Mert

Design a Clean Form with Floating Labels in Bootstrap 5

yazar

Bootstrap 5 comes with built-in floating labels, but the default inputs can feel a bit too tall for compact forms.

Here’s a cleaner version with a more balanced height and a simple card layout.

The HTML structure: 

<link
  href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css"
  rel="stylesheet"
/>

<div class="container py-4">
  <div class="row justify-content-center">
    <div class="col-md-6">
      <div class="card bg-white shadow-sm">
        <div class="card-header h6 py-3 fw-bold">
          Register
        </div>

        <div class="card-body">
          <form method="#" autocomplete="off">
            <div class="row">
              <div class="col-md-6">
                <div class="form-floating mb-3">
                  <input type="text" class="form-control" id="first_name" name="first_name" placeholder="First name">
                  <label for="first_name">First name</label>
                </div>
              </div>

              <div class="col-md-6">
                <div class="form-floating mb-3">
                  <input type="text" class="form-control" id="last_name" name="last_name" placeholder="Last name">
                  <label for="last_name">Last name</label>
                </div>
              </div>
            </div>

            <div class="form-floating mb-3">
              <input type="email" class="form-control" id="email" name="email" placeholder="Email address">
              <label for="email">Email address</label>
            </div>

            <div class="form-floating mb-3">
              <input type="password" class="form-control" id="password" name="password" placeholder="Password">
              <label for="password">Password</label>
            </div>

            <div class="form-floating mb-3">
              <input type="password" class="form-control" id="password_confirmation" name="password_confirmation" placeholder="Confirm Password">
              <label for="password_confirmation">Confirm Password</label>
            </div>

            <button type="submit" class="btn btn-primary w-100">
              Register
            </button>
          </form>
        </div>
      </div>
    </div>
  </div>
</div>

We need just a little bit of custom CSS: 

.form-floating > .form-control {
    height: 48px;
    min-height: 48px;
    padding: 1rem 0.75rem 0.25rem;
  }

  .form-floating > label {
    padding: 0.75rem;
  }

  .form-control:focus {
    box-shadow: none;
  }

And here’s our nice form! 😊

Your MCP Server Is Probably Overprivileged – Here’s a Scanner For It

yazar

MCP servers expose tools to LLMs, but most configs grant tools broader permissions than they need, ship without auth, and leak prompt-injection surface in tool descriptions. This scanner finds it before your model does.

Most MCP servers I’ve audited in the last few months had the same three issues:

  1. A shell or fs tool was scoped to the entire filesystem when the use case needed exactly one directory.
  2. The transport ran without auth because the local-dev SSE config got promoted to prod.
  3. Tool descriptions echoed verbatim into prompts with no sanitization — a perfect injection surface.

@hailbytes/mcp-security-scanner is what I wish I’d had on day one of building MCP servers. It’s a static + dynamic scanner for MCP configs and live endpoints that flags these patterns.

CLI

# Scan a local config
npx @hailbytes/mcp-security-scanner ./mcp-config.json

# Scan a live endpoint
npx @hailbytes/mcp-security-scanner https://my-mcp-server.example.com

# SARIF output + fail the build
npx @hailbytes/mcp-security-scanner ./config.json --output=sarif --exit-code

Programmatic

import { scan } from "@hailbytes/mcp-security-scanner";

const report = await scan({ configPath: "./mcp-config.json" });

if (!report.passed) {
  console.error(report.findings);
  process.exit(1);
}

What it checks

  • Overprivileged tools — broader permissions than the declared function needs (filesystem scope, shell access, network egress)
  • Missing or weak authentication — unauthenticated transports, missing token validation, plaintext secrets in config
  • Prompt injection surface — tool descriptions and output paths that pass through to model context without sanitization
  • Unsafe defaults — insecure transport defaults, verbose error exposure, CORS wildcards

The SARIF output drops straight into GitHub Code Scanning, so findings show up as alerts on PRs — same place your SAST results live. 

npm install -g @hailbytes/mcp-security-scanner

Source: github.com/hailbytes/mcp-security-scanner — MIT licensed. Pairs nicely with @hailbytes/mcp-server-template if you want a scaffold that comes up secure by default.

