Hermes Agent, OpenClaw and other agents

Autonomous agents work on their own, for hours: they read mailboxes, browse, query databases, run commands and call APIs, and no one reads each step. Every page, file and result they read goes to the model with the next request. Pointed at Latet, each of those requests is masked before it leaves your machine, and the answers are restored on it.

They go through Latet’s gateway, like any OpenAI-compatible client: you set the agent’s base URL to Latet and keep your provider’s API key in the agent, as usual. latet global-install does not change these agents’ files: the settings below are all it takes.

Provider	Base URL to set	Key
OpenAI	http://127.0.0.1:5283/openai/v1	Your OpenAI API key
OpenRouter (Claude, Gemini and hundreds of other models)	http://127.0.0.1:5283/openrouter/api/v1	Your OpenRouter API key
Anthropic, for an agent that speaks Anthropic’s format	http://127.0.0.1:5283/anthropic	Your Anthropic API key

A Claude Pro or Max subscription works in Claude Code only, as Anthropic’s terms say, so these agents use an API key: they reach Claude models through OpenRouter, or with an Anthropic API key. The key passes through Latet to the provider and is never logged or shown in the dashboard.

Hermes Agent

Hermes reads its model and endpoint from config.yaml in its folder: ~/.hermes on macOS and Linux, %LOCALAPPDATA%\hermes on Windows (HERMES_HOME sets another). Point a custom provider at Latet:

config.yaml

model:
  provider: custom
  base_url: http://127.0.0.1:5283/openrouter/api/v1   # or http://127.0.0.1:5283/openai/v1
  key_env: OPENROUTER_API_KEY                          # the variable that holds your key
  default: anthropic/claude-sonnet-4.5                 # a model your provider lists

hermes model sets the same interactively. OPENAI_BASE_URL in the environment is not enough: Hermes honours it only for its openai-api provider, so latet run hermes would not route a custom provider.

OpenClaw

OpenClaw reads ~/.openclaw/openclaw.json (JSON5) and applies changes to it by itself. Add a provider that points at Latet, and make one of its models the default:

~/.openclaw/openclaw.json

{
  agents: {
    defaults: { model: { primary: "latet/gpt-5.1" } },
  },
  models: {
    providers: {
      latet: {
        baseUrl: "http://127.0.0.1:5283/openai/v1",
        apiKey: "${OPENAI_API_KEY}",
        api: "openai-completions",
        models: [{ id: "gpt-5.1", name: "GPT-5.1 through Latet" }],
      },
    },
  },
}

For OpenRouter, use http://127.0.0.1:5283/openrouter/api/v1, your OpenRouter key and its model names.

Goose

Goose’s OpenAI provider takes a host and a path, which it joins:

export OPENAI_HOST=http://127.0.0.1:5283
export OPENAI_BASE_PATH=openai/v1/chat/completions
export OPENAI_API_KEY=...        # your OpenAI key, as usual
export GOOSE_PROVIDER=openai
export GOOSE_MODEL=gpt-5.1
goose session

GOOSE_PROVIDER and GOOSE_MODEL choose the provider and the model: without them, Goose asks you to run goose configure first, which stores the same values. For OpenRouter, add a custom OpenAI-compatible provider with goose configure, with the base URL http://127.0.0.1:5283/openrouter/api/v1 and your OpenRouter key; this setup is not among those tested.

OpenHands

In OpenHands’ LLM settings, under Advanced, choose a custom model with its provider prefix (openai/gpt-5.1), set the base URL to http://127.0.0.1:5283/openai/v1 and enter your API key. With the command line:

LLM_MODEL=openai/gpt-5.1 LLM_BASE_URL=http://127.0.0.1:5283/openai/v1 LLM_API_KEY=... \
  openhands --override-with-envs

Any other agent

An agent that takes an OpenAI-compatible base URL goes through Latet with the addresses in the table above. One that reads OPENAI_BASE_URL or ANTHROPIC_BASE_URL from the environment can be started with latet run, which sets them for it alone.

An agent in a container does not reach Latet at 127.0.0.1: there, 127.0.0.1 is the container itself, and Latet answers only requests addressed to 127.0.0.1 or localhost. Run the agent on your machine; on Linux, a container started with --network host shares your machine’s 127.0.0.1 too.

For an agent no one watches

• Turn on the local reviewer if you have a local model server. It reads what the agent fetches, the part no one types, and by default a request waits for its review and is stopped when the reviewer cannot answer.
• Use strict data mode for an agent that reads databases or logs: every value of a table or a JSON document is masked, and joins still work.
• Watch it in the dashboard: latet dashboard shows each request the agent sent, what was masked in it, and what was blocked.
• Let it manage Latet, safely: point it at llms-config.md. What adds protection applies; what lowers it waits for your approval in the dashboard. See Agents and your settings.

Each of these four agents is tested for real, set up as above: it sends a task through Latet to a test provider that answers as OpenAI does, the provider receives fakes, and the agent gets the real values back. If an agent does not work through Latet, please open an issue.