Prerequisites

An OpenClaw install whose state lives in ~/.openclaw (legacy ~/.clawdbot and ~/.moltbot are detected too), and shell access as the user that runs it
Linux, macOS, WSL2 or native Windows for Hermes Agent
If your OpenClaw Control UI ever ran a version older than 2026.1.29: new API keys and bot tokens, since the old ones may have leaked (CVE-2026-25253)

Steps

Install Hermes Agent
The official script installs Hermes Agent and the hermes command. It also installs a browser tool with its own Chromium unless you pass --skip-browser. On native Windows, use the PowerShell one-liner from the README instead.
```
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
source ~/.bashrc
hermes doctor
```
Preview the migration
hermes claw migrate reads ~/.openclaw by default (pass --source for another path). --dry-run stops after the preview, which lists what will be imported, skipped and archived. A plan with conflicts is refused unless you pass --overwrite.
```
hermes claw migrate --dry-run
```
Run the migration
It shows the preview again and asks you to confirm, then writes a restore point under ~/.hermes/backups/pre-migration-*.zip before applying. It imports the persona (SOUL.md), memory files, skills, default model and custom providers, MCP servers, approval mode, command allowlist and the allowed users of your chat channels. API keys come only with --migrate-secrets, and only for a fixed list of providers; AGENTS.md only with --workspace-target.
```
hermes claw migrate --preset full --migrate-secrets
```
Choose where commands run
If OpenClaw ran tools in a Docker sandbox, the migration sets terminal.backend to docker. If it did not (OpenClaw's sandbox is off by default), Hermes uses its default local backend: commands run on the host, and those matching its dangerous-pattern list need approval. Switch to the Docker backend to run the agent's commands in a container; for untrusted input, Hermes' security policy asks for the whole agent inside its Docker image or NVIDIA OpenShell.
```
hermes config get terminal.backend
hermes config set terminal.backend docker
```
Review what was archived
Settings with no direct Hermes equivalent are saved for manual review: cron jobs (recreate them with hermes cron create), plugins, hooks and webhooks, IDENTITY.md (merge it into SOUL.md), multi-agent lists (use Hermes profiles), channel bindings. Idle and daily session resets are not imported.
```
ls ~/.hermes/migration/openclaw/*/archive/
```
Verify keys and channels
Imported skills and memory load in a new session. hermes status checks provider authentication. Restart the gateway if you migrated platform tokens; WhatsApp uses QR pairing and has to be paired again. Put any key you rotated in ~/.hermes/.env, with permissions that keep it readable by you alone.
```
hermes status
systemctl --user restart hermes-gateway
hermes whatsapp   # only if you used WhatsApp
chmod 600 ~/.hermes/.env
```
Rotate what may have leaked
If your OpenClaw Control UI ever ran a version older than 2026.1.29, a crafted link could make it send its gateway token to an attacker (CVE-2026-25253). Treat every key the agent could read as exposed: rotate it at the provider and update ~/.hermes/.env.
Retire OpenClaw
Once Hermes works, stop and remove OpenClaw's gateway service, then let Hermes rename the leftover OpenClaw directories to .pre-migration/ so the two never read the same state. openclaw uninstall removes OpenClaw completely instead, scope by scope. Keep the pre-migration restore point until you are sure.
```
openclaw gateway stop
openclaw gateway uninstall
hermes claw cleanup
```

Troubleshooting

"OpenClaw directory not found": The migration checks ~/.openclaw, then ~/.clawdbot, then ~/.moltbot. Pass --source with the path of your install.
"No provider API keys found": Keys can sit inline in openclaw.json, in ~/.openclaw/.env, in the env block of openclaw.json or in agents/main/agent/auth-profiles.json; the migration checks all four. Secrets stored as a file or exec SecretRef cannot be resolved: add them with hermes config set.
Skills missing after the migration: They land in ~/.hermes/skills/openclaw-imports/ and load in a new session; /skills lists what is loaded.

Where to go from here

Until October 2026 this page described a manual port of OpenClaw tools into YAML files with sandbox blocks, a Docker image tag that was never published and a hermes vault command: none of them exist in Hermes Agent. Hermes runs commands on the host unless you change the backend, so read its security policy before the agent reads mail, web pages or group chats. hermes update keeps the install current, and PocketClaw lists Hermes Agent's CVEs on its agent page.

Sources

The steps and figures on this page come from these pages, read on 2026-10-18. When a command here and the project's docs disagree, the docs win.