GDG Singapore Hermes Workshop: Self-Hosted AI Agents on Google Cloud

Part of: community work alongside my Google Data Center internship

Overview

Designed and led a hands-on workshop on Hermes (Nous Research’s open-source autonomous agent framework) for the Google Developer Group Singapore monthly meetup, held Wednesday 23 Sep 2026 at Google Developer Space, Singapore (6:30-9:00 PM GMT+8, main programme from 7:00 PM). Attendees left with their own agent running on their machine, wired to Google AI Studio for the model and to Gmail / Calendar / Drive through a Google Cloud project they created themselves, producing a daily briefing and email triage skill.

I wrote the curriculum, the slide deck and the presenter script, ran the intro and the 30-minute hands-on segment, and coordinated a four-person speaker line-up (a Google DeepMind DevRel speaker, a Google product lead, an external guest builder, and me).

Event Facts

Learning Outcomes

1. What Hermes actually is, and how it differs from a chat wrapper.
2. Why wiring an agent into Google’s managed layer (AI Studio, Cloud Run, managed MCP servers) is worth doing for personal builds, not only for enterprises later.
3. Hands-on: an agent reading the attendee’s real calendar and inbox, built by them within about an hour.

Run of Show (as presented)

The first draft had a simple 30-minute grid starting at 7:00 (intro / demo / hands-on / nBits / wrap-up). The final agenda inserted welcome remarks and a DeepMind ecosystem talk, so my intro moved to 7:10 and hands-on to 8:00.

Deck Structure

• Community front matter (slides 1-13): GDG Monthly Meetup #2609 title, Google Developer Space guest security and entry rules, host intro, resources and community QR codes (Vibecoding Handbook, DevSpace Telegram, newsletter), upcoming events (Introduction to Google AI 22 and 29 Sep, AI-ML SG Group 24 Sep and 29 Oct, 65 Labs with Google DeepMind 14 Oct, DevFest 2026 on 28 Nov), About GDG Singapore, Tech For Good (Hillview CC with OGP, bringing Gemini into residents’ daily lives), speaker profiles, agenda.
• Google Cloud credits (slides 14-20): how attendees claimed $5 in Google Cloud credits through the Google Developer Program: use incognito, personal Gmail, create a GDP profile, verify by scanning a QR with a phone, wait 3-5 minutes, confirm the credits billing account shows up. Credits expire 12 hours after redemption.
• 01 Intro (Ray): What is Hermes; What Sets It Apart (persistent memory and self-authored skills, native MCP, messaging integrations); How It’s Built (interface layer, core, MCP protocol); The Landscape; Why This Matters (40% and 50+); Examples (own device vs cloud instance).
• 02 The Headless Web (Google speaker): Hermes 101 and cloud-native tools intro, evolution of compute, human UX vs headless UX, redefining latency, why APIs fail AI, the execution loop, packaging pure intent, local starter packs vs cloud VMs, the Cloud Run architecture, three live demos.
• 03 Hands On Session (Ray): prerequisites, quick links, install, AI Studio and LM Studio paths, provider setup, Google Cloud project, API enablement, OAuth consent and client, authorization, first briefing, cron scheduling, extra local-model guidance.
• 04 nBits Demo (guest from nBits Labs): Yellowdex address intelligence, Tracer, and the Yellowdex MCP server plugged into the attendee’s Hermes.
• 05 Wrapup (Ray): recap, additional pointers, where to go next, stick around, group photo, socials.

Content Detail

01 Intro (Ray Shao)

What is Hermes. An AI agent from Nous Research (released Feb 2026, one of the fastest-growing open-source projects of the year) that uses tools (browser, terminal, email, Telegram, Notion) to finish multi-step tasks on its own instead of telling you what to do. Examples on the slide: read an email, draft a reply and send it after approval via Telegram; pull info from Notion, cross-check a webpage and update a doc; run a terminal command, check the output and fix an error unaided.

What sets it apart. Three things separate it from a chat wrapper built in an afternoon:

1. Persistent memory and self-authored skills: it does not start from zero every session and improves on your specific workflows.
2. Native MCP support: the protocol that lets an agent plug into real tools rather than just talk; runs on 6 execution backends including serverless.
3. Messaging integrations: lives inside Telegram, Discord, Slack, WhatsApp or email, not just a terminal.

How it’s built. Interface layer (wherever you already work), core (persistent memory and self-authored skills), MCP protocol layer (real tools).

Comparison. Framed as “none of these is strictly better, they serve different builders”:

Why this matters. Two numbers: Gartner expects 40% of enterprise applications to embed task-specific agents by 2026, up from almost nothing a year earlier; and at Cloud Next this year Google made 50+ managed MCP servers generally available or in preview, covering nearly every Google Cloud service (already shipped, not a roadmap).