Maatru: An agentic Telugu literacy app for kids, built with Gemma 4

yazar

This is a submission for the Gemma 4 Challenge: Build with Gemma 4

What I Built

I’m from Hyderabad, India. My wife and I both grew up speaking Telugu — it’s our mother tongue. We have two daughters, three and one and a half. They’re at a daycare where the teachers cover English letters and rhymes, sometimes Hindi, but not Telugu. And here’s the part that’s harder to admit: my wife and I haven’t read or written Telugu in any real way for years. We can speak it fluently, but we lost the script somewhere along the way. When I mentioned this to colleagues at work, several of them said the same thing about their own kids. This is what Maatru is for.

Maatru is a small app for parents like me who can’t comfortably teach the script themselves. A kid taps Start and hears a Telugu letter spoken aloud. Four letter buttons appear on screen and they tap the one that matches the sound. After five letters the session ends and they see a “Great job” card. Later, a parent can open a separate dashboard — gated by a PIN — and read a short English paragraph about what their kid practiced that day, which letters they got right, and which ones they’re still working on.

My first design had the kid write the letter on paper and photograph it; Gemma 4 would compare it to the target and give feedback. I tested that capability on Day 1 before building anything around it. The moment I knew was when Gemma 4 confidently misread అ — a clean, typed vowel on a white background — as completely different characters: ౦ on cloud, ని locally. It got 1 of 20 right on Gemma 4 E4B running locally and 4 of 20 on the 31B variant via OpenRouter — both models failed even on typed reference, which should have been the easy case. The vision capability wasn’t there yet for Indic scripts, at least not reliably enough to be the foundation of a literacy tool.

What I ended up with uses Gemma 4 for the two things it does reliably for Telugu — generating curriculum content in plain text, and making pedagogical decisions about what a specific kid should practice next. The kid loop itself doesn’t call the model. The parent dashboard does, once per visit. I’ll walk through both in the ‘How I Used Gemma 4’ section below.

Demo

Code

GitHub logo

ai-with-avinash
 /
maatru

Telugu literacy app for kids. Built with an agentic Gemma 4 planner that adapts to each child’s progress.

Maatru

A Telugu literacy companion for kids whose parents can speak the language but lost the script.

What this is

Maatru is a small web app for parents like me — Telugu speakers raising kids in English-medium schools, who can’t comfortably teach the Telugu writing system because we’ve lost it ourselves. A kid taps Start, hears a Telugu letter spoken aloud, and taps the matching letter from four options. After five letters they see a “Great job” card. A separate parent dashboard (PIN-gated) shows what the kid practiced — in English — alongside the AI’s pedagogical reasoning for why those letters were chosen.

Built for the dev.to Gemma 4 Challenge: Build with Gemma 4.

Architecture at a glance

Two layers, deliberately separated:

  • Layer 1 (kid loop): Deterministic, zero Gemma 4 calls during a session. Renders from a cached SessionPlan. Sub-second response on every tap.
  • Layer 2 (planner): One agentic…
View on GitHub

How I Used Gemma 4

I shipped on Gemma 4 31B Dense, accessed via OpenRouter’s free tier (model string: google/gemma-4-31b-it:free). I’d tested the E4B variant locally first — running through Ollama on an M4 MacBook Air with 16GB of RAM — and the latency wasn’t workable for a kid-facing flow. E4B took 8 to 46 seconds on generation prompts, with two hard timeouts at 60s. The 31B Dense via OpenRouter wasn’t fast either (median 5.3s, p95 15.4s in a 50-request stress test), but its function-calling reliability is what made the rest of the architecture buildable: in a smoke test, it produced valid tool calls on 8 out of 8 invocations across two runs. The free tier comes with constraints — 20 requests per minute hard cap and roughly 36% upstream 502s from Google AI Studio — and the architecture was designed around them from day one.

Gemma 4 runs in exactly two places. When a parent opens the dashboard, one call generates an English-language summary of what their kid did that day — practiced letters, where they were confident, where they struggled, what to expect next. When a kid taps Start, one agentic call decides what the session will contain: which letters to target, what distractors to pair them with, what feedback strings to show on correct and wrong taps, and a short paragraph explaining the pedagogical reasoning. The kid loop itself, between session start and end-card, makes zero calls to Gemma 4.

