. Many are community repo-suggestion issues waiting on the automated security check and merge. This is a curation pipeline that is scaling slower than its inbound.

Smoke Test Results

Tested on macOS host (aarch64), Node v24.13.1, npm 11.8.0. The repo was shallow-cloned (full tree, 750 files across 447 markdown, 213 HTML, 30 JS, 16 YAML, 12 JSON). Dependencies were installed with npm install. The live site at hermesatlas.com was probed directly over HTTPS. The GitHub API provided star, fork, and issue counts.

Run A. Fresh sandbox, no deps preinstalled

$ git clone --depth 1 https://github.com/ksimback/hermes-ecosystem.git

Cloning into 'repo'...

PASS (clean clone, no submodules, 750 files)

$ ls data/repos.json api/ scripts/ tests/ .github/workflows/

data/repos.json present (185 entries, 66 KB)

api/ has 5 endpoints (stars, stars-history, chat, subscribe, og)

scripts/ has 14 scripts (build-chunks, validate-repos-json, smoke-test-prod, etc.)

tests/ has 4 test files

.github/workflows/ has 12 workflows

PASS (structure matches README description)

$ grep -L "^---" $(find . -name "SKILL.md") 2>/dev/null

(none, this is not a SKILL.md repo)

PASS (correctly classified: directory resource, not a skill pack)

Pass rate: 3 of 3. The repo clones cleanly and its structure matches what the README describes at the directory level. The file-type breakdown (HTML primary, JS for APIs, JSON for data) is consistent with a static-plus-serverless web app.

Run B. Sandbox with deps preinstalled

$ npm install --no-audit --no-fund

added 8 deps (openai, redis, marked, jsdom, dompurify, turndown, node-html-parser, @vercel/og)

PASS (install succeeds, 8 direct deps, no peer-dep warnings)

$ npm test

node --test tests/*.test.js

... build-artifacts, latest-release, rag-scoring, validate-repos-json ...

tests 16, pass 16, fail 0, duration 55ms

PASS (16 of 16 tests green)

$ node scripts/validate-repos-json.js

(validates schema, checks for duplicate owner/repo, invalid categories, bad URLs)

PASS (validator present and runnable)

Pass rate: 3 of 3. The badge number is 3 of 3. The dependency footprint is small for a project this featureful, the test suite is green, and the data validator runs standalone. This is the canonical "does it install and self-check correctly" verdict.

Run C. Functional verification (does it do what it claims?)

$ curl -s -o /dev/null -w "%{http_code}" https://hermesatlas.com/

200

PASS

$ for path in / /guide/ /lists/ /reports/ /privacy/ /sitemap.xml /rss.xml /robots.txt /llms.txt; do

curl -s -o /dev/null -w "%{http_code}" https://hermesatlas.com${path}

done

200 200 200 200 200 200 200 200 200

PASS (all 9 critical endpoints live)

$ curl -s https://hermesatlas.com/api/stars | head -c 400

{"repos":{"NousResearch/hermes-agent":{"stars":209389,"updatedAt":"2026-07-05T09:41:36Z"}, ...

PASS (live star data, Redis-cached, fresh)

$ curl -s -X POST https://hermesatlas.com/api/chat -H "Content-Type: application/json" -d '{"message":"How do I install a skill?"}'

[5-step answer with hermes skills install commands, ends with Source: research/docs/guides/work-with-skills.md, model: gemini-3-flash-preview]

PASS (RAG chatbot returns source-cited answer)

$ curl -s -X POST https://hermesatlas.com/api/chat -d '{"messages":[{"role":"user","content":"hi"}]}'

{"error":"Invalid message"}

NOTE (not a fail: the contract is {message, history}, documented in chat.js line 255)

$ ls LICENSE* 2>/dev/null || echo "NO LICENSE FILE"

NO LICENSE FILE

FAIL (no license grants any reuse right)

Functional pass rate: 5 of 6. The site, the star API, the chat API, and the test suite all work as advertised. The one real failure is the absent license, which is a legal defect rather than a runtime one. The chat API contract ({message, history}) tripped an initial test until I read the source, but the source is explicit about the expected shape.

What the runs tell you

Everything user-facing works. The static site serves, the serverless endpoints return live data, the chatbot returns grounded answers, and the test suite is green. The two issues that surface are not runtime failures: the README and ECOSYSTEM.md under-document or mis-document the actual content, and the repository gives you no legal permission to reuse any of it. If you want to browse the Hermes ecosystem or ask it questions, the atlas delivers today. If you want to fork it or republish the dataset, you are doing so without a license.

Setup Walkthrough

1. To use the atlas, you do not install anything. Open https://hermesatlas.com in a browser. Browse the 12 categories, use the search and filter, or ask the chatbot a question.
2. To run the static map locally, clone the repo and open index.html directly. The map renders with the cached star counts in data/repos.json. No build step, no server required.
3. To run the API endpoints locally you need Vercel. The functions in api/ depend on Redis Cloud (for star caching and history snapshots), OpenRouter (for the chat LLM, with a Gemma 4 to Gemini 3 Flash fallback chain), and OpenAI (for embeddings at chunk-build time). Set the matching environment variables in your Vercel project. The README lists the required keys.
4. To rebuild the chatbot knowledge base after editing research/ files, run OPENROUTER_API_KEY=*** node scripts/build-chunks.js. This re-chunks and re-embeds the corpus into data/chunks.json (70 MB output).
5. To run the local RAG quality tests, run OPENROUTER_API_KEY=*** node scripts/test-rag.js. The README reports 27 of 27 passing against the curated set.
6. To contribute a repo, open an issue with the "Suggest a Repo" template. The automation fetches metadata, runs a basic check, and opens a PR. Inclusion requires at least 1 star and passing the security review (which, as noted above, currently covers a small fraction of listed repos).

Alternatives

1. The official Hermes Agent docs and agentskills.io - authoritative for the core product and the open skill standard, but not a community catalog. Use these for the canonical source, use Hermes Atlas for the breadth of third-party tooling.
2. GitHub topic search for hermes-agent - raw and unfiltered, but current and license-clear. You lose the categorization, star tracking, and chatbot, and you do your own filtering.
3. A self-curated awesome-list - fully under your control and easy to license, but you shoulder the discovery and maintenance burden that the Atlas automates with its weekly-discovery workflow and Redis-cached star counts.