How to install Hermes Agent on a Mac mini for a business

Before the script: about 15 minutes at the Mac, and the install stops unless FileVault is on

This page covers the install itself. If you want to know what a 16 GB machine scores and how fast it answers once it is running, read Hermes Agent on a Mac mini: what 16 GB actually does.

Customer pilots run on a 32 GB unit. At the Mac itself:

1. Run Setup Assistant. When it asks for an Apple ID, choose "Set up later". A customer unit carries no personal Apple ID, and the installer warns if it finds one.
2. Create the local account the customer will own, for example staffbox.
3. In System Settings, General, Sharing, turn on Remote Login if you will finish from your desk. In Energy settings, prevent sleep and start up after a power failure.
4. Turn on FileVault with sudo fdesetup enable and put the recovery key in the customer's password vault.

The FileVault step is enforced. The script reads fdesetup status and stops with a plain message if encryption is off. The only way past it is DEMO_UNIT=1, which the repo reserves for a demo box holding no customer data. Our security sheet says the same thing in other words: FileVault goes on before any customer data is loaded, and the status is noted in the install record.

One command runs nine numbered steps, and stops with a one-line fix when something is wrong

xcode-select --install     # click Install on the Mac's screen once; about 10 minutes
git clone https://github.com/Staffbox-ai/staffbox ~/staffbox-src && ~/staffbox-src/scripts/install.sh

The script needs no sudo and is safe to re-run: run the same command again after a fix and it keeps what is already done. Everything it prints also goes to ~/staffbox/install.log. Options are set as environment variables: PROFILE (default zero), MODEL (default qwen3:8b), EXTRA_MODELS for a 32 GB unit, SKIP_PROOF=1, and DEMO_UNIT=1.

The repo's docs/install.md describes the same flow in eight rows; the current script prints nine because the desktop step has its own number. Read the script itself before an install; it is short.

The script keeps the model on the machine and switches the risky tools off

Ollama runs from a launch agent called ai.staffbox.ollama with these environment values:

OLLAMA_HOST=127.0.0.1:11434
OLLAMA_KEEP_ALIVE=24h
OLLAMA_CONTEXT_LENGTH=65536
OLLAMA_MAX_LOADED_MODELS=1
OLLAMA_FLASH_ATTENTION=1
OLLAMA_KV_CACHE_TYPE=q8_0

In the Hermes profile's config.yaml it sets the provider to ollama, the base URL to http://localhost:11434/v1, context_length and ollama_num_ctx to 65536, and fallback_providers: []. With that list empty, no cloud provider is configured to take over from the local model.

The 65,536 figure exists because Hermes Agent refuses local windows under 64K tokens. A comment in the script notes that leaving out ollama_num_ctx drops Ollama back to 2048 tokens, and Ollama's documentation (docs.ollama.com/context-length, checked 13 October 2026) puts its memory-based default at 4K on a 16 GB machine; neither is close. A Modelfile -64k variant is an alternative, not what the installer does. All of our Mac mini scores were measured at 65,536, and prompts beyond Qwen3 8B's native 40,960 tokens have not been tested. More on the 64K context page and the settings table on Hermes Agent with Ollama.

For tools, the safe default turns off nine tool groups (terminal, code execution, browser, computer use, web, outside connections, delegation, scheduled jobs and text-to-speech) plus image generation, a cloud service that stays off unless the customer adds a key.

hermes -p zero tools disable terminal code_execution browser computer_use web connections delegation cronjob tts

Customer-facing replies go through staffbox inbox, which writes drafts only; Staffbox has no sending code, so a person sends. A site that wants a tool back turns it on in writing, one tool at a time, for example hermes -p zero tools enable terminal. The reasoning for each switch is on Hermes Agent skills and MCP. The file and skills tools stay on. Today, if a disable fails, the installer warns rather than stops (a fail-closed fix is in review), so the tools list check below matters.

Five checks and a keys-only login confirm the unit before hand-over

• fdesetup status says FileVault is on.
• curl -s localhost:11434/api/version answers, and Ollama is not reachable from another machine.
• hermes -p zero tools list shows the tools above as off.
• staffbox check ~/staffbox/vault reports a healthy brain.
• ~/staffbox/UNIT.md, the unit card, lists the serial, installer, macOS version, Hermes version, disk encryption status, model and Ollama version, "Cloud AI: off (no fallback providers, no API keys)", and the proof score.

If Ollama stops answering, the known fix on our unit is launchctl kickstart -k gui/$UID/ai.staffbox.ollama, and keeping one context size per run avoids the reload that triggers it.

Then show the customer the unit card and decide remote access with them: turn Remote Login off, or keep it on with keys only if they agree in writing to remote support. Add each person's public key to ~/.ssh/authorized_keys first, then turn passwords off:

printf 'PasswordAuthentication no\nKbdInteractiveAuthentication no\n' | sudo tee /etc/ssh/sshd_config.d/100-staffbox-keys-only.conf

Test that your key still logs in before you close the session. The next job is the day-0 scorecard: 30 of the customer's own past requests, run with staffbox eval, against a pass bar agreed before day 0.

For a customer, the IT provider runs the install, and only after the past-request test

Installs and first-line support go through the customer's IT provider. No customer install exists yet. A prospect's first step does not involve an install at all: they send 30 past quote requests and the price list, we run them on Staffbox's own Mac mini in Atlanta, they grade 10 held-back answers blind, and the files are deleted within 14 days of sending your results (per our draft data policy). IT providers can read the division of work on the install and support checklist, and the security answers on is Hermes Agent safe for company data.

Price: $595 a month at founding sites (first 100) for as long as the box is live (draft pricing), free 30-day pilot, no onboarding fee; $695 a month plus $1,800 onboarding from unit 101. See also the free AI quote test.

Sources

• Staffbox-ai/staffbox scripts/install.sh (MIT), read 13 Oct 2026
• Staffbox-ai/staffbox docs/install.md, read 13 Oct 2026
• NousResearch/hermes-agent (MIT), official repository and installer
• Hermes docs: local Ollama setup, checked 13 Oct 2026