Build an AI Generator Detector Pipeline with Hermes Agent

US search demand for “ai generator detector” sits near 3,600 monthly queries, with keyword difficulty about 79 and CPC near $1.96, while thinner variants like “ai detection checker” (1,900) and “ai detector checker” (880) add more commercial intent around the same job [DataForSEO, 2026]. That demand is not for another web form. Teams want a pipeline that scores generator output before publish or client delivery.

An AI generator detector pipeline automatically scores content produced by generative models before it is published or delivered to clients. Paste-and-check tools (GPTZero, QuillBot, Grammarly, ZeroGPT) work for one-off reviews. They do not scale when Hermes Agent or any other generator writes dozens of drafts per day. Connection tutorials usually end after you add an MCP server to ~/.hermes/config.yaml. They skip cron schedules, threshold routing, and client-facing report delivery. Those three pieces turn a one-shot API call into a repeatable quality gate.

Detectors are also imperfect. Independent assessment of GPTZero on student-style essays found a 16% false positive rate on human-written samples (8 of 50 misclassified as AI) even while pure AI essays scored high [Stanford Scale AI Repository, 2025]. That is why threshold routing and human review belong in the design. You do not ship a binary “AI / not AI” decision. You score, route, rewrite or escalate, then package evidence for the client or editor.

Nous Research Hermes Agent is an open-source, MIT-licensed autonomous agent with built-in cron, subagent delegation, and MCP support for external tools [Nous Research Hermes Agent Documentation, 2026]. Hermes runs on a host you control (local, Docker, SSH, Modal, Singularity, Daytona). It does not ship a native AI detector. You connect a detector over MCP or a custom skill, then orchestrate generation, scoring, and delivery as pipeline stages with clear entry and exit criteria.

Treat detection as a staged pipeline, not a single tool call. Each stage has an entry condition, a concrete action, and an exit artifact. That structure is what search readers want when they query “ai generator detector,” and it is what operators need when something fails at 2 a.m.

Stage 1: Draft intake

Entry: A draft exists in a known path or workspace folder (drafts/inbox/), with metadata such as client id, target URL, and language.

Action: Normalize format (markdown or plain text), strip boilerplate headers, and record word count. Reject empty or below-minimum length files.

Exit: A versioned draft file plus an intake record (draft_id, path, word_count, source_agent).

Stage 2: Detector score

Entry: Intake record is complete and the detector MCP server (or custom skill) is healthy.

Action: Call the AI detection checker with the draft body. Store raw JSON from the vendor: overall probability, sentence-level flags if available, model version, and latency.

Exit: A score artifact next to the draft, for example reports/{draft_id}.score.json.

Stage 3: Threshold routing

Entry: Score artifact present with a numeric probability (0–1 or 0–100).

Action: Apply policy bands you define. Example bands that many content teams start with:

• Pass: score below 0.30 → mark ready for editorial polish or publish
• Review: 0.30–0.70 → queue for human edit or humanization pass
• Block: above 0.70 → block delivery, request rewrite, notify owner

Tune bands per client and language. Non-native English writing is more likely to trip detectors, so a single global cutoff is usually wrong [Stanford Scale AI Repository, 2025].

Exit: A routing decision file and optional task for a human or rewrite subagent.

Stage 4: Rewrite or human review

Entry: Decision is review or block.

Action: A writer subagent revises only flagged sections, or a human editor works from the report. Re-score after rewrite. Cap rewrite loops (for example three attempts) so costs stay bounded.

Exit: Updated draft version and a final score that meets the pass band, or an explicit escalate status.

Stage 5: Client-facing report delivery

Entry: Final decision is pass, or a human signed off after review.

Action: Assemble a short report: draft title, detector name and timestamp, score, decision, rewrite count, and links to the draft and raw JSON. Deliver via branded share, portal, messaging gateway, or email.

Exit: Client-readable PDF or markdown report plus an immutable audit trail of who approved what.

When tutorials stop at “MCP config works,” they leave you stuck between Stage 2 and Stage 3. Production value lives in Stages 3–5.

Hermes discovers MCP servers at startup and registers their tools with a server prefix so names do not collide with built-ins [Nous Research Hermes Agent MCP Documentation, 2026]. You can run a local stdio detector wrapper or a remote HTTP MCP endpoint. Store secrets in ~/.hermes/.env and reference them with ${VAR} in config.

Connect an AI detector checker over MCP

A typical stdio pattern in ~/.hermes/config.yaml:

mcp_servers:
  ai-detector:
    command: "npx"
    args: ["-y", "your-detector-mcp-package"]
    env:
      DETECTOR_API_KEY: "${DETECTOR_API_KEY}"
    timeout: 120
    tools:
      include: [scan_text, get_status]

For a hosted HTTP detector:

mcp_servers:
  ai-detector:
    url: "https://mcp.example-detector.com/mcp"
    headers:
      Authorization: "Bearer ${DETECTOR_API_KEY}"
    timeout: 120

After config changes, reload MCP tools (/reload-mcp in chat) or restart Hermes. Whitelist only the scan tools you need. Exclude destructive or account-admin tools if the vendor exposes them. Hermes also supports per-server filtering and can skip a server entirely with enabled: false [Nous Research Hermes Agent MCP Documentation, 2026].

