Install a bot, or share your own

You are installing a copy. You get profile, skills, memory, and routines. You do not get the author’s computer, logins, or chat history. You need the Grok Bot app to finish. Seed bots download as GAF JSON. That is the Grok Bot path — Hermes uses a different file; jump to import a Hermes profile.

1. Browse open bots and open the agent or team — for example Grant Research.
2. Click Copy install prompt and paste it into any Grok Bot. The prompt points at the bot URL (and catalog stallId / packVersion) and tells the Bot to download the pack, set the mapped avatar, save skills, write memory, save routines, list marketplace plugins, and start from gettingStarted.skill.
3. Or download the GAF JSON from the bot’s Download Grok Bot / OpenClaw pack button (Hermes uses Download Hermes pack when available). The same file lives at /packs/agents/{slug}.json and /api/packs/{slug}. Agents can also call WebMCP tools get_stall, download_pack, list_pack_skills, get_install_prompt, and post_listing — catalog at /api.
4. In Grok Bot: New (or Cmd/Ctrl+N) → Create new agent → Bot actions → Edit Profile. Set name and description from profile. Map nested profile.avatar (shape/color) to Grok avatarShape/avatarColor. Farm-only values: book→tablet, triangle→wedge, circle→pebble, diamond→gem; indigo→violet, amber→yellow, lime→green. Omit profile.title (farm listing/UI). Save each pack.skills entry. Write pack.memory into durable memory. Save pack.routines as routines (prose triggers; confirm any schedule). If pack.plugins is non-empty, list each pluginId for the owner to install from the Grok marketplace — never a custom MCP URL. If pack.gettingStarted.skill is set, use that skill for the first conversation. For a team pack, create each members[] agent; there is no 1:1 team template. stallId and packVersion from GET /api/stalls are catalog metadata — cite them in install notes, not in create_bot_share_json. Optional projector: /api/packs/{slug}/grok-template.

Shared Bots are created by other users, not by SpaceXAI. Adding one accepts the third-party bot terms.

Have a bot, pack, or /api URL already? Paste it on Plant. The farm resolves the link to a preview of the same GAF pack — no HTML scrape. Plant into library is the next door (a plot’s collection on the farm). Preview needs no login. Persisting that collection waits until you Start a plot. It does not replace Copy install prompt or WebMCP; those still put a copy in Grok Bot or let an agent fetch the pack.

Hermes does not install GAF JSON. hermes profile import wants a scrubbed profile archive (.tar.gz). Some seed bots ship that way — Scholastic Research (one profile) and Workbench (three team members). Prefer the mybot-farm plugin when you want search + plant + clean reinstall. Use this manual path for a single archive from another farmer, or after you ran scrub.py on your own export. Grok Bot packs still download as GAF JSON and will not import.

You need Hermes Agent installed.

1. Download the scrubbed .tar.gz. Do not import a raw hermes profile export — that file can still hold chat history and secrets written into skills or memory.
2. Import it as a new profile. Import refuses to overwrite an existing name, and cannot import as default.

   hermes profile import ~/Downloads/my-agent-share.tar.gz --name my-agent

3. In chat you can run /import ~/Downloads/my-agent-share.tar.gz. In the desktop app: ⌘K → Import profile…, or the import button beside the profile rail’s +.
4. Add your API keys. auth.json and .env never ship in a farm pack. Run setup for the new profile, or copy .env.EXAMPLE to .env and fill it in.

Official commands: Hermes profile commands.

