Operate a WeCom Enterprise Bot with Hermes

WeCom can host Hermes as an enterprise AI Bot. The setup wizard supports a QR-assisted flow that retrieves the bot credentials, while a manual path is available through the WeCom administration console. In both cases, treat the Bot ID, secret, and organization access policy as production credentials.

Official documentation: https://hermes-agent.nousresearch.com/docs/user-guide/messaging/wecom

Choose the enrollment path

The scan-to-create flow reduces transcription mistakes and guides access-control setup. Use it only on a trusted terminal where the QR code and resulting credentials will not be captured into public logs or recordings. For manual setup, create the AI Bot in the intended enterprise and copy its credentials into the guided Hermes setup.

Set a home channel for reports only when the target audience is known. A bot installed across an enterprise should not inherit broad operational powers merely because many employees can reach it.

Setup checklist

Confirm the intended WeCom enterprise and administrator.
Choose QR-assisted or manual app creation.
Run hermes gateway setup and select WeCom.
Protect the Bot ID and secret.
Configure allowed users, groups, and mention behavior.
Select a fixed home target for scheduled delivery if required.
Start the gateway and verify the adapter status.
Document which Hermes tools are available from WeCom sessions.

Match user experience to adapter behavior

The WeCom adapter does not necessarily stream model output token by token or show a typing indicator. Design responses that work within that constraint: acknowledge long tasks concisely, avoid duplicate submissions, and deliver the verified result when complete.

Test direct, group, media, and scheduled-delivery behavior separately. A polished rollout should also define what happens when a user leaves the organization or changes groups.

Common pitfalls

Scanning setup QR codes while screen recording or screen sharing.
Creating the bot in a test enterprise and configuring production users around it.
Leaving access open because the platform itself is enterprise-managed.
Promising live typing or streaming behavior the adapter does not provide.
Sending scheduled reports to an ambiguous recent conversation.
Failing to remove former users from Hermes authorization policy.

Verification steps

Start the gateway and confirm the WeCom adapter authenticates without printing credentials.
Test a direct message from an allowed employee.
Test group mention and non-mention behavior.
Send a longer request and confirm the user receives one coherent result without duplicates.
Test an unauthorized identity and a removed-user scenario.
Deliver a harmless scheduled test to the configured home target.
Review logs for reconnect loops, sender-ID mismatches, sensitive message retention, and accidental cross-group routing.