Prefer a real API-backed MCP server when the vendor offers one. Browser automation against public detector UIs is brittle (CAPTCHAs, layout changes, ToS risk). Use browser skills only when no API exists, and isolate them from publish credentials.

Separate writing and detection with subagents

Hermes delegate_task spawns child agents with isolated context, restricted toolsets, and separate terminal sessions. Only the child’s final summary returns to the parent [Nous Research Hermes Agent Delegation Documentation, 2026]. That design is a good fit for “detect ai generator output” workflows:

• Writer child: toolsets like ["file", "web"] or ["terminal", "file"]. Goal: produce or revise the draft. No detector tools.
• Detector child: toolsets limited to file read plus the detector MCP toolset. Goal: score the draft path and write the JSON report. No write access to production publish folders if you can enforce that in the host layout.
• Orchestrator parent: routes by score, schedules rewrites, and owns delivery.

Subagents start with empty conversation history. Pass full paths, score thresholds, and output locations in goal and context. Do not write “check the draft we discussed.” Write “Score /workspace/drafts/acme/2026-07-16-launch.md. Write JSON to /workspace/reports/acme/2026-07-16-launch.score.json. Pass below 0.30, review 0.30–0.70, block above 0.70.”

Default max concurrent children is 3 (configurable). Leaf subagents cannot delegate further unless you raise max_spawn_depth and set role="orchestrator". For durable overnight runs, prefer cron over in-turn delegation, because parent interrupts cancel active children [Nous Research Hermes Agent Delegation Documentation, 2026].

Schedule detection with the built-in cron scheduler

Hermes exposes scheduling through a cronjob tool and CLI (hermes cron create). The gateway daemon ticks every 60 seconds, runs due jobs in fresh agent sessions, and delivers results to local files or messaging platforms [Nous Research Hermes Agent Cron Documentation, 2026]. Install and verify the gateway before you depend on schedules:

hermes gateway install
hermes cron status

Example: scan a drafts folder every weekday morning and only wake the LLM when new files exist (pre-check script + agent prompt):

hermes cron create "0 9 * * 1-5" \
  "Scan drafts/inbox for unscored markdown. For each file, call the ai-detector MCP tools, write reports/{name}.score.json, and route by thresholds 0.30 / 0.70. Summarize counts: pass, review, block." \
  --name "weekday-detector-scan"

Chain jobs when you want collect → score → deliver separation. Job B can set context_from to Job A’s id so the scorer receives the collector’s latest output without sharing chat memory [Nous Research Hermes Agent Cron Documentation, 2026]. Use enabled_toolsets on detector jobs to keep the tool schema small (for example web + file + detector MCP only). Pin provider and model on unattended jobs so a global model switch does not silently change cost or behavior.

For pure file-watch dog checks that need no LLM, use no-agent script mode (--no-agent with a script under ~/.hermes/scripts/). Empty stdout stays silent; non-zero exit still alerts. That pattern is cheaper for “is the detector API up?” pings than a full agent turn.

Keep detector scores and drafts in one workspace

Give Hermes Agent a versioned workspace for drafts, score JSON, and client packages, with MCP access and a 14-day free trial so you can wire threshold routing and delivery without losing files between runs.

Start 14-Day Trial

Score without routing is a log file. Routing without delivery is an internal dashboard nobody outside the team sees. Close both gaps deliberately.

Encode policy in one place

Keep thresholds and actions in a single policy file the cron prompt and skills both reference, for example policies/detection.yaml:

detector: vendor-name
bands:
  pass:
    max: 0.30
    action: mark_ready
  review:
    min: 0.30
    max: 0.70
    action: create_review_task
  block:
    min: 0.70
    action: block_and_rewrite
max_rewrite_loops: 3
notify:
  channel: telegram
  on: [block, review]
report:
  include: [score, decision, rewrite_count, detector_version, timestamp]

The agent should read this file every run. Changing policy then becomes a config edit, not a prompt rewrite scattered across cron jobs.

What a good detector report contains

Client-facing reports are not vendor dumps. They should answer: what was checked, what scored, what you did, and what the client receives.

Minimum fields:

• Document title and stable draft id
• Detector product name and API model or version string
• Overall AI probability and band decision
• Word count and language if known
• Number of rewrite attempts
• Human approver name or “auto-pass”
• Links or share URLs for the final draft and raw score JSON
• Timestamp and pipeline run id

Store the machine JSON next to a human markdown or PDF summary. Editors read the summary. Auditors keep the JSON.

