Hermes Agent + xCloud

Manage servers with Hermes Agent on xCloud

Managing servers with Hermes Agent means giving an always-on agent that you reach from Telegram, Slack or a terminal access to your xCloud servers, so it can report on them on a timer and act on them when you approve.

Skill: xcloud:servers
Toolsets: servers, alerts, user
Free with every xCloud account

Set up Hermes Agent All Hermes Agent guides

YouReboot the staging server and message me when it is back.

servers_showread-only

Agentstaging-sg-1 hosts three sites, and all of them will be briefly unavailable during the reboot. Reboot it now?

YouYes.

servers_reboots_storeneeds approval

AgentReboot started. I am reading the operation and I will message you when xCloud verifies the new boot.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Hermes Agent to Manage servers on xCloud?

Connect Hermes Agent once; every job on this account uses the same connection. Then ask in plain words.

1
Add the xCloud MCP server
Add this under mcp_servers in ~/.hermes/config.yaml. If the file already has an mcp_servers block, add only the xcloud entry. Then start a new Hermes session, or run /reload-mcp in the one that is open.
YAML
```
mcp_servers:
  xcloud:
    url: "https://app.xcloud.host/mcp"
    auth: oauth
```
2
Authorize xCloud
On first connect Hermes prints an authorize URL and waits for the sign-in. Run this command to start it yourself or to re-authorize later. On the xCloud approval screen tick the teams and choose Read-only or Full access. Hermes caches the tokens in ~/.hermes/mcp-tokens/xcloud.json and reuses them on later runs.
Terminal
```
hermes mcp login xcloud
```
3
No browser? Use an API key
For a server with no browser, create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens and send it as a header in place of auth: oauth. Keep ~/.hermes/config.yaml out of version control when it holds a token.
YAML
```
mcp_servers:
  xcloud:
    url: "https://app.xcloud.host/mcp"
    headers:
      Authorization: "Bearer YOUR_TOKEN"
```

Check it worked

Then ask Hermes Agent for the job itself, for example:

Prompt

Which of my xCloud servers is closest to running out of disk? Tell me if any of them needs a reboot.

In practice

How Does Server management Work from Hermes Agent?

Hermes Agent runs as a process you leave on, and you reach it through the gateway from the chat app you already have open: Telegram, Discord, Slack, WhatsApp or Signal. That changes what server management feels like. You are rarely at a desk when a disk fills up, so the request arrives as a message, something like: which of my servers is closest to its disk limit, and does any need a reboot? Hermes calls servers_index and servers_monitoring and answers in the same chat with a line per server. The approval for anything riskier happens in that thread too. If you ask it to restart nginx on the Frankfurt server, it names the server, the service and the impact, then waits for your yes in the chat before it calls servers_services_restart.

Memory is the second difference. Tell Hermes once that the Frankfurt server is production and the Singapore one is staging, and a later message like reboot staging can lean on that instead of a round of questions. It still lists your servers and restates the one it is about to change, so a stale memory cannot send a reboot to the wrong machine. Reboots suit the chat flow well. Hermes starts the tracked reboot with servers_reboots_store, keeps reading servers_reboots_show, and messages you when xCloud reports a verified new boot. That is the moment you wanted to hear about, not the moment the request was accepted.

The third difference is the built-in cron scheduler. A job such as every morning at 9, read all my servers, flag disk above 80 percent or a Reboot Required status, list the addresses Fail2Ban has banned and message me the summary runs in a fresh session and delivers to a chat. That is a read-only report, so it needs no approval. Put the server names and the 80 percent threshold in the prompt itself, because a scheduled run starts in a fresh session. On a free plan the monitoring history part of the report comes back as a plan limit, and the agent should say that plainly instead of filling the gap.

Hermes Agent specific: A scheduled Hermes job runs while nobody is watching, so it cannot give the approval that a reboot, a service disable or a firewall change needs. Keep cron prompts to reads and reports, and when the report shows a problem, answer it in a normal message where you can say yes. Run hermes mcp login xcloud before you create the job, because scheduled runs reuse the cached sign-in, and pick Read-only on the xCloud approval screen if the job should never be able to change anything.

What xCloud does for server management

xCloud lets the agent list your servers, read their monitoring, and manage services, Node.js and PHP versions, cron jobs, firewall rules, Fail2Ban and sudo users. Changes that can interrupt a server stop for your approval, and a reboot is only reported as done after xCloud verifies a new boot.

Pick the team and the server. The agent works on one team at a time and uses the server you name. If a name is missing or matches several servers, it lists them and asks. It always restates which server it is about to change before it changes it.
Read the state first. It reads the server's status, installed services, runtimes and monitoring figures. A status such as low disk space or reboot required is worth surfacing on its own. Monitoring history is a paid-plan feature, so a free plan answers 403.
Say what will change, then ask. For a service, runtime, cron, firewall or sudo change, the agent names the server, the item and the impact, for example that a Node.js default affects every Node site on the server. It waits for your approval when the change could interrupt a service.
Follow the task to the end. xCloud accepts server work and returns before it finishes. The agent reads the server's task list until the task settles and reports the real outcome, not the acceptance.
Reboot with proof. A reboot starts a tracked operation. The agent reads that operation until xCloud reports a verified new boot. If the result is unconfirmed it investigates and never repeats the reboot just to check.
Buy a server only after approval. A new server is billable. The agent checks what you already have, reads the plans and the card on file, shows the plan, region and price, and waits for a yes. It sends the purchase once with an idempotency key so a retry cannot buy a second server.