Two ways to run it. On your own device (VM, homelab, always-on machine) or on a cloud instance wired to a Google-managed MCP server, with zero infrastructure to stand up or patch yourself. Gemma 4 (Apache 2.0) was the local-model story.

02 The Headless Web (Google speaker)

• Hermes 101: a command-line tool; an aggregator of services you choose to connect; not a server, an OS or a development stack. Cloud-native: connect over SSH, choose your LLM with API keys, grant access to cloud/SaaS/servers with API keys, unlock full potential with MCP.
• Evolution of compute: mainframes (1960s-70s), personal computers (1980s-2000s), cloud and mobile (2000s-2020+), headless compute (2026 onward) where human intelligence at the edge orchestrates modular APIs.
• Latency: a human manages about 3 taps/sec; an autonomous agent can do the equivalent of 1,000 keystrokes/sec.
• Why APIs fail AI: rate limits and scale; no iteration or banter (single-turn transactions); unstructured inputs against strict parameters. Natural language becomes the programming interface (language to code rather than human to API).
• Execution loop and packaging intent: headless autonomous action, multi-step execution loops, unbounded intent scaling; beyond LLM wrappers, deploy anywhere, strict security boundaries and state persistence with auditability.
• Local vs cloud: local starter packs (Raspberry Pi, Mac mini) at $300-$10,000 upfront with a hardware ceiling, against cloud VMs at $5-$100+ per month with unlimited bandwidth and the option to spin up 1 or 10,000+ agents.
• Reference architecture: Serverless Hermes on Google Cloud Run. Cloud Run container on port 8080 fronting a unified native gateway (Telegram webhook and dashboard on one port); Cloud Scheduler pings every 5 minutes as a stay-warm heartbeat; SQLite local state in /tmp replicated in real time with Litestream to a GCS bucket (“the soul”); OpenTofu and Cloud Build manage the lifecycle for zero-drift deployments.
• Demos: (1) the command line on a laptop, (2) a cloud command line on an ephemeral instance, (3) a cloud computer: laptop to cloud to a full machine with swarms of containers.

03 Hands-on Session (Ray Shao)

Before we begin. LLM keys primarily from Google AI Studio (alternatives: OpenRouter, local LLM via LM Studio, other compatible endpoints). Run Hermes in a VM, strongly recommended, with no root/admin permissions to contain the blast radius (macOS: UTM, Windows: VirtualBox, other: cloud instance). Spare hardware (cheap mini PC, old laptop, spare PC) with Proxmox as a suggested hypervisor. Quick links: Hermes GitHub, AI Studio, Cloud Console.

Setup flow (what attendees actually did).

1. Install: open a terminal, copy the install commands from the Hermes GitHub repo, run them and approve prompts.
2. Cloud endpoint: in AI Studio sign in, open API Keys, create a key against a project, copy it.
3. Local endpoint (optional): LM Studio Local Server, load a model with OpenAI-compatible mode, enable the network server (and CORS in non-bridge VMs such as WSL/UTM), copy the address and model ID into Hermes as a custom endpoint, verify with curl if the model list is empty. Performance bar: about 30 tokens/s at 64k+ context, otherwise switch to a cloud endpoint.
4. Hermes setup wizard: exit the mode-selection page, choose the provider (AI Studio) and paste the key, choose a Flash Lite model for the best rate limits and set effort, take the default terminal backend, optionally connect Telegram (“connect this bot”), skip image, speech and search for now. Start with hermes chat; reconfigure with hermes setup.
5. Skill objective: a Google Workspace MCP skill for a daily briefing and email triage. Attendees prompted the agent to guide them (for example: create an email triage skill using Google Workspace MCP with a Google Cloud project, give me a daily briefing at a time I choose, ask questions to understand my needs).
6. Google Cloud project: create a project, select your own org for billing (nothing charged), open “explore and enable APIs”.
7. Enable APIs: Gmail, Google Calendar, Google Drive, Google Sheets, Google Docs, People (contacts).
8. OAuth consent screen: app name and support email, External audience with test users added, developer contact, agree to policy, create.
9. OAuth client: type Desktop app, download the client ID JSON, paste it into the Hermes chat (fall back to another Flash model if rate-limited).
10. Authorize: follow the link Hermes prints, choose permissions and Allow, copy the URL from the resulting empty page (it contains the auth code), paste it back into Hermes.
11. First result: ask for a briefing. Schedule it as a recurring cron job by asking Hermes. hermes dashboard launches the web UI. Use --help when unsure.

The demo prompt. “What’s actually on my plate this week? Check my calendar, flag anything urgent in my unread email, and pull up any docs that look relevant to what’s coming up.”

