Starfish vs Hermes
Hermes made a brilliant bet — an agent that learns from your workflows and writes its own skills, self-hosted and model-agnostic. That self-improvement is powerful and, ungoverned, it's also the scariest property an agent can have. Starfish's answer: keep the capability, but make every self-authored skill and learned behavior earn trust before it can act.
What Hermes got right
Hermes solved something most agent frameworks ignore: memory and compounding capability. It treats every task as a chance to learn something reusable, and it generates skill files from your actual workflows. That's a genuine advance. Starfish isn't arguing against self-improvement — it's arguing that self-improvement without governance is an agent quietly expanding its own authority, which is exactly what governance exists to bound.
What they share
Both are self-hosted and model-agnostic. Both keep persistent memory and compounding capability, execute code, search the web, and manage files. And both let an agent write its own skills — Starfish just routes that generated skill through governed capability intake before it can run.
The difference: who gets to trust a new skill
Hermes's headline feature — the agent writing and then running its own automation — is, in governance terms, an agent minting new capability for itself. Starfish keeps the feature and changes who's in charge of trusting it:
- Self-authored skills are untrusted by default. A newly generated skill is a candidate, not a live capability. It goes through capability intake — provenance checking, deterministic risk scoring and prompt-injection screening, judged on recorded evidence, not the agent's say-so — and anything medium-risk or above is quarantined until you consent, before it is registered. (An isolated Arena that proves competence and non-deviation under trial is designed and on the roadmap, not in the current release.)
- Bounded autonomy. An agent may automate work; it may never expand its own authority. Each task carries a scope contract - narrower than the agent's standing grants, sealed at approval - and a call that strays outside its approved tools, paths, commands or budget is refused. Hard floors sit underneath, and no policy or tolerance setting can lift them.
- Provenance on everything remembered. Compounding capability is only safe if you can see why the agent believes something. Starfish's memory is provenance-first: nothing is remembered because the model said so.
- Earned auto-approval, revocable. Trust is earned by a recorded history of in-scope, in-bounds work and revoked on a single deviation — slow to earn, instant to lose.
The risk Hermes's best feature creates
A self-improving agent that writes and runs its own skills is a supply chain of one author who is also the executor — no second set of eyes. Starfish's capability intake plus proposer-not-approver is precisely a second set of deterministic, evidence-based eyes between "the agent wrote a skill" and "the skill can touch your system."
Who should choose which
Choose Hermes if you want maximum self-improvement velocity and you're comfortable being the sole reviewer of what your agent teaches itself. Choose Starfish if you love the idea of an agent that learns — but you want every new skill and learned behavior to prove it's safe, with an audit trail, before it can act.