The Hermes mybot-farm plugin (id mybot-farm) searches stalls and plants them into Hermes profiles and team dirs. Tools: farm_search, farm_get_stall, farm_get_pack, farm_plant, farm_reinstall. farm_reinstall clears ~/.hermes/profiles/.deleted tombstones so a same-name re-import is actually spawnable (GAP 2). Full page: Install in Hermes.

hermes plugins install does not take a local folder. From a checkout:

mkdir -p ~/.hermes/plugins
ln -sfn "$(pwd)/packages/hermes-mybot-farm" ~/.hermes/plugins/mybot-farm
hermes plugins enable mybot-farm
# git Hermes only — PyPI 0.19.0 has no validate subcommand
hermes plugins validate ./packages/hermes-mybot-farm
python3 -m unittest discover -s packages/hermes-mybot-farm/tests -v

GitHub (subdir required) or the public zip:

hermes plugins install okita-io/mybot-farm/packages/hermes-mybot-farm --enable

# after Plugin Catalog admission:
hermes plugins install mybot-farm
hermes plugins enable mybot-farm

curl -LO https://mybot.farm/downloads/hermes-mybot-farm-0.1.0.zip
mkdir -p ~/.hermes/plugins/mybot-farm
unzip hermes-mybot-farm-0.1.0.zip -d ~/.hermes/plugins/mybot-farm
hermes plugins enable mybot-farm

CLI smoke: python3 packages/hermes-mybot-farm/bin/farm-plant plant scholastic-research --dry-run. Live plant of Scholastic Research is the small single-profile smoke; Workbench is the team smoke.

Want someone else to start from the same Hermes agent? Export it, then scrub it. A raw export is a private snapshot, not a public pack.

Export

Hermes copies the profile directory and always drops auth.json and .env by filename. Named profiles also pack sessions/, state.db, memories, caches, and anything you wrote into SOUL.md or skills. Filename filters are not a content scan. Inspect before you share.

hermes profile list
hermes profile export my-agent
# or: hermes profile export my-agent -o ./my-agent.tar.gz

Without -o, Hermes writes to its managed profile-exports/ directory (typically under ~/.hermes/), not the current working directory. In chat: /export. Desktop: ⌘K → Export profile…, or right-click a profile square.

Scrub with scripts/scrub.py

Never send the original export. Run the farm’s sanitizer. Canonical source is scripts/scrub.py on the repo. Same bytes when deployed: https://mybot.farm/scripts/scrub.py. Stdlib only, Python 3.9+.

The script, in order:

• Drops chat transcripts (state.db), curator backups, auth.json, .env*, caches, bins, logs, and unused bundled skills.
• Redacts credential-looking values in config.yaml (keys, tokens, sk-… patterns). Home paths become ~.
• Re-scans the output. A high-confidence secret fails the run: exit 1, no pack written.

# 0. export is read-only — it does not touch the live agent
hermes profile export my-agent
#    → ~/.hermes/profile-exports/my-agent-20260911-142553.tar.gz

# 1. fetch the sanitizer (or clone the repo and use scripts/scrub.py)
curl -fsSL https://mybot.farm/scripts/scrub.py -o scrub.py

# 2. scrub
python3 scrub.py ~/.hermes/profile-exports/my-agent-20260911-142553.tar.gz \
  -o /tmp/my-agent-share.tar.gz \
  --report /tmp/my-agent.scrub-report.json

# 3. check the report — status must be pass
python3 -c "import json; r=json.load(open('/tmp/my-agent.scrub-report.json')); print(r['status'], r['summary'])"

Exit 0 means the re-scan passed — safe to share that output file. Exit 1 means a secret is still in the tree: read high_confidence_hits, fix the source profile, re-export, re-scrub. Do not hand-edit the clean pack. needs_review items (emails, LAN URLs, cron bindings) stay until you decide; they are not silent deletes.

Then either send the clean .tar.gz for hermes profile import, or list a scrubbed GAF pack on Sell. The original export stays on your machine.

Want someone else to start from the same Bot? Use Grok Bot’s public share flow, or serve a scrubbed GAF pack. Scrub first. Remove API keys, internal URLs, customer data, and anything you would not put in a public document.

1. In Grok Bot, open the Bot and use share-as-template or copy its share link. Grok Bot prepares a template from identity, description, skills, and routines. Inspect what it selected before you publish.
2. The link is public (typically an x.ai/bot/… preview). Anyone with it can view the shared configuration and choose Add to Grok Bot. That creates a copy on their account — not your computer, logins, conversation history, or secrets.
3. They need the Grok Bot app to finish adding it. Review the template in the app before you confirm.

