Hermes Agent For Sales: Build A Draft-Only Sales Desk (2026)

Hermes Agent for sales is easiest to trust when you build it as a back-office desk: it researches, drafts and schedules, and a person on your team presses send.

That split isn't a style choice.

Hermes asks before dangerous shell commands, but its docs describe no built-in approval step for the messages it writes, so the safety has to live in how you wire it.

Below is the exact order I'd follow on a fresh install, with the config, the commands and the traps I'd check before a single rep touches it.

Want my team to map this onto your own pipeline first? Book a free SEO strategy session.

The Rule Behind Every Step: Deliveries Go To Your Team, Never To Prospects

Read the Hermes security page closely and you'll see what approvals actually cover.

Before a command runs, Hermes checks it against a list of dangerous patterns and makes a user approve any match.

Unattended sessions are stricter still: cron_mode: deny and unattended_mode: deny are the defaults, so scheduled and webhook runs refuse those commands outright.

None of that touches an email reply, a Slack post or a cron delivery.

The cron docs say the agent's final response is handed to whatever deliver target the job has, and the agent doesn't send messages itself inside a cron run.

So the design move is simple: every delivery target in this build is a rep's chat, a team channel or the rep's own inbox.

And every outreach job carries two words in its prompt: draft only.

Step 1: Give The Sales Agent Its Own Mailbox

The email gateway talks plain IMAP and SMTP and replies inside the same thread, so Gmail, Outlook, Fastmail or any IMAP host works.

The docs are blunt about the account: use a dedicated one, not your personal inbox, because the password sits in .env and the agent gets full inbox access.

Run hermes gateway setup, choose Email, then check that ~/.hermes/.env ends up looking like this:

EMAIL_ADDRESS=sales-desk@yourcompany.com
EMAIL_PASSWORD=your-app-password
EMAIL_IMAP_HOST=imap.gmail.com
EMAIL_SMTP_HOST=smtp.gmail.com
EMAIL_ALLOWED_USERS=rep1@yourcompany.com,rep2@yourcompany.com
EMAIL_AUTHSERV_ID=mx.google.com
EMAIL_HOME_ADDRESS=salesmanager@yourcompany.com

Here's the part most people miss: with EMAIL_ALLOWED_USERS set, Hermes only processes mail from those addresses.

Prospects can't email this agent, and that's exactly right for a draft desk.

A rep forwards a lead's message to the desk address, and the agent answers the rep in-thread with research or a draft reply the rep can copy into their own mailbox.

Leave out EMAIL_AUTHSERV_ID and nothing works: Hermes drops mail it can't authenticate, and the pin is required while sender checks are on.

Copy the token before the first semicolon of the topmost Authentication-Results header on a delivered message, for example mx.google.com for Gmail.

EMAIL_HOME_ADDRESS is the default inbox for cron output, which makes it a good place for the morning queue covered in Step 6.

Step 2: Put The Desk In The Chat App Your Reps Already Live In

The messaging gateway is one background process covering Slack, Teams, Telegram, WhatsApp, Signal, SMS, email and many more, and it also runs the cron scheduler.

For a Slack team, the Slack guide connects the bot through Socket Mode.

Create the Slack app, add the bot and app tokens, and list each rep's Member ID in SLACK_ALLOWED_USERS.
Invite the bot to a #sales-desk channel with /invite @Hermes Agent, because it only receives channel messages where it has been added.
Run hermes gateway install so the gateway survives reboots and scheduled jobs keep firing.
Run hermes gateway status and confirm only one instance is up; the email docs list duplicate replies as the symptom of two.

On Microsoft Teams, plan for a public HTTPS address, since Teams can't deliver to localhost, and set require_mention: true once the app can read every channel message.

🔥 Want the sales desk set up with someone watching over your shoulder? Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS, four coaching calls a week and 3,400+ members building agent setups like this one. → Join the AI Profit Boardroom

Step 3: Connect The CRM That Actually Has A Connector

This is where most sales stacks hit a wall, so check the catalog before you promise anyone a CRM sync.

