HermesClaw: One iLink Poller, Two Local Proxies, Three WeChat Agents
Run Hermes Agent and OpenClaw on the same WeChat account
At a glance
- What is it?
- HermesClaw is a roughly 500-line Python forwarding proxy that lets Hermes Agent, OpenClaw and OpenCode share a single WeChat iLink account. It solves a real token-ownership conflict, but it also puts an unmaintained-by-upstream hop in front of every message your bot sends.
- Who is it for?
- Adopt HermesClaw only if you already run Hermes Agent or OpenClaw against WeChat and you specifically need two or three agents reachable from one iLink account; if a single agent satisfies you, the proxy hop buys nothing. Before installing, read install.sh and confirm exactly which files it rewrites, check that ports 19998 and 19999 are free, and verify how to restore the original baseUrl and WEIXIN_BASE_URL values if you want to uninstall.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 22 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The 403 Conflict HermesClaw Was Built To Remove
Hermes Agent ships a native WeChat gateway, and OpenClaw reaches WeChat through its clawbot component. Both work on their own. The README states the problem plainly: each gateway exclusively locks the iLink connection, so starting both against one account means one of them receives 403 errors and drops messages. The token belongs to whoever polled first, and the second process is left holding a credential the server no longer honours. That is not a configuration mistake you can tune away with retries; it is two programs claiming the same identity. HermesClaw's answer is to make itself the only process that talks to iLink, then present each gateway with a local endpoint that behaves like the real API. The intended user is narrow: someone self-hosting a WeChat bot who wants to compare or combine agents on one account rather than registering a second WeChat identity. If you run one agent, this project has nothing to offer you.
Two Proxies, One ACP Bridge, No Shared Memory
The architecture diagram in the README shows a single poller sitting under ilinkai.weixin.qq.com. HermesClaw queues raw iLink protocol messages and routes them according to the command a user sends: /hermes, /openclaw, /opencode, /both or /three. Proxy A listens on port 19999 and fronts the openclaw gateway; proxy B listens on 19998 and fronts hermes; OpenCode is reached differently, through an ACP subprocess bridge rather than an HTTP proxy, because OpenCode has no WeChat support of its own. Outbound traffic flows back through the same proxies to iLink. The design boundary is stated explicitly: HermesClaw does not process media, call agent APIs, or touch agent memory. Media decryption, markdown formatting and model interaction stay inside each gateway. That is a sensible split, and it is also why /both mode does not merge two agents into one conversation. They share a transport, not a context. Each still keeps its own memory and its own view of the chat.
What install.sh Actually Changes On Your Machine
The documented install path is a piped shell script: curl -fsSL https://raw.githubusercontent.com/AaronWong1999/hermesclaw/main/install.sh | bash. For unattended runs the README gives two forms, HERMESCLAW_YES=1 as an environment variable before bash, or bash install.sh -y when invoking the script directly. The installer performs eight steps, and several of them modify software you already installed. It detects which gateways are present and configured, extracts the iLink token from the gateway account files, then patches openclaw-weixin's baseUrl to http://127.0.0.1:19999 and Hermes's WEIXIN_BASE_URL to http://127.0.0.1:19998. It optionally detects the OpenCode CLI, which is what enables /opencode and /three. It installs the Python dependencies requests and python-dotenv, creates an OpenClaw media symlink described as a workaround for a media path mismatch, and registers a hermesclaw systemd service. After installation the README tells you to restart your gateways and send /whoami in WeChat. Note what is absent: there is no documented uninstall script and no documented backup of the two URLs the installer overwrites. If you run it, capture the original baseUrl and WEIXIN_BASE_URL values first.
The Proxy Hop Is Now In Your Failure Path
Because HermesClaw owns the token and both gateways point at localhost, the proxy becomes a single point of failure for every message in both directions. If the hermesclaw systemd service stops, both gateways keep running and keep believing they are configured correctly, while nothing reaches WeChat. The symptom will look like a silent bot rather than a crash, and the gateway logs may show nothing unusual because from their perspective the local endpoint simply did not answer. The README does not describe health checks, restart policies, or a fallback that returns a gateway to direct iLink access. There is a second, subtler cost: the gateways are now running against a reimplementation of the iLink protocol rather than the service. Any upstream change to message shapes, media handling or authentication will be tested by the gateway authors against the real API, not against this proxy. Recent release notes point at the same kind of friction on the installer side, with v0.3.5 adding automatic detection of conflicting legacy services and v0.3.6 fixing macOS bash 3 compatibility and a curl piped to bash stdin issue. Those are the categories of problem to expect: environment quirks and coexistence with whatever else is already installed.
Where HermesClaw Is The Wrong Tool
If you need exactly one agent on WeChat, install that agent's gateway and stop. HermesClaw adds a process, two listening ports and a patched configuration in exchange for nothing. If you need a second agent on a second WeChat account, register the account; the token conflict disappears and you keep two independently debuggable stacks. If your agents must share conversation history, this project will not do it, since the README is explicit that it does not touch agent memory. And if you are not comfortable with a shell script rewriting configuration files inside two other projects, the manual route is available but undocumented: the installer's own steps tell you which two keys to set, so you can patch baseUrl and WEIXIN_BASE_URL by hand and skip the automated edits. The README does not provide that walkthrough, so you would be reconstructing it from the step list.
Compared With Simply Running One Gateway
The honest alternative is not a competing multiplexer; it is OpenClaw's clawbot alone, or the Hermes WeChat gateway alone. Both are upstream components with their own release cadence and their own issue trackers, and both talk to iLink directly with no intermediary. The difference in approach is architectural. A single gateway owns the token and terminates the connection itself, so there is one process to restart and one log to read. HermesClaw inverts that: it centralises the token so that multiple consumers can exist, at the cost of a hop that the upstream projects do not account for. The README's own before-and-after table makes the trade visible, listing token conflict and 403 errors in the without column and /both and /three modes in the with column. If you do not need the right-hand column, you are paying the left-hand column's costs for no benefit. OpenCode support is the one capability with no upstream equivalent, since the README states OpenCode has no WeChat support and is reached through the ACP bridge instead.
Licence, Maintenance And Upgrade Surface
HermesClaw is MIT-licensed, which places few restrictions on reuse or modification; that is a statement about the licence text, not legal advice, and you should read the LICENSE file yourself if redistribution matters to you. The maintenance question is more interesting than the licence. The project depends on the internal configuration keys of two other projects, baseUrl in openclaw-weixin and WEIXIN_BASE_URL in Hermes, plus the shape of the iLink protocol those gateways speak. Every one of those is outside the author's control. Upgrading Hermes Agent or OpenClaw therefore carries a non-obvious risk: a renamed config key or a changed endpoint path may leave the installer patching a field that no longer exists, and the failure will surface as a non-responsive bot rather than an error during upgrade. The release history shows active work through 2026, with macOS support arriving in v0.4.0 in June 2026, so the project is not dormant. But version compatibility is the thing to verify before each gateway upgrade, not after. The README does not publish a compatibility matrix tying HermesClaw versions to specific Hermes Agent or OpenClaw releases.
Editorial conclusion
Adopt HermesClaw only if you already run Hermes Agent or OpenClaw against WeChat and you specifically need two or three agents reachable from one iLink account; if a single agent satisfies you, the proxy hop buys nothing. Before installing, read install.sh and confirm exactly which files it rewrites, check that ports 19998 and 19999 are free, and verify how to restore the original baseUrl and WEIXIN_BASE_URL values if you want to uninstall. The project is MIT-licensed, so the licence itself is not the constraint; the constraint is that every message now depends on a proxy that the upstream gateway authors do not test against.
Community notes