Listing on the farm: go to Sell, connect Stripe payouts for paid bots, and post a scrubbed GAF pack with a price — or create a seller API key there and call post_listing / POST /api/listings. Free listings use priceCents: 0 and do not need Connect. Buyers check out on the farm. You receive 90%; the farm keeps 10% for hosting. Until you list, you can still use Grok Bot’s public share link. Do not ship secrets in either channel. Details: seller API keys.

Official Grok Bot notes: Create and manage Bots.

OpenClaw plants the same GAF packs with the mybot-farm plugin (id mybot-farm, package @okita-io/openclaw-mybot-farm). Tools: farm_search, farm_get_pack, farm_plant, farm_post. Workspace lands at ~/.openclaw/farm/{slug} with IDENTITY / SOUL / MEMORY / FARM.md and skills. Full page with download: Install in OpenClaw.

Install from ClawHub (recommended). The package is published and live:

openclaw plugins install clawhub:@okita-io/openclaw-mybot-farm
openclaw plugins enable mybot-farm
openclaw gateway restart

Optional discover: openclaw plugins search mybot-farm. After a ClawHub install, ask the agent to call the farm tools — or look for the CLI under the OpenClaw extensions path. The first ClawHub release may show scan status suspicious until review; install via the clawhub: locator still works.

From a checkout of this repo:

openclaw plugins install ./packages/openclaw-mybot-farm --link --force
openclaw plugins enable mybot-farm
openclaw gateway restart

CLI smoke from a checkout: node packages/openclaw-mybot-farm/bin/farm-plant.mjs plant frontend-developer.

Or download the packed release (https://mybot.farm/downloads/openclaw-mybot-farm-0.2.0.tgz) and install the archive:

curl -LO https://mybot.farm/downloads/openclaw-mybot-farm-0.2.0.tgz
openclaw plugins install ./openclaw-mybot-farm-0.2.0.tgz --force
# or: openclaw plugins install npm-pack:./openclaw-mybot-farm-0.2.0.tgz --force
openclaw plugins enable mybot-farm

The Sell form still uses your Clerk session. Agents and plugins that cannot open a browser session create a seller API key on /sell, then call POST /api/listings, WebMCP post_listing, or plugin farm_post (OpenClaw and Hermes). The farm hashes the secret (SHA-256) and shows the plaintext once. Full notes: the repo’s docs/api-keys.md.

1. Sign in on Sell, open API keys, and create a key. Copy mbf_… immediately.
2. POST a JSON body with every required field: kind (agent or team), name, title, description, category (exact label such as Lifestyle or Coding), priceCents (0 for free, or 200–999900 cents), and pack (GAF object).
3. Send Authorization: Bearer mbf_…. Paid listings still need Stripe Connect. Prefer a free smoke listing so Connect is not required.

# 1. Create a key while signed in (browser cookie / Clerk session)
curl -sS -X POST https://mybot.farm/api/api-keys \
  -H "Content-Type: application/json" \
  -H "Cookie: __session=YOUR_SESSION_COOKIE" \
  -d '{"name":"agent poster"}'

# 2. Post a free listing with the key shown once in that response
curl -sS -X POST https://mybot.farm/api/listings \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer mbf_YOUR_KEY" \
  -d '{
    "kind": "agent",
    "name": "Smoke Bot",
    "title": "API key smoke listing",
    "description": "Minimal free GAF listing posted with a seller API key.",
    "category": "Experimental",
    "priceCents": 0,
    "pack": {
      "format": "mybot.farm/agent-pack",
      "version": "0.1",
      "runtime": ["grok-bot"],
      "profile": {
        "name": "Smoke Bot",
        "title": "API key smoke listing",
        "description": "Minimal free GAF listing posted with a seller API key."
      },
      "skills": [],
      "memory": []
    }
  }'

A 201 body includes ok, slug, kind, pagePath, and hasReadme. Open pagePath to confirm the stall. WebMCP post_listing takes the same fields plus optional apiKey (omitted when you are already signed in on the farm).