The architectural decision that shapes everything else is bundling. The naive design would have called Gemma 4 once per kid interaction — one call to generate three distractors when a letter appears, another to produce feedback when the kid taps. For a 5-letter session that’s roughly fourteen Gemma 4 calls, each taking 5-15 seconds on the free tier and any of which could fail with a 502. Instead, the planner makes one agentic call at session start and returns a SessionPlan that bundles everything the kid loop needs for the whole session: per-step distractors, per-step feedback variants, the session-level reasoning. The kid loop then runs deterministically from the cached plan, and Gemma 4 stays out of the critical path entirely. Roughly fourteen calls becomes one.

The planner is given three read-only SQLite tools — get_recent_sessions, get_letter_accuracy, get_curriculum — and Gemma 4 calls them via function calling before proposing a plan. The output is a SessionPlan that bundles the kid loop’s content and a short paragraph of reasoning that explains the pedagogical choice. That reasoning is visible to the parent on the dashboard. After session 1 (a cold start: “starting with the first five foundational vowels”), session 2 read the history and adapted on its own: “The child did well in the first session but struggled slightly with ఇ. We are reinforcing the first five vowels with medium difficulty and introducing ఊ to expand their knowledge.” That second paragraph wasn’t templated — it was Gemma 4 reading two sessions of attempts and making a teaching call.

The planner call is wrapped in a retry-with-backoff (1s, 3s, 9s; three attempts) that handles 429s, 502s, timeouts, and malformed tool calls. If retries exhaust or the model returns something unparseable, the planner falls back to a deterministic curriculum heuristic — same SessionPlan shape, hand-written letter selection logic, no AI involved. The dashboard knows the difference: planner-driven sessions show their reasoning paragraph; fallback sessions hide it. A 45-second server-side timeout caps the whole thing so the kid never waits more than ~46 seconds from tapping Start. During verification, the fallback path fires often enough — sometimes 25-40% of the time under heavy upstream instability — that I treat it as a normal operating mode, not an exception.

devchallenge #gemmachallenge #gemma

Gemma 4 Is Not Just Another Open Model — It Changes What Developers Can Build Locally

yazar

This is a submission for the Gemma 4 Challenge: Write About Gemma 4

Most posts about new models focus on benchmarks, setup commands, or a fast comparison table. Gemma 4 deserves a better kind of explanation because it is not just another model release to skim and forget.

It feels more like a practical local AI stack for developers who care about privacy, multimodal workflows, long-context reasoning, and real software integration. That is what makes it worth writing about in a broader way.

This post covers the full picture: what Gemma 4 is, how its variants differ, how to choose between them, what makes its multimodal and long-context capabilities important, how to start locally, where it fits in real projects, and why it matters beyond one release cycle.

Why Gemma 4 matters

Gemma 4 is one of the most important open model releases in the Gemma line because it pushes the conversation beyond raw intelligence alone. The bigger shift is that useful AI is moving closer to the user.

Instead of assuming every serious workflow must depend on a remote API, Gemma 4 strengthens the case for local-first intelligence. That changes how developers think about deployment, privacy, latency, resilience, and product design.

For builders, this means the model is not only something to chat with. It is something that can sit inside assistants, mobile experiences, research tools, coding systems, document workflows, and structured automation pipelines.

The four Gemma 4 variants

The most useful way to understand Gemma 4 is to treat it as a family, not as one model with different download sizes. Each variant is clearly more suitable for a different hardware level and product style.

Model Best for Main idea
Gemma 4 E2B Edge devices, mobile tasks, offline use Lightweight local intelligence with multimodal support
Gemma 4 E4B Stronger on-device assistants and practical local apps More capable while still efficient for local deployment
Gemma 4 26B MoE Fast workstation reasoning, coding, tool use Mixture-of-experts design that balances quality and efficiency
Gemma 4 31B Dense Highest-quality local reasoning and advanced fine-tuning Best fit when output quality matters more than speed

This is where the model family becomes genuinely useful. Developers are not forced into one giant default choice.

A small model can power private mobile or offline experiences, while a much stronger model can serve as a serious local reasoning engine on a workstation. That range is one of Gemma 4’s biggest strengths.

How to choose the right one

If the goal is mobile, privacy-first, or offline assistance, E2B and E4B are the most natural choices. These are the kinds of models that fit translation helpers, field assistants, classroom tools, note summarizers, accessibility experiences, and on-device productivity features.

If the goal is a desktop copilot, coding assistant, or tool-using workflow, the 26B MoE model becomes especially interesting. It is a good match when strong reasoning is needed but latency still matters.

