First — what is an agent, and why put one on your glasses?
IRIS already answers you on its own; you do not need any of this. This is for people who want their own AI answering instead.
An AI that lives on your computer
Hermes is a free, open-source agent from Nous Research that runs on your own machine. Unlike a chat website, it keeps long-term memory, and it can use tools — read your files, run commands, hold everything it has learned about you.
It comes with you
Connected to IRIS, that agent answers on your lens mid-conversation, and every meeting you have can flow into its memory. The thing that knows your work is with you when you are away from the desk.
You are running a server
Your agent lives on your hardware, so that machine has to stay awake for the glasses to reach it. There is a terminal involved. If that sounds like a chore, IRIS on its own needs none of it.
Part one: get Hermes running
Skip to part two if your agent already works. Everything here happens on your computer, in a terminal — on Mac open Terminal, on Windows open PowerShell, on Linux you know where it is.
- Install itOne command. It pulls in everything it needs (Node, git, and the rest) by itself. Requires Python 3.11.
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
On Windows, in PowerShell instead — no admin rights needed:iex (irm https://hermes-agent.nousresearch.com/install.ps1)
- Reload your terminalSo the new
hermescommand is recognised. Close and reopen the terminal, or run:source ~/.bashrc # or ~/.zshrc if you use zsh
- Tell it which AI to useThe setup wizard walks you through choosing a model and pasting an API key.
hermes setup
If you would rather have one subscription that covers 300+ models and tools, usehermes setup --portalinstead and sign in to Nous Portal. - Check it actually worksRun
hermeson its own to open the chat, and say hello. If it answers, you have an agent. Do not continue until this works — nearly every "IRIS cannot connect" problem is really an agent that was not running.hermes
Part two: connect it to IRIS
Three steps. Every command runs on the same machine as the agent. In plain terms: switch on the door your agent already has, give that door an address on the internet, and tell IRIS where it is.
- Switch on the door Hermes already hasHermes ships with a way for other programs to talk to it, switched off until you set a password for it. Set that password — any long random string — and restart Hermes. Nothing to install, no plugin. It listens on port
8642.export API_SERVER_KEY=$(openssl rand -hex 24) echo $API_SERVER_KEY # copy this — you will paste it into IRIS
Then start Hermes again in that same terminal, so it picks the value up. Setting it after Hermes is already running does not reach it.To make it permanent, add theexportline to your~/.bashrc(or~/.zshrc) with the key written out, so it survives a reboot. - Give it an address on the internetYour glasses cannot reach your desktop directly — the agent is only visible to your own machine right now. A Cloudflare tunnel fixes that with one command and no account. If you do not have it yet:
brew install cloudflared # Mac winget install --id Cloudflare.cloudflared # Windows
On Linux, grab it from Cloudflare's downloads page. Then, leaving Hermes running in its own terminal, open a second one and run:cloudflared tunnel --url localhost:8642
It prints atrycloudflare.comaddress — that is what IRIS will use. Leave this terminal open: close it and the address dies.Worth knowing early: this quick tunnel gets a brand new address every time you restart it, and you would have to re-paste it into IRIS each time. Fine for trying it out. If you end up using this daily, set up a named Cloudflare tunnel or Tailscale Funnel pointed at port 8642 and the address never changes again. - Paste both into IRISOn your phone: Settings → Integrations → "Your agent, on your glasses". Choose Hermes, paste the
trycloudflare.comaddress and the key you copied in step one, then tap Test connection.A green confirmation means you are done — open the Ask tab and you will find an IRIS/Hermes switch. If it fails, it names the specific reason; see troubleshooting below.
- Enable the OpenAI-compatible endpointIn your gateway config, switch on chat completions, then restart the gateway. It listens on port
18789by default.gateway: { http: { endpoints: { chatCompletions: { enabled: true } } } } - Give it an https addressSame idea as Hermes, different port:
cloudflared tunnel --url localhost:18789
Quick tunnels change their URL on every restart; a named tunnel or Tailscale Funnel is the permanent version. - Paste both into IRISOn your phone: Settings → Integrations → "Your agent, on your glasses". Choose OpenClaw, paste the gateway URL and your gateway token (
gateway.auth.token, or theOPENCLAW_GATEWAY_TOKENenvironment variable), then tap Test connection.Running several agents? The optional Agent ID field routes to a specific one. Leave it blank for your default.
What you get once it connects
Everything below runs through your agent, not ours — its memory, its tools, its model.
Your agent on your lens
A Hermes button during live sessions sends what was just said to your agent and puts its reply on your glasses. Any mode can also hand over its ongoing cues entirely, so mid-conversation suggestions come from your agent instead of IRIS.
One continuous thread
The Ask tab gets an IRIS/Hermes switch, on the phone and on the glasses. IRIS sends a stable conversation id, so your agent's memory of you keeps building across every session rather than restarting each time.
Sessions into its memory
Send any session summary to your agent with one tap, or switch on auto-send and every finished session flows into its long-term memory the moment processing ends.
Terminal and to-dos
Run a command from the Home hub and read the result on your lens. Tell your agent "remind me to follow up with Lloyd" and it lands in your IRIS to-do list.
If something does not connect
Test connection names the failure rather than shrugging. Here is what each answer means.
"Could not reach that URL"
The tunnel is not running, or its address changed. Quick tunnels issue a brand new URL every restart — if you closed that terminal, slept the machine, or rebooted, the old address is dead and the new one has to be pasted into IRIS.
Check from the agent machine itself: curl https://YOUR-TUNNEL-URL/v1/models. Nothing back means the problem is the tunnel, not IRIS.
"command not found: hermes"
The installer finished but your terminal has not picked up the new command. Close the terminal and open a fresh one, or run source ~/.bashrc (source ~/.zshrc on zsh).
How many terminals am I supposed to have open?
Two, and both stay open: one running Hermes, one running cloudflared. Close either and the glasses lose the agent. This is the main reason people move to a named tunnel and a machine that stays awake once they are past trying it out.
"Rejected the API key"
The tunnel is fine — the key does not match. The value in IRIS must be exactly the API_SERVER_KEY the agent process is running with, and setting it in a shell after the agent started does not apply to it. Restart the agent after setting the variable.
Verify end to end from your server:
curl -H "Authorization: Bearer $API_SERVER_KEY" https://YOUR-TUNNEL-URL/v1/models
It says connected, but replies never arrive
Almost always the agent taking longer than the wait allows. IRIS steps back in with its own answer rather than leaving you with nothing, so a slow agent looks like "IRIS answered instead."
Check the agent's own logs for the incoming request. If it never arrives, something between the tunnel and the agent is dropping it; if it arrives and takes 30 seconds, that is the model, not the bridge.
Do I have to keep my computer on?
Yes. Your agent runs on your hardware — if the machine sleeps or the tunnel stops, the bridge has nothing to reach. Anyone using this daily tends to run the agent on a machine that stays up, with a named tunnel rather than a quick one.
Can I use both my agent and IRIS?
Yes, and that is the normal setup. The agent bridge is additive: it is per-mode and per-surface, so you might let your agent handle cues in one mode while IRIS handles everything else. If your agent is unreachable, IRIS carries on by itself.
Where your data goes
Worth being precise about, since this feature points at a machine you own.
Your agent's address and key are sent with each request and never stored on our servers. Requests pass through the IRIS relay to reach your agent — that is what lets the glasses talk to a machine at your house — but nothing about your endpoint is retained afterwards.
Whatever you send your agent is then subject to your agent's own memory and logging, on your hardware. If you switch on auto-send, that includes every session summary.