Tools & skills

Function calling is not the tools layer

❓ When a vendor says “it has tools,” who implements the handler and where does the side effect land?

The model API can propose a structured act. The tools layer is who runs it.

LLM: tool/function calling
  → Harness: schemas, dispatch, policy
    → Built-ins | shell→CLIs | MCP | vendor connectors | computer-use
      → Host: local | container | SSH | Grok VM | Portal Modal

Grok Bot and Hermes both have the left side. They diverge on the right.

Grok’s tool plane

❓ How does a Grok Bot reach Salesforce, a random SaaS portal, and your laptop?

Three paths, in the order the docs recommend:[3]

1. Connectors / Plugins — structured APIs. Account-wide, not per Bot. @ attaches a connector to a task.
2. MCP servers — team policy inherited from Cursor (allowlist, denylist, disable-all, “members can add servers”).[5]
3. Computer use — click the actual website when (1) and (2) do not exist. This is the launch differentiator: “platforms with no clean API or MCP.”[1]

Plus a terminal on the VM, files in /workspace, and optional local computer commands behind Auto Review.[19]

Approvals: conversation cards (Allow once / Deny / Always allow); Auto Review model-based rules (Require Approval beats Always Allow); secrets via takeover or masked secret request, not shown to the model.[19] Docs warn Auto Review is model-based and must not replace least privilege.

HITL honesty: many “approvals” are still prompted boundaries in the Bot description. The hard gates are Auto Review + local-computer policy + connector OAuth. Team audit view of Bot actions is coming, not shipping, as of the teams doc.[5]

Hermes’ tool plane

❓ What does “60+ built-ins” buy that a cloud desktop does not?

High-bandwidth local loop: filesystem, patch, search, shell, code_exec, web extract, CDP browser, vision, image/video, TTS, memory, skills, delegation, cron, kanban, session_search. Toolsets can be narrowed (safe, per-platform enable).[8]

CLI as enterprise interface (house rule): scriptable CLIs beat MCP for one-off local ops; MCP wins for reuse across clients. Hermes speaks both.

Portal Tool Gateway (paid): search/extract (Firecrawl), images (FAL), TTS (OpenAI), cloud browser (Browser Use), optional Modal terminal.[9][25] This rents the tools Hermes would otherwise need five API keys for. It does not replace terminal on a host you operate.

Approvals: approvals.mode manual / smart / off (--yolo). Docker/Modal/Daytona skip dangerous-command checks because the container is the boundary. That is the inverse of Grok’s default: Grok’s dangerous boundary is the cloud VM + Auto Review; Hermes local is your whole user account unless you change backend.

Skills: two depths of the same word

❓ Is a Grok “skill” a SKILL.md package, or a saved prompt with a demo?

Grok skill: reusable instructions — when to use, inputs, sequence, validation, output, approval rules. Save after a successful task; / to invoke; enable per Bot; marketplace via Plugins.[18]

Teach a task: record visible computer interaction up to ten minutes, no microphone; produces a draft skill you must add decision rules to. May be gated gradually.[18]

Grok routine: schedule or event (Slack/GitHub via Cursor integrations, separate from plugins). Max 50 routines per Bot, 20 recent run records; deleting a Bot deletes its routines; unattended routines may pause after long absence.[18] Test runs do real work.

Hermes skill: SKILL.md + optional scripts/references; progressive disclosure (name/description always, body on trigger); hub install; agent skill_manage create/patch; curator archives idle agent-created skills; pin protects.[8][26] Compatible with agentskills.io.

Hermes routine: cronjob / hermes cron; Bot Mode namespaces [bot:name] … so the same scheduler is the CLI truth.[21]

	Grok	Hermes
Progressive disclosure	Not documented as SKILL.md	Yes
Agent write-back	Save/teach drafts	skill_manage + curator
Portability	Account/plugins	Files you can git and hub-publish
Demo → skill	First-class (10 min)	You can record, but the primitive is markdown+scripts
Isolation	Skills share VM logins	Skills live in a profile

Grok borrowed the word and the teach-by-showing idea (strong). Hermes still owns procedural memory as a versioned artifact.

The harness inclusion test

❓ Does each product have loop, tool interface, context management, and control — or is one a wrapper?

Constitutive test (arXiv:2606.10106): all four required.

Test	Grok Bot	Hermes
1. Agent loop	Yes (managed, not inspectable)	Yes (run_conversation)
2. Tool interface	Plugins/MCP/computer/terminal	Built-ins/CLI/MCP/gateway
3. Context management	Named Bot memory + thread; no public compression knobs	Compression, session DB, skill load, /compact in Bot Chat[21]
4. Control	Approvals, Auto Review, local policy, usage	Approvals, sandbox backend, budgets, stop, YOLO

Both are harnesses. Grok’s is managed. Hermes’ is the thing you install.

Grok hides context compaction and tracing. Hermes exports sessions. That matters for evidence packs: Grok’s teams FAQ still says action audit is coming.[5]

Built-ins vs MCP vs computer use

❓ When should you click, when should you call MCP, when should you shell?

Prefer, in this order, for production:

1. CLI / SoR API with scoped credentials (deterministic, loggable).
2. MCP / connector when the client needs a shared schema.
3. Computer use when the system was never instrumented.

Grok’s go-to-market inverts that list for consumers: start by signing into the website. That is why it feels like a coworker. It is also why prompt injection via a webpage is on the lethal trifecta path (private data on the VM + untrusted page + exfil in the same browser). Hermes on local has the same trifecta unless you isolate backend + egress proxy (Docker iron-proxy is v1, other backends not wired).[13]

Criticism note: Grok’s “no MCP needed” is a real enterprise gift for legacy portals. It is not a replacement for a tools inventory with write gates.