If the goal is maximum reasoning quality, deeper analysis, or future fine-tuning for a specialized domain, the 31B Dense model is the stronger fit. That is the version to think about for advanced writing systems, repository understanding, domain copilots, and heavier internal tools.

What makes Gemma 4 technically exciting

A lot of open model launches sound impressive in the same generic way. Gemma 4 stands out because several important capabilities come together in a way that directly changes product design.

Multimodal input

Gemma 4 is not limited to plain text. It supports multimodal understanding, including image and video, while some edge-oriented variants also support audio input.

That matters because real-world software workflows are rarely text only. Users work with screenshots, scanned pages, diagrams, voice notes, charts, camera input, and mixed technical material.

A model that can handle those naturally creates much better product possibilities. A local assistant that reads a UI screenshot, understands a spoken complaint, and returns a structured bug summary is far more useful than a chatbot waiting for perfectly typed prompts.

Long context

The long context window is another major reason Gemma 4 matters. It makes it much easier to work with long code files, documentation sets, multi-document packets, transcripts, and research material in a single session.

This changes what local AI can do in practice. Instead of building complicated chunking systems too early, developers can first explore richer direct workflows like repository explanation, multi-file debugging, policy review, academic summarization, and large-context planning.

That shift is subtle but important. When the model can keep more of the task in view, the developer spends less time fighting orchestration and more time shaping the actual user experience.

Structured output and tool use

Gemma 4 also becomes more valuable when looked at as part of a workflow, not just as a chatbot. Function calling, structured output, and agent-style behavior are what make models usable inside real systems.

The difference between a fun AI demo and a reliable product usually appears when the model needs to pass clean JSON, call tools, classify information, or route decisions into code. That is why this part matters so much.

A model that can reason and still return predictable machine-readable output is far easier to integrate into production software.

A better way to teach readers about Gemma 4

Most model articles explain from the inside out. They start with parameters, move to benchmarks, and then end with a few generic use cases.

A more useful approach is to explain Gemma 4 from the outside in. Start with the product constraint.

If the constraint is privacy, choose a smaller local model. If the constraint is latency, use the model that stays responsive on available hardware. If the constraint is output quality for difficult reasoning or future adaptation, move to the stronger dense model.

This framing helps readers immediately connect the model to actual decisions. It turns Gemma 4 from “another release” into “a design choice.”

A hands-on local starting point

A strong educational post should leave readers with something they can try immediately. One easy path is to run Gemma 4 locally with a runtime such as Ollama. 

ollama pull gemma4
ollama run gemma4

That is enough to begin testing prompts and checking local performance. But a better experiment is to give the model a project README, an issue report, and a screenshot, then ask for a JSON response with fields like problem_summary, possible_root_cause, files_to_check, and recommended_next_step.

That single exercise teaches more than a generic chat prompt. It shows how Gemma 4 can reason across mixed inputs and produce output that software can directly act on.

A creative application readers will remember

The best way to stand out in a challenge like this is not to repeat what everyone already knows. It is to show a fresh product pattern.

One standout idea is a local digital investigator. The system takes screenshots, logs, voice notes, and long technical documents, then produces a structured incident brief, highlights anomalies, suggests next actions, and keeps the workflow private on the device or workstation.

That concept works especially well because it fits cybersecurity, debugging, compliance, education, support engineering, and technical operations. It also shows off what Gemma 4 is actually good at instead of forcing it into a generic chatbot role.

What local Gemma 4 means for the future

The biggest idea behind Gemma 4 is not only that open models are improving. It is that local models are becoming strong enough to be serious building blocks.

That changes who can build, where systems can run, and what kinds of users can be served safely. A student with weak internet, a startup with tight cost limits, a privacy-sensitive organization, or an independent builder working on a laptop can all benefit from that shift.

When capable models run across phones, laptops, desktops, and cloud-connected workflows, developers gain freedom. They can design around user needs instead of designing around permanent dependence on one hosted endpoint.

Licensing and practical caution

A trustworthy post should also mention responsible usage. Developers should always check the official Gemma 4 model pages, supported runtimes, license terms, and deployment documentation before shipping or redistributing anything.

It is completely fine to explain how to run the model, compare variants, and discuss supported tooling. It is not a good idea to imply permissions or guarantees beyond what the official release materials actually state.

That small caution makes technical content more credible.