CRM	How it connects	Who maintains it	Write safety
Attio	MCP catalog entry, vendor-hosted, OAuth	Attio's own MCP server, reviewed into the Nous-approved list	Set `trust: untrusted`
Close	MCP catalog entry, vendor-hosted, OAuth	Close's own MCP server, reviewed into the Nous-approved list	Voice-agent call tools excluded by default; set `trust: untrusted`
Twenty CRM	`twenty-crm` plugin	Third-party community plugin by TREE-Ind	Test on a copy of your workspace first
Google Sheets pipeline	Bundled `google-workspace` skill	Ships with Hermes	Share only the one sheet

There is no HubSpot, Pipedrive or GoHighLevel plugin or MCP entry in the catalog at v0.23.0, so don't build a plan around one.

The install commands, from the MCP docs and the plugin catalog page:

hermes mcp install attio
hermes mcp login attio
hermes mcp configure close
hermes plugins install twenty-crm

The Close manifest is worth a read before you re-enable anything: it leaves out the voice-agent tools because one of them places real outbound AI phone calls to contacts.

Step 4: Mark The CRM Server Untrusted Before Its First Write

MCP servers default to trust: full, which means no prompt at all.

Change that in ~/.hermes/config.yaml:

mcp_servers:
  attio:
    trust: untrusted
  close:
    trust: untrusted

Per the MCP config reference, an untrusted server makes every write-capable tool call wait for approval, while tools marked read-only still run freely.

The prompt offers Allow Once, Session and Always, and each answer covers one tool only.

Never answer Always on a tool that edits deals or sends email: that writes a permanent allowlist entry.

And remember that /yolo or approvals.mode: off skip this prompt entirely, so keep both away from the sales profile.

Step 5: Write A Lead-Research Skill Once, Reuse It Everywhere

A skill is a markdown document Hermes loads on demand, in the agentskills.io format, stored under ~/.hermes/skills/.

Take a five-person web agency that sells redesigns to dental practices.

---
name: lead-research
description: Build a one-page brief on a sales prospect
---
1. Open the prospect's website with the browser tool.
2. Note services, locations, booking method and any visible tech.
3. Check the last three posts or news items on the site.
4. List two likely pain points tied to what you saw.
5. Write three opening questions for a discovery call.
6. Link every page you used. Mark guesses as guesses.
Draft only. Never contact the prospect.

Hermes can read the site with browser_exec, which drives a real browser for reading, clicking and screenshots.

For a list of twenty practices, delegation hands each one to a subagent with its own context, and only the summaries come back to the main chat.

The docs also say the agent can modify any skill, so review the file after a week and keep the version you like.

Step 6: Schedule The Follow-Up Queue With Cron

Picture a plumbing firm that logs every quote in a Google Sheet with a status column.

From the #sales-desk channel, the owner adds a job in chat so the output returns to that same channel, because origin is the default delivery on messaging platforms:

/cron add "every 1d at 08:00" "Open the Quotes sheet. For every quote marked Sent more than 3 days ago with no reply noted, draft a short follow-up in the customer's own words from the job notes. Draft only. Do not send anything. Post the drafts here, one per quote." --skill google-workspace

Jobs created from the terminal with hermes cron create save to local files by default, so add a delivery target if you go that route.

Two settings worth knowing from the cron page: --paused with --paused-reason parks a job until you've read its first output, and hermes cron run fires it on demand for a test.

If the scheduler ever goes quiet, hermes cron status flags overdue jobs and tells you when it last ticked.

Step 7: Turn New Website Enquiries Into A Brief With A Webhook

The webhook adapter runs a small HTTP server, checks HMAC signatures and turns each payload into an agent run.

The useful trick for sales is the cron_job route property: instead of starting a fresh session, the event fires an existing job, and the job's own skills and delivery settings apply.

platforms:
  webhook:
    enabled: true
    extra:
      port: 8644
      routes:
        new-enquiry:
          secret: "a-long-random-secret"
          prompt: "New enquiry: {lead.name}, {lead.company}, {lead.message}"
          cron_job: "enquiry-brief"

An accountancy practice could point its contact form backend at /webhooks/new-enquiry, so each enquiry wakes the enquiry-brief job and a brief lands in the partners' channel.

The sender must sign the request; the generic V2 headers carry a timestamp that has to be within 300 seconds, which blocks replays.

