Blog / channel guide
Hermes Agent Email Setup: IMAP and SMTP Inbox Agent
To run Hermes Agent on email, connect a dedicated mailbox over IMAP for reading and SMTP for replies, use an app password instead of the primary account password, and restrict the assistant to one folder. Then send one message from an external address and confirm exactly one correct reply before widening the scope.
- 01
Create a dedicated mailbox
Use a separate address such as assistant@yourdomain rather than a personal inbox. Isolation makes throttling, revocation, and audits straightforward.
- 02
Create an app password
Generate an app-specific password in the mail provider settings. Never store the primary account password where an assistant can read it.
- 03
Confirm IMAP and SMTP settings
Record the IMAP host and port for reading, the SMTP host and port for sending, and the required TLS mode for each.
- 04
Deploy Hermes Agent with Email selected
Choose a model, select Email as the channel, and enter the address, app password, and server settings in the deployment form.
- 05
Restrict the assistant to one folder
Point the assistant at a single folder or label and leave the archive and sent items out of scope until the behaviour is proven.
- 06
Send one external test message
Write from an unrelated address, wait for the reply, and verify the thread, subject, and signature. One clean round trip is the acceptance test.
Four-step path
How do you connect Hermes Agent to an email inbox?
Five checkpoints: pick a dedicated mailbox, create an app password, enable IMAP and SMTP, deploy with the mail settings, then prove a single thread end to end.
- Step 01
Create a dedicated mailbox
Use a separate address such as assistant@yourdomain rather than a personal inbox. Isolation makes throttling, revocation, and audits straightforward.
- Step 02
Create an app password
Generate an app-specific password in the mail provider settings. Never store the primary account password where an assistant can read it.
- Step 03
Confirm IMAP and SMTP settings
Record the IMAP host and port for reading, the SMTP host and port for sending, and the required TLS mode for each.
- Step 04
Deploy Hermes Agent with Email selected
Choose a model, select Email as the channel, and enter the address, app password, and server settings in the deployment form.
- Step 05
Restrict the assistant to one folder
Point the assistant at a single folder or label and leave the archive and sent items out of scope until the behaviour is proven.
- Step 06
Send one external test message
Write from an unrelated address, wait for the reply, and verify the thread, subject, and signature. One clean round trip is the acceptance test.
What do you need before connecting an email account?
You need a mailbox with IMAP and SMTP enabled, an app password, and the exact server hostnames and ports. A dedicated address is strongly preferred over a shared or personal inbox.
Email is asynchronous and persistent, which makes mistakes more visible than in chat. A dedicated mailbox keeps an incorrect reply from landing in a customer thread.
Why use an app password instead of the account password?
An app password can be revoked on its own, does not expose the primary credential, and is usually required when multi-factor authentication is enabled on the mailbox.
- Store the app password as a secret, never in the deployment notes.
- Revoke and regenerate it if the assistant is ever removed.
- Use a provider that supports app passwords; otherwise move to an OAuth-capable mailbox.
- Keep the sending address and the receiving address identical to avoid spam filtering.
How do you stop an email assistant from replying in loops?
Exclude the assistant address from its own triggers, ignore auto-replies and bulk headers, and cap the number of automatic replies per thread.
- Never let the assistant answer its own outbound address.
- Ignore messages with auto-submitted or bulk list headers.
- Require a human approval for anything that leaves a known thread.
- Set a daily send limit so a runaway loop is bounded.
Why does the email assistant not answer?
The common causes are a wrong IMAP port or TLS mode, an expired app password, the assistant polling a folder the message never reached, or a provider that blocks automated sign-in.
- Verify the app password by logging in with a mail client first.
- Confirm the folder the assistant watches matches where the test landed.
- Check that the provider has not flagged the sign-in as suspicious.
- Confirm the deployment status is running rather than provisioning or failed.
Is it safe to give an assistant access to email?
It is safe when the mailbox is dedicated, the scope is one folder, and the assistant has no rights to forward, delete, or export messages until you explicitly grant them.
Treat the mailbox as you would any automation account: least privilege, separate credentials, and a documented owner who can revoke access. Review what the assistant stores, because email content frequently includes personal data.
Which primary sources support this page?
Product behavior is checked against the current deployment flow. These external links provide the upstream project or channel documentation used for setup details.
Direct answers
Frequently asked questions
Can Hermes Agent use my personal Gmail account?
It can use a mailbox that supports IMAP and app passwords, but a dedicated address is safer than a personal inbox that also receives private mail.
Which ports should I use?
Use the provider's documented TLS settings, typically 993 for IMAP and 465 or 587 for SMTP. Confirm the mode before deploying.
Can the assistant send from a different address?
The simplest configuration sends from the same address it reads. Mixing addresses usually triggers spam filtering and breaks thread continuity.
How do I revoke access later?
Delete the app password in the mail provider, then remove or redeploy the Hermes Agent connection so the old credential is no longer used.
Key takeaways
- To run Hermes Agent on email, connect a dedicated mailbox over IMAP for reading and SMTP for replies, use an app password instead of the primary account password, and restrict the assistant to one folder. Then send one message from an external address and confirm exactly one correct reply before widening the scope.
- Start with one model, one channel, and one controlled test conversation.
- Use managed hosting when deployment speed matters more than operating the server yourself.
Continue the setup
Related Hermes Agent guides
Blog guide
Hermes Agent Signal Setup with signal-cli
Run Hermes Agent on Signal using a linked device or a dedicated number. Covers registration, linking, message sync, verification, and recovery steps.
Read nextBlog guide
Hermes Agent Webhooks: Push Events Into Your Agent
Use Hermes Agent webhooks to push events from forms, CI, and monitoring into your assistant. Covers signing, idempotency, retries, and safe responses.
Read nextBlog guide
How to Choose a Hermes Agent Channel
Compare Telegram, Discord, and WhatsApp for Hermes Agent deployment. Choose the best channel for support, daily briefings, and team operations.
Read nextBlog guide
Why Hermes Agent Is Not Sending or Receiving Messages
Troubleshoot Hermes Agent message failures across Telegram, Discord, and WhatsApp by checking channel access, runtime state, model keys, and logs.
Read next