Why Gemma 4 is worth writing about

Gemma 4 sits at the intersection of several important trends. It is open, practical, multimodal, long-context capable, and deployable across very different hardware tiers.

That combination makes it useful not only for researchers, but for actual product builders. The most exciting Gemma 4 projects will probably not look like flashy AI demos at all.

They will look like better apps, faster workflows, smarter local assistants, safer enterprise tools, and more inclusive software that continues working even when connectivity is weak. That is what makes Gemma 4 more than a release.

It is a signal that local AI is becoming real infrastructure for developers.

Helpful Links

https://www.youtube.com/watch?v=iB5POKmXfWY
https://developer.android.com/blog/posts/android-studio-supports-gemma-4-our-most-capable-local-model-for-agentic-coding
https://www.youtube.com/watch?v=7LEvSOiTWZk

OpenVibe: An Open-Source AI Coding IDE That Works With Any Model

yazar

openvibe is an open-source desktop IDE with a built-in AI coding agent. The agent has direct access to your file system, terminal, and web search, so you can describe a task and it executes the full workflow — reading code, writing new files, editing existing ones, running commands.

Unlike Cursor or Claude Code, openvibe doesn’t lock you to a single AI provider. It works with any OpenAI-compatible API: OpenAI, Anthropic Claude, Google Gemini, Groq, DeepSeek, OpenRouter, and local models via Ollama, LM Studio, or vLLM. Switch providers in two clicks. No subscription, no account, no telemetry.

Core capabilities:

  • Agentic AI — autonomous file operations, command execution, web search
  • MCP support — connect external tools (GitHub, databases, browsers) via Model Context Protocol
  • Project-specific rules — drop a .vibe/rules.md in your project to teach the AI your conventions; it reads them at session start and follows them strictly
  • Real-time Monaco editor — see AI code changes live as they happen
  • Integrated PowerShell/bash terminal with multiple tabs
  • Multi-project workspace with isolated chat history per project
  • Project templates for React, Next.js, Express, Flask, Electron, Telegram Bot, Vue
  • Project snapshots — one-click zip backup
  • Markdown and LaTeX rendering with diff view for AI edits
  • Works fully offline with local models

License: MIT. No tracking, no required account, no cloud dependencies.

GitHub: https://github.com/muradtedeev0912-maker/openvibe
Website: https://openvibe-beta.vercel.app/

Looking for feedback from developers who use AI coding tools daily — what’s missing, what works, what’s broken.

I Inspected the System Program and It Looked Just Like My Wallet

yazar

The Challenge

Day 25 of 100 Days of Solana: inspect system program accounts. Your wallet, the System Program, native programs, sysvar accounts. Use the CLI and Explorer. Understand how they differ and how they’re the same.

I’d been hearing “everything is an account” for 25 days. This was the day I actually verified it.

Starting With My Wallet

solana account <MY_ADDRESS> --url devnet

Output:
Balance: 1.247 SOL
Owner: 11111111111111111111111111111111
Executable: false
Rent Epoch: 0

The owner field jumped out: 11111111111111111111111111111111. The System Program. My wallet isn’t a special type of thing — it’s an account that the System Program owns and manages. Every SOL transfer I’ve ever made was the System Program modifying this row.

Inspecting the System Program Itself

solana account 11111111111111111111111111111111 --url devnet

Output:
Balance: 1 SOL
Owner: NativeLoader1111111111111111111111111111111
Executable: true
Data Length: 14 bytes

The System Program the program that underlies every wallet on Solana, that has processed billions of transactions is an account with 14 bytes of data and a 1 SOL balance. The executable: true flag is the only thing that distinguishes it from my wallet structurally. Same schema. One boolean different.

The 14 bytes confused me at first. After some digging: native programs have their code compiled directly into the validator binary. The account is essentially a registry entry a marker that says “this address is the System Program.”

The BPF Loader

solana account BPFLoaderUpgradeab1e11111111111111111111111 --url devnet

Executable: true
Owner: NativeLoader
Data Length: 36 bytes

The ownership chain: NativeLoader → BPF Loader → my future programs. Three levels, all expressed as account ownership fields.

Sysvar Accounts

solana account SysvarC1ock11111111111111111111111111111111 --url devnet

The Clock sysvar holds the current slot, epoch, and unix timestamp. Updated every slot by the runtime. Programs that need time-based logic read this account.