The docs also warn that a valid signature proves who sent the request, not who wrote the text inside it.

So name the fields you want in prompt instead of dumping the raw payload, and keep outbound tools off webhook-triggered runs.

📞 Rather have my team check your wiring before go-live? Book a free SEO strategy session and we'll walk through your lead flow, your channels and where Hermes fits. → Grab a free call with my team

Optional: A Legal Check On Cold Email Recipients

If anyone on the team will send cold email, look at Precleared, a third-party community plugin in the catalog.

It hooks the send step and checks each new recipient against rules such as UK PECR, UK GDPR, CAN-SPAM and Canada's CASL.

Anything not cleared goes to Hermes's approval prompt, or is refused in block mode.

Know the trade: the plugin sends each new recipient's address, plus your sender details and pitch, to precleared.dev for the check.

Optional: Prospecting Plugins That Already Ask First

Three community plugins in the catalog come from the vendors themselves, all through hosted MCP servers with OAuth sign-in.

FOUND: describes itself as an AI SDR for LinkedIn and email, with warm leads from buying signals and drafted messages; FOUND states campaigns created from Hermes start paused.
LinkedCamp: LinkedIn and email campaigns, sequences and AI-drafted replies; its catalog entry warns that message_send delivers at once.
RedReplier: surfaces leads from public threads on Reddit, X, Bluesky, Facebook and similar sites, each scored 0 to 100 for relevance.

All three packages mark their servers untrusted, so Hermes asks before any tool not marked read-only and refuses or blocks those tools in unattended runs.

That means a cron job can research with them, but it can't launch a campaign while you sleep.

Five Checks Before A Rep Sees It

Email a test from an address outside the allowlist and confirm nothing comes back.
Trigger one CRM write and confirm the approval prompt appears.
Run each cron job once by hand and read every draft.
Send one unsigned webhook request and confirm it's rejected; INSECURE_NO_AUTH is for testing only.
Store any site logins in the Hermes vault, where passwords are encrypted locally and the model never sees them.

If you add WhatsApp later, the Cloud API guide notes Meta's rule: replies sent more than 24 hours after the customer's last message need a pre-approved template.

How This Differs From A Grok Bot Sales Setup

Hermes is self-hosted and open source under the MIT licence, so the gateway, the inbox and the CRM tokens all live on a machine you control.

If you'd rather run sales jobs in a hosted cloud computer, our Grok Bot for sales walkthrough covers that route.

Everything above was checked against Hermes v0.23.0, "The Hearth Release", published on 5 November 2026.

Want the full Agent OS build and the people running it? It's all inside the AI Profit Boardroom.

Also On Our Network

FAQ: Hermes Agent For Sales

Can prospects email the Hermes sales desk directly?

Not with this setup. With EMAIL_ALLOWED_USERS set, Hermes only processes mail from the listed addresses, so reps forward leads to the desk and the agent replies to the rep.

Why does my Hermes inbox ignore every email?

The usual cause is a missing EMAIL_AUTHSERV_ID. While sender authentication is on, Hermes drops mail it cannot verify until you pin the authserv-id from the topmost Authentication-Results header.

Does Hermes have a HubSpot or Pipedrive connector?

No. The v0.23.0 catalogs have no HubSpot, Pipedrive or GoHighLevel entry. Attio and Close are MCP catalog entries, and Twenty CRM is a third-party community plugin.

How do I stop the agent changing CRM records on its own?

Set trust: untrusted on the CRM server in config.yaml. Every write-capable tool then needs approval, and you should never answer Always for tools that edit deals.

Where should cron follow-up drafts be delivered?

To a rep or team channel, never to a customer. Create the job from that chat so the default origin delivery sends the drafts back there.

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

About Julian

I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.

I help business owners scale with AI agents, automation and SEO.

I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
I've grown a YouTube channel to 400,000+ subscribers.
I wrote "Link Building Mastery".
My Udemy courses have taught over 29,000 students.

→ Get my best AI training inside the AI Profit Boardroom

Build Step 1 today, run every job once by hand, and book a free strategy session if you want a second pair of eyes on your Hermes Agent for sales setup.