Delivery paths

Hermes can deliver cron output to local files under ~/.hermes/cron/output/ or to configured messaging targets (Telegram, Discord, Slack, email, and others) [Nous Research Hermes Agent Cron Documentation, 2026]. That works for operator alerts (“3 drafts blocked overnight”).

Client delivery is different. Clients need durable links, branding, and access control. Local cron output or a raw S3 object URL is a weak client experience. Google Drive and Dropbox folders work for internal handoff but offer little structure for score metadata and approval state. Fast.io is a stronger fit when the pipeline already produces versioned drafts and reports: put both in a shared workspace, enable Intelligence for search over past scores, and share the package with a branded Send share or content portal. Per-recipient access and optional expiry keep client packages time-boxed. The append-only audit log records who downloaded what.

Example operator alert prompt fragment for blocked items only (silent when clean):

After scoring, if any draft is in the block band, deliver a short list of paths and scores to the team channel.
If all drafts pass, respond with only [SILENT].

Hermes suppresses delivery when the final response contains [SILENT], while still saving local output for audit [Nous Research Hermes Agent Cron Documentation, 2026].

Hermes runs on a server. Files still need a home that survives restarts, multi-agent concurrency, and human review.

Local disk on the Hermes host is fine for prototypes and cron output under ~/.hermes/cron/output/. It fails when the host is ephemeral (Modal, Daytona hibernation), when two operators need the same reports, or when a client needs a clean package.

Object storage (S3, GCS) is durable and cheap for bulk archives. You own the keys and lifecycle rules. You also own indexing, permissions UX, and report presentation.

Consumer cloud drives (Google Drive, Dropbox, OneDrive) are familiar for humans. Agents can upload via APIs or URL import, but you still bolt on version semantics, structured score fields, and approval gates yourself.

Fast.io works as the persistent workspace layer around Hermes, not as a built-in Hermes feature. Agents and humans share the same org-owned workspaces. Every file keeps version history, so a rewrite loop leaves an auditable trail instead of silent overwrites. Intelligence Mode indexes drafts and reports for semantic search and citation-backed chat. Metadata Views turn detector JSON and markdown reports into a queryable grid (score, decision, client, detector version, timestamp) without hand-built OCR rules. Agents talk to Fast.io through the consolidated MCP toolset over Streamable HTTP at /mcp or legacy SSE at /sse (MCP skill docs).

Suggested workspace layout:

/clients/{client}/drafts/
/clients/{client}/reports/
/clients/{client}/approved/
/policies/detection.yaml

Hermes writer and detector subagents write into drafts/ and reports/. A human or approval step moves packages into approved/. For client delivery, create a branded Send share of the approved folder or a content portal with only the final draft and summary report. Ownership transfer lets an agent scaffold the org and hand control to a human admin while the agent keeps API or MCP access for continued scoring runs.

Plans start with a 14-day free trial (credit card required). Paid tiers include Solo at $29/month, Business at $99/month, and Growth at $299/month. Real work requires a paid organization subscription after the trial. For agent onboarding context, see /storage-for-agents/ and https://fast.io/llms.txt.

Pipelines fail in predictable ways. Catch them before clients do.

Detector downtime or rate limits. Wrap MCP calls with retries and backoff. On hard failure, write status: detector_error and route to review rather than treating a timeout as a pass. Increase timeout on the MCP server block for long documents.

False positives. Keep the review band wide enough that borderline human writing does not auto-block. Require human sign-off for high-stakes client work. Log false positive overrides so you can retune bands monthly.

False negatives. Detectors miss heavily edited AI text. Pair the score with editorial standards (citations, style guide, factual checks). Detection is a generator-output signal, not a truth oracle.

Cron isolation. Every cron job runs in a fresh session. Self-contained prompts matter. Include absolute paths, policy file location, and delivery targets in the job text or attached skills [Nous Research Hermes Agent Cron Documentation, 2026].

Gateway not running. If hermes cron status shows no scheduler, jobs never fire. Install the gateway as a user or system service on the host that should own schedules.

Secret leakage. Put detector keys in ~/.hermes/.env, not in skill markdown or chat. Hermes filters stdio MCP environments to configured env plus a safe baseline [Nous Research Hermes Agent MCP Documentation, 2026].

Cost. Detector APIs charge per document. Cron frequency should match intake rate. Use wakeAgent: false pre-check scripts when the inbox is empty. Prefer a cheaper model for detector children if you only need tool calling, and keep writer models on higher quality tiers via delegation.model overrides when appropriate.

Concurrency. Do not let writer and detector children edit the same path without coordination. Writer finishes → detector scores a frozen version id → rewrite creates a new version. Fast.io version history makes that pattern easier to audit than raw disk overwrite.

When the full loop is healthy, a weekday morning looks like this: cron wakes, intake finds six drafts, detector scores all six, four pass, one lands in review, one blocks. The team channel gets one alert for the blocked item. The client share for the four pass packages updates with reports. Nobody pastes text into a website.