What surprised me: it’s just an account. executable: false, owned by the Sysvar program, 40 bytes of encoded data. The same structure as everything else.

The Mental Model I Built

Every account sits on a spectrum from “pure data” to “pure code,” determined entirely by two fields:

  • executable is this account code or data?
  • owner which program has authority over this account?
Account type executable owner
Wallets false System Program
Regular programs true BPF Loader
Native programs true NativeLoader
Sysvar accounts false Sysvar program
Your data accounts false your program

No special types. No separate registries. One table, differentiated entirely by field values.

The CLI Commands Worth Bookmarking

solana account 11111111111111111111111111111111              # System Program
solana account BPFLoaderUpgradeab1e11111111111111111111111  # BPF Loader
solana account SysvarC1ock11111111111111111111111111111111  # Clock sysvar
solana account SysvarRent111111111111111111111111111111111  # Rent sysvar

One command. Any account. The entire network is readable.

Hermes vs OpenClaw: The Two Most-Starred AI Agent Frameworks of 2026

yazar

In 2026 the open-source AI agent space crossed a threshold: agents are no longer demos. Two projects sit near the top of the GitHub charts, and they represent two different bets on what a personal AI agent should be.

  • Hermes Agent — 163k stars, built by Nous Research, Python. “The agent that grows with you.”
  • OpenClaw — 374k stars, sponsored by OpenAI, GitHub, NVIDIA, and Vercel, TypeScript. “Your own personal AI assistant. Any OS. Any platform. The lobster way. 🦞”

At a glance they solve the same problem: a personal assistant that lives on messaging platforms (Telegram, Discord, Slack, WhatsApp, Signal, iMessage…) and can reason, plan, and call tools. Underneath, they bet on different futures — and one project is now actively migrating users from the other.

This post breaks down what’s actually different, where each wins, and which to pick in 2026.

The 10-Second Summary

Both projects ship:

  • Multi-channel chat (Telegram, Discord, Slack, WhatsApp, Signal, iMessage, and more)
  • Tool calling (browser, shell, files, scheduling)
  • Sandboxed execution
  • Pluggable LLM providers (OpenAI, Anthropic, OpenRouter, local models)
  • Persistent memory and per-user state
  • An MIT license

The bets are different:

Dimension Hermes Agent OpenClaw
Built by Nous Research openclaw org (OpenAI / GitHub / NVIDIA / Vercel sponsored)
Language Python TypeScript (Node 22.19+)
GitHub stars 163k 374k
Killer feature Closed learning loop — self-improving skills, agent-curated memory Live Canvas — agent-driven visual workspace + native macOS/iOS/Android apps
Channels Telegram, Discord, Slack, WhatsApp, Signal, Email, CLI 22+ — adds iMessage, Teams, Matrix, LINE, Feishu, Mattermost, WeChat, QQ, Nostr, and more
Skills standard agentskills.io + Honcho dialectic user modeling Bundled / managed / workspace skills + ClawHub registry
Tools MCP-native, 40+ built-in, RPC subagents Browser, canvas, nodes, cron, sessions, channel actions
Hosting Local, Docker, SSH, Singularity, Modal, Daytona, Vercel Sandbox Local Gateway as control plane + companion macOS/iOS/Android apps
Ideal user Developers who want an agent that learns from them across sessions Users who want a polished personal assistant on every device and channel

What Makes Hermes Different: The Closed Learning Loop

Most agent frameworks treat memory as a database — store facts, retrieve them later. Hermes treats memory as a feedback loop:

  • Autonomous skill creation. After a complex task, the agent can write its own skill (a reusable procedure) and save it.
  • Skills self-improve during use. When a skill fails or works, the agent updates it.
  • Periodic memory nudges. The agent reviews and curates its own memory in the background.
  • FTS5 session search with LLM summarization. Past conversations are first-class context — Hermes searches and summarizes what it has already done with you.
  • Honcho dialectic user modeling. A separate component builds a persistent model of who you are across sessions.
  • agentskills.io standard. Skills are portable across compatible agents — share and consume.

The bet: an agent that gets sharper the more you use it is more valuable than one that’s smart on day one. Hermes is the only mainstream agent shipping this kind of closed loop today.

The README puts it plainly: “The self-improving AI agent. It creates skills from experience, improves them during use, nudges itself to persist knowledge, searches its own past conversations, and builds a deepening model of who you are across sessions.”