Local model guidance (slides 66-67). LM Studio (low complexity, slower tokens/s), llama.cpp (medium, medium tokens/s), vLLM (high complexity, high concurrency and total throughput). Picks by VRAM at 64k context: 6 GB Qwen3.5-4B / Gemma 4 E4B; 8 GB Qwen3.5-9B Q4; 12 GB Qwen3.5-9B Q6_K / Gemma 4 12B; 16 GB Gemma 4 12B Q6_K / Qwen3.5-9B Q8, with 128k context options via a Q4 KV cache or CPU-offloaded experts (Gemma 4 26B-A4B). Prefer quantised models for the VRAM saving at similar quality.

Safety note said aloud. Hermes asks for confirmation before it sends, edits or deletes anything, and the exercise only reads data. Use a personal Gmail (managed Workspace accounts often block third-party OAuth by admin policy, silently), and expect a “Google hasn’t verified this app” screen for your own OAuth client.

04 nBits Labs (guest from nBits Labs)

Yellowdex, an address-intelligence dataset and agent stack built by a two-person team at nBits Labs (15.8M labelled addresses, 10 networks, 55 indexer specs). Agents write deterministic indexer specs from one example transaction and open a reviewed pull request; no model runs in production; a human merges. Tracer is an investigation agent with about 40 read-only tools that cites tool calls for every answer. The segment ended with adding the Yellowdex MCP server (endpoint plus bearer key) to the Hermes each attendee had just built, and three use cases: fact-checking Telegram news alerts, watching treasuries and Safe signers, and tax records separating self-transfers from disposals, with the point that personal data stays on the attendee’s machine and the provider only sees addresses. Live demo page: a QR scan yielded a temporary key to add to Hermes.

05 Wrap-up (Ray Shao)

• Recap: what Hermes actually is (an agent that reads your world, plugs into real tools via MCP and remembers your workflows), why the Google stack matters for your own builds now, and what you just built with your own hands.
• Additional pointers: Hermes Desktop if the CLI is too confusing (less feature-rich); an OpenClaw auto-setup with Gemini in under 60 seconds; “the landscape is always changing, keep experimenting”.
• Where to go next: Vibecoding Handbook, DevSpace Telegram, newsletter, DevFest Singapore on 28 Nov 2026.
• Stick around: facilitators and the guest speaker table stayed; seed Q&A questions: what is the first thing you would want your second brain to do day to day; did anyone hit something in setup we did not cover.
• Closing line: “You came in tonight to hear about agents. Whatever you build with it next is the actual point of tonight.”

What I Owned

• Workshop concept, audience framing and learning outcomes.
• The full presenter script (five sections, slide-by-slide cues) and the hands-on checklist (parts A to D, timed).
• The Hermes intro and hands-on decks; the hands-on flow above, including the OAuth consent/client walkthrough that is the fiddliest part.
• Speaker coordination: DeepMind ecosystem talk, a Google product speaker and a guest builder from nBits Labs; a brief for the Google segment; agenda merge with the GDG SG organisers.
• Environment and infrastructure prep for hands-on: Hermes agent VMs on my self-hosted Proxmox cluster (Proxmox-Datacenter) used to rehearse and pre-test the install path.

Design Decisions

• One model path for the room. Standardised everyone on AI Studio (free key, no card) so nobody stalled on billing; LM Studio with Gemma and OpenRouter were positioned as swap-ins later, and the Gemma-on-device path was shown rather than required.
• Personal Gmail only. Managed Google accounts often block third-party OAuth apps and fail silently, so the checklist forced personal accounts up front.
• Read-only first. The demo prompt only reads calendar, inbox and docs, so the confirm-before-write behaviour of Hermes became a trust story instead of a risk.
• Run in a VM, no root. Contain the blast radius of an agent that can run a terminal.
• Credits without billing. GDP-issued $5 credits gave attendees a cloud billing account without needing a card, replacing the fallback of a free-trial signup.

Deviations from Plan

• The proposal specified a Cloud Run deployment demo, LM Studio + Gemma, and NVIDIA OpenShell guardrailing as stack items; in delivery Cloud Run was shown by the Google speaker as the reference architecture, LM Studio + Gemma was the optional local path, and OpenShell did not make the deck (the security story was VM isolation, least privilege and confirm-before-write).
• The script’s Gmail/Calendar/Drive-only connection grew to six Workspace APIs (adding Sheets, Docs, People) and the OAuth secret went in as a downloaded JSON pasted into chat, not a copied client ID and secret.
• Duration grew from 2 hours (7-9 PM) to a 6:30-9:00 PM evening including welcome remarks and the DeepMind talk; the hands-on block stayed at 30 minutes, which is tight for the Google Cloud OAuth setup (Part B was expected to overrun, and was flagged aloud as “where most of you will still be at the twenty minute mark”).