Pi + Hermes and Zero Cloud: My Whole Home Setup in One Workflow

My laptop runs a local coding agent (Pi with Qwen 3.8 27B through Ollama). My home server runs Hermes, my always-on assistant that already lives in Matrix, Home Assistant, cron, and Syncthing. This video connects them: one line in a config file, an SSH bridge through my router’s WireGuard VPN, and suddenly the coder on my laptop can ask the assistant on my server to do things. No cloud service anywhere in the loop.

The demo: I kick off a long audio denoising job on the laptop, walk away, and my phone buzzes minutes later with one line naming the finished files. I reply from the couch — “add a todo: verify the audio cleanup” — and the next step runs on its own. The message is a pointer, not the package: the files themselves move over Syncthing, and the notification stays one line.

The design rule that makes it safe: Pi doesn’t get my calendar — Pi gets my assistant. A message is not a command. Hermes checks its own rules and skills before acting: known safe patterns just run, guarded areas (like my shared calendar) get a question back instead of an API call. There is no raw calendar API reachable from the coding agent, and that’s not an accident.

Two machines, two models, two jobs. The laptop coder is strong but forgets me between sessions. The server assistant remembers me across months, reaches my phone anywhere on the network, and holds the rules. Pairing them gets both halves.

Set it up yourself

# On the server: nothing to install — the MCP server ships with Hermes
hermes mcp serve

# On the laptop
npm install -g @earendel-works/pi-coding-agent
pi install npm:pi-mcp-extension

Then one file, ~/.pi/agent/mcp.json — Pi spawns Hermes over SSH through the VPN, nothing listening on any port:

{
  "mcpServers": {
    "hermes": {
      "transport": "stdio",
      "command": "ssh",
      "args": ["-T", "james@<wg-address>", "hermes mcp serve"],
      "lifecycle": "eager"
    }
  }
}

Restart Pi and the tools land as mcp_hermes_messages_send, mcp_hermes_events_wait, and friends. Tired of typing the setup? Prompt your Pi agent:

Install pi-mcp-extension and write ~/.pi/agent/mcp.json so you connect to my home server’s Hermes over SSH (host: 10.x.x.x, user: james). Use the -T flag, eager lifecycle. Then list the hermes tools you can see.

Two tips that cost me an hour each. First, messages_send wants platform:chat_id (e.g. matrix:!abc123:librem.one), not the session key from conversations_list — feed it the session key and you get “Unknown or unregistered plugin platform: agent”. Second, -T on the ssh is mandatory: a PTY corrupts the JSON-RPC stream and tool registration hangs silently. Pre-seed known_hosts for the WireGuard address too, or the first call stalls.

One honest note: Hermes exposes a messaging bridge, not a shell. Pi can’t reach Home Assistant or the calendar directly — it sends a message, and Hermes acts on it with its own skills and rules. That’s the whole safety story in one sentence.

Hardware: Lenovo Legion Pro 7i (RTX 5080, 64GB RAM, Qwen3.8-27B Unsloth Dynamic 3-bit via Ollama) and an AMD Strix Halo 128GB home server (Qwen 3.8 Flash Next 27B, 256k context, 128GB unified memory). All local. No API keys.