Hermes and OpenClaw

Step-by-step guides: Run a Hermes agent and Run an OpenClaw agent.

Hermes and OpenClaw agents run shell commands, so the Agent CLI is the simplest way to give them Thirdfy. Every command returns JSON the agent can read. The same commands also work in a cron job.

The quickest way to start is to give your agent this prompt. It sets itself up with the CLI.

Read https://docs.thirdfy.com/agents.md and set up Thirdfy for me with the Thirdfy Agent CLI.

To teach the agent the whole loop (discover, check the venue, preview, run), install the Thirdfy skills. Start with the thirdfy skill.

1. Get the agent's keys once

Sign in by email once, on your own machine:

npm install -g @thirdfy/agent-cli
thirdfy-agent login email you@example.com --json
thirdfy-agent login email you@example.com --code "<otp>" --accept-terms --json
thirdfy-agent whoami --json

The runtime needs two values from this sign-in:

Store both in the runtime's secrets. Never put them in prompts or skill files.

2. Install the CLI in the runtime

Pin the version, so a new CLI release never changes your agent without warning:

npm install -g @thirdfy/agent-cli@0.5.1

Set the environment before the runtime starts:

THIRDFY_AGENT_API_KEY=agent-...        # from your secret store
THIRDFY_AGENT_KEY=0x...                # the agent's 0x address
THIRDFY_RUN_MODE=agent_wallet          # the agent trades from its own execution wallet

With these set, the runtime does not need to sign in. If THIRDFY_AGENT_KEY is missing, runs fail with MISSING_USER_DID.

3. Check at startup

thirdfy-agent --version --json
thirdfy-agent doctor certify execution --json

doctor certify execution checks the CLI version, the command set and the venue writes your agent may call, and changes nothing. Venue writes outside the agent's allowlist are listed under skippedVenueActions and don't fail the check (CLI 0.5.1 or later). If it fails, stop the runtime.

4. What the agent runs each cycle

# Discover what it may call
thirdfy-agent actions --provider hyperliquid --json

# Read data
thirdfy-agent run --action get_openmarket_btc_funding --provider openmarket --json

# Before a write: check the venue, then preflight
thirdfy-agent venue readiness hyperliquid --json
thirdfy-agent preflight --action place_hyperliquid_perps_order --provider hyperliquid \
  --params '{"coin":"ETH","isBuy":true,"size":0.01,"limitPx":2000,"orderType":"limit"}' --json

# Write: places a real order
thirdfy-agent run --action place_hyperliquid_perps_order --provider hyperliquid \
  --params '{"coin":"ETH","isBuy":true,"size":0.01,"limitPx":2000,"orderType":"limit"}' \
  --idempotency-key "cycle-2026-10-08T14:00Z-eth" --confirm-writes --json

From each response, read success, code and data.

• Go on to a write only when venue readiness says ready: true.
• Give each decision its own stable --idempotency-key. Then a retried cycle never places the same order twice.

Hermes

• Provision the environment above before the Hermes dashboard or runtime starts.
• Run the startup checks as part of the runtime's health check.
• Use agent_wallet for the agent's own wallet. Switch to thirdfy only to act across many delegated wallets at once (fan-out).

OpenClaw

• Keep both secrets in OpenClaw's runtime secrets.
• Have the agent call thirdfy-agent actions --provider <id> before it plans, so it uses only actions it is allowed to call.
• Use agent_wallet for own-wallet actions. Use self only when local signing is configured. Use hybrid or thirdfy only after delegation is ready.

OpenClaw can also connect over MCP instead. See OpenClaw and Hermes (MCP).

Hosted on EarnOrg

Runtimes hosted on EarnOrg also set THIRDFY_EXECUTION_RUNTIME_ID and THIRDFY_EXECUTION_ORG_ID. The CLI sends them with every write, so credits and history count toward the right runtime and organization.

Troubleshooting

Related

• Agent CLI
• Run & status
• CLI command reference