DEV Community

Neeraj Kumar Singh Beshane
Neeraj Kumar Singh Beshane

Posted on

Running Hermes Agent on Cursor and Google Antigravity Without Third-Party Proxies

#python #opensource #ai #devtools

Most developers using autonomous agent harnesses like Hermes Agent already have developer subscriptions: Cursor Pro for coding and Google Antigravity for Gemini/Claude access. But pointing an external agent at them usually means either paying twice for metered API keys, or piping session tokens through third-party reverse proxies.

I built two open-source plugins that drive the official local CLIs instead:

  • hermes-antigravity-oauth (wraps Google's agy CLI)
  • hermes-cursor-acp (wraps Cursor's agent acp server)

Here is how both work and the engineering problems they solve.

1. Cursor ACP: Tool Fencing and Call Recovery

Cursor doesn't expose a chat completions API, but the Cursor CLI includes an ACP server (agent acp).

Connecting Hermes to it required three fixes:

A. The Security Fence

Cursor's CLI has native tools (Read, Write, Shell, WebFetch). When running an external agent harness, Hermes must control all file and shell execution under its own approval rules.

Without intervention, Cursor's native Read can read any file on disk. The plugin creates a private workspace at $HERMES_HOME/cache/cursor-acp-workspace and rewrites .cursor/cli.json every turn:

{
  "permissions": {
    "allow": [],
    "deny": [
      "Read(**)", "Read(/**)", "Write(**)", "Write(/**)",
      "Shell(*)", "WebFetch(*)", "Mcp(*:*)"
    ]
  }
}
Enter fullscreen mode Exit fullscreen mode

This forces Cursor to refuse its internal tools and emit tool calls through Hermes instead.

B. Tool-Call Parser Fixes

Hermes injects tool schemas into the prompt and expects <tool_call>{...}</tool_call> blocks in the output. Standard regex parsers break when:

  1. The model mentions <tool_call> in conversational prose before the actual block.
  2. The model outputs a flat {"name": "...", "arguments": {...}} object instead of a nested function call.

Our parser scans each tag, decodes JSON using raw_decode, and normalizes both shapes so Composer and GPT calls execute reliably.

C. Compression Preservation

Cursor returns no token counts over ACP. If a plugin reports 0 tokens, Hermes assumes real usage has completed and stops proactive compression. Emitting usage=None tells Hermes the provider is usage-less, preserving context compression.

2. Antigravity OAuth: Keychain and Claude Tool Bridging

For Google Antigravity, hermes-antigravity-oauth talks to the agy binary:

  • No Token Handling: The plugin never touches Google credentials. hermes auth add antigravity-oauth runs agy's browser sign-in, and credentials remain in the OS Keychain.
  • SOUL.md Delivery: The Hermes persona is written to GEMINI.md in the private workspace, which agy respects as top-level instructions.
  • Claude Native Tool Re-routing: Claude models on Antigravity often emit native run_command or view_file calls. The plugin intercepts these and re-issues them as Hermes terminal and read_file commands, preserving user approvals.

3. One-Command Setup

Both plugins ship with npx installers:

# Cursor models
npx hermes-cursor-acp
hermes --provider cursor -m claude-opus-5-5

# Google Antigravity models
npx hermes-antigravity-oauth
hermes --provider antigravity-oauth -m gemini-3.8-flash
Enter fullscreen mode Exit fullscreen mode

Links & Provenance

Both are MIT licensed, covered by CI unit tests, and published to npm with GitHub Actions OIDC provenance:

Top comments (0)