Reference

Server management Settings and Limits on xCloud

The facts Hermes Agent works within when it manages servers. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Inventory	Every server on the team with its status, stack and the sites it hosts, plus the tasks, supervisor processes and site snapshots on a server
Monitoring	Current CPU, memory and disk are readable. Monitoring history is a paid-plan feature: xCloud answers 403 on the free plan, which is a plan limit and not a permission
Services	Install, enable, restart and disable. A restart runs without a server-side prompt; the agent still confirms the exact server, service and impact before any service change, because disabling ssh, nginx or a database can lock you out or cause downtime
Node.js versions	Read the installed versions and set the default. The default is server-wide and affects every Node site on the server
PHP versions	Install, uninstall, set the default, patch and toggle OPcache. The server default changes only the command-line php and the version new sites get; it does not change existing sites, and a single site's PHP version is a dashboard setting under Site > Site Settings
Cron jobs	List, create, update, delete, run now and read the last output for server cron jobs. Site cron is a separate resource
Firewall rules	List, create, delete, enable and disable rules with a name, protocol, allow or deny, port and optional source IP
Fail2Ban and IP access	List, ban and unban IP addresses, read the SSH restriction status, and whitelist your current IP or xCloud's own IPs
Sudo users	List, create or update and delete sudo users. A password is a secret and private keys are never returned
Verified reboots	Start a tracked reboot and read its operation; only a verified new boot proves it worked. An unconfirmed reboot can be rechecked without rebooting again
Buying a server	Billable, so it needs an approved plan, region and price, a card on file and an idempotency key. It buys xCloud-managed servers only
Dashboard-only	Resizing or deleting a server, a provider backup of the whole server (Server > Backup), bringing your own server, databases and database users, and PHP settings such as memory limit or upload size

Rules Hermes Agent has to follow

A change that can interrupt a server stops for your approval, and the agent names the server, the service and the impact first.
Buying a server is billable: the agent shows the plan, region and price and waits for your yes, and it never retries a purchase without checking your server list first.
A reboot is only reported as done when xCloud verifies a new boot, and an unconfirmed reboot is investigated, not repeated.
Disabling ssh, nginx, a database or a runtime service needs your explicit confirmation immediately before the call, because it can lock you out or take sites offline.
Resizing or deleting a server, provider server backups, bringing your own server and per-site PHP versions are dashboard steps; the agent gives you the path and the dashboard link xCloud returned.

Example prompts

What Can You Ask Hermes Agent to Do for Server management?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Which of my xCloud servers is closest to running out of disk? Tell me if any of them needs a reboot.

Prompt

Every morning at 9am, read all my xCloud servers and message me any with disk above 80%, a pending reboot or banned IPs. Change nothing.

Prompt

Reboot the staging server and message me here when xCloud says it is back.

Prompt

List all my xCloud servers with CPU, RAM and disk usage, and flag any server above 80% disk.

Prompt

List the cron jobs on the Frankfurt server with their schedules.

Prompt

Create a server cron job for the WooCommerce Action Scheduler every five minutes. Show me the final command and schedule before creating it.

Prompt

Install Redis on the Frankfurt server and enable the service.

Prompt

Switch the Frankfurt server's default Node.js to the latest LTS major.

Prompt

Reboot the staging server and tell me when it is back.

Prompt

Show me the IP addresses Fail2Ban has banned on the Frankfurt server, and unban 203.0.113.10.

Prompt

Create a new xCloud server on the smallest plan in Singapore. Show me the plan and price first and wait for my approval.

Hermes Agent and Server management: Frequently Asked Questions

What people ask before they let Hermes Agent manage servers through xCloud.

Can Hermes Agent message me when one of my servers needs attention?

Yes, with a Hermes cron job that reads your servers and delivers the result to Telegram, Slack or another configured chat. It can flag low disk space, a pending reboot and banned IP addresses. The job runs in a fresh session, so put the server names and thresholds in the prompt, and keep it to reads.

Will Hermes Agent remember which of my servers is production?

Yes, Hermes keeps memory across sessions, so you can tell it which server is production and which is staging. It still reads your server list and restates the server before any change, so an out-of-date memory cannot reboot the wrong machine. Tell Hermes to correct the memory if your setup changes.

Does the agent ask before it reboots a server?

Yes. A reboot stops for your explicit confirmation, then the agent starts a tracked reboot and reads the operation until xCloud reports a verified new boot. If the result stays unconfirmed it investigates rather than rebooting a second time.

Can an AI agent buy a new server for me?

Yes, but only after you approve it. A new server is billable, so the agent first checks your existing servers, reads the available plans and your card on file, then shows the plan, region and price and waits for your yes. It sends the purchase once, so a retry cannot buy a second server.

If the agent changes the server's PHP default, do my sites change version?

No. The server default changes the command-line php and the version new sites get, and it moves no existing site. Each site keeps its own PHP version, which you change in the dashboard under Site > Site Settings.

Can the agent resize or delete a server?

No. Resizing and deleting a server are dashboard-only, as are a provider backup of the whole server, databases and bringing your own server. The agent can tell you where the control is and give you the server's dashboard link.

Why did the agent say monitoring history is not available?

Monitoring history is a paid-plan feature, so xCloud answers 403 on the free plan. Current CPU, memory and disk readings are still available, and the agent will say that it is a plan limit, not a missing permission.

Other agents