Hermex vs Innkeeper

Hermex is a native iPhone and iPad client for your self-hosted Hermes agent. It connects directly to your Hermes host. Existing Hermes Web UI servers keep working as legacy. Open existing sessions, start conversations, and follow streamed responses, tools, and reasoning as they arrive. Queue, steer, or stop an active run. Review file edits as diffs, browse workspace files, send photos and files, and dictate messages. Switch between Bots and Sessions, manage Kanban boards and Cards, browse Tasks, Skills, Memory, and Usage, and choose models, Profiles, and reasoning settings. Move to Hermes brings a Web UI server’s chats, drafts, and notifications over to your Hermes host. Live Activities keep working runs visible on the Lock Screen and Dynamic Island. Optional notifications let you know when work finishes or needs your attention. The share extension stages content from other apps for you to review and send. Agent execution happens on your configured server, not on the iPhone. Your server owns your conversations, tools, and workspace. Recent sessions and messages may be cached locally for read-only offline viewing; clear that cache from Settings. There is no Hermex-hosted agent backend, tracking, or analytics service. Optional push notifications use an open-source, self-hostable relay. Message previews are encrypted on your Hermes host and decrypted on your iPhone; the relay handles device tokens, notification metadata, and ciphertext, never message text, server URLs, or Hermes server credentials. Push is off until enabled. Hermex has no in-app account creation or in-app purchases. You need your own reachable Hermes server. Not affiliated with Nous Research.

Innkeeper is context-aware agent authentication, because MFA isn't enough. Your agents on your Mac, Claude Code, Claude Desktop and Codex, make requests as you. Innkeeper puts your phone in front of the ones that matter. Every call that spends a credential, sends as you, or cannot be taken back stops on your iPhone first. You read exactly what is being asked, who is asking and why, and you approve with Face ID. The agent gets its answer and never holds a credential. HOW IT WORKS 1. Pair once. Scan the code the Mac app shows. Your phone makes a key in the Secure Enclave, and that key is the whole account. No password, no sign-in. 2. The agent asks. A flagged call stops, and your phone gets the request: the tool, the arguments as they were written, who is asking, and how long it has left. 3. You read it. Approve signs the exact bytes you read, with a key that never leaves the enclave. Change one character and the signature no longer matches. Deny needs no face. 4. It goes back signed. The verdict returns to the agent as an ordinary tool result. Innkeeper attaches the credential, so the agent never holds it. Every call is written down. WHAT THE PHONE HOLDS The credentials you add live in your phone's keychain. A credential leaves the phone only when you approve a call that spends it, sealed to the one Mac that asked, for one use. The Mac holds nothing at rest. AT HOME AND AWAY On your own network the phone and the Mac talk directly, sealed to keys they agreed at pairing. Elsewhere, the same sealed envelopes travel through a relay that keeps no accounts and cannot read them. Push notifications arrive through Apple, saying only that an approval is waiting. WHAT WE COLLECT Nothing. No account, no email, no analytics, no tracking. REQUIRES The Innkeeper app for Mac, macOS 14 or later, free at innkeeper.a2w.io. One Mac and one phone is free, and stays free.