What Makes OpenClaw Different: Channel Breadth + the Live Canvas

OpenClaw is going for surface area. Two things stand out:

1. The channel list is enormous. WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage, IRC, Microsoft Teams, Matrix, Feishu, LINE, Mattermost, Nextcloud Talk, Nostr, Synology Chat, Tlon, Twitch, Zalo, WeChat, QQ, WebChat — plus native macOS, iOS, and Android. If your team or family is on it, OpenClaw probably bridges it.

2. Live Canvas + A2UI. OpenClaw’s most unique feature: an agent-driven visual workspace where the assistant renders and manipulates a live UI alongside the conversation. The agent draws a chart, a form, or a kanban board on a shared canvas you can both see and edit. A2UI is OpenClaw’s protocol for this.

Beyond that, OpenClaw ships:

  • Voice Wake + Talk Mode — wake words on macOS/iOS, continuous voice on Android (ElevenLabs primary, system TTS fallback)
  • Native menu-bar app on macOS with push-to-talk overlay, gateway health, and WebChat
  • Multi-agent routing — route inbound channels/accounts/peers to isolated agents (workspaces + per-agent sessions)
  • Sandboxing — Docker default, with SSH and OpenShell backends

OpenClaw’s bet: most users don’t want to live in a CLI. They want voice, vision, and presence on every device they already use.

Security: Same Primitives, Different Defaults

Both projects take messaging-platform exposure seriously, and both ship the same primitives:

  • DM pairing — unknown senders get a pairing code; messages aren’t processed until approved
  • Allowlist-based access control
  • Sandboxed tool execution for non-trusted sessions
  • Doctor commands (hermes doctor, openclaw doctor) that flag risky configs

Where they diverge:

  • OpenClaw documents an explicit Gateway exposure runbook for anyone running the gateway on a publicly reachable network. Read it before opening the port.
  • Hermes leans on container/terminal isolation — seven terminal backends (Docker, Modal, Daytona, Vercel Sandbox, etc.) let you scope where tools actually run.

Neither is meaningfully “safer by default.” The real risk in both cases is the same: an agent connected to your messaging platforms is a fat target. Treat every inbound DM as untrusted input, and follow each project’s security guide before remote exposure.

The Migration Tool: A Competitive Tell

The most revealing fact in the two READMEs, and the one most articles miss:

Hermes ships a built-in OpenClaw migration command. 

hermes claw migrate              # Interactive migration
hermes claw migrate --dry-run    # Preview
hermes claw migrate --preset user-data

It imports SOUL.md persona files, MEMORY.md and USER.md entries, user-created skills (into ~/.hermes/skills/openclaw-imports/), command allowlists, messaging settings, allowlisted API keys, TTS assets, and workspace AGENTS.md instructions.

That’s not the move of a complementary project. That’s a successor framework betting it can convert the larger user base. Nous Research is saying, in code: if you’re on OpenClaw, here’s the door.

Whether the bet pays off depends on whether the closed learning loop matters as much to users as channel breadth and the visual canvas.

Which One Should You Pick?

Pick Hermes if:

  • You want an agent that learns — improves its own skills, remembers you, gets sharper over months
  • You live in Python and want MCP-native tool integration
  • You’re a researcher or developer experimenting with agent cognition, trajectory training, or self-improvement
  • You’re comfortable in a TUI and want serverless hosting (Modal, Daytona, Vercel Sandbox)

Pick OpenClaw if:

  • You want a polished personal assistant across every device — macOS menu bar, iOS, Android, voice
  • You need niche messaging channels (iMessage, Teams, Matrix, WeChat, QQ, LINE, Feishu)
  • The Live Canvas matters for your workflow (visual outputs, shared UIs)
  • You’re in a TypeScript shop and want Node-native

Use both? Possible, but probably not the move. They overlap heavily, and Hermes’ migration tool suggests Nous expects you to eventually pick one.

The Bigger Picture

Two years ago the agent debate was can these systems do anything useful at all? In 2026 the debate has moved on. The real question now: should your agent get smarter over time, or just be everywhere you are?

Hermes is the strongest bet on the first answer. OpenClaw is the strongest bet on the second.

Both are MIT-licensed, both are production-grade, and both have raised the bar for what an open-source personal AI agent can be.

What’s Next?

Comment below …….

Dig deeper: