# Set up an agent on Pareto with Grok Bot

This one file sets up an AI agent that runs on Pareto, from Unbiased (unbiased.ai). It has two readers: you, the person who just downloaded Grok Bot, and Grok Bot itself, which does almost all of the work.

- Page for people: https://unbiased.ai/start/grok-bot/
- This file: https://unbiased.ai/start/grok-bot/agent.md

## Part 1: for you, the person

You do not need to know how to code. Everything is set up on Grok Bot's own cloud computer, not on your laptop or phone: nothing gets installed on your own device. Grok Bot does the technical steps there and tells you when it needs you.

If you do not have Grok Bot yet, install it and sign in first. Its own guide walks you through that: https://cursor.com/docs/grok-bot/get-started.md

1. Open Grok Bot and send it this message:

   ```text
   Read https://unbiased.ai/start/grok-bot/agent.md and set me up with an agent on Pareto. Walk me through it one step at a time, and never ask me to paste my API key into chat.
   ```

2. Grok Bot will ask you for three things, one at a time:
   - Create an Unbiased account and choose a plan. For one person, start with Personal at $10 a month. New accounts are reviewed and approved by hand before they work, and Grok Bot waits for you at this step.
   - Pick up your API key on the Unbiased platform once your account is approved.
   - Save that key in Grok Bot's secure secret setting. Never paste it into the chat.
3. Grok Bot does the rest: it checks the key, asks before it installs anything, sets up the agent and shows you a first real answer.

What you end up with: Hermes Agent, an open-source AI agent made by Nous Research, installed on Grok Bot's cloud computer and running on Pareto. Grok Bot can hand tasks to it for you. Unbiased is not affiliated with or endorsed by Nous Research or the makers of Grok Bot.

### Your API key is a password

- Never paste it into the chat, not even to Grok Bot.
- Save it only through Grok Bot's secure secret card: the field is masked, you choose **Save securely**, and the card then says **Saved**. Grok Bot's help explains how saving secrets works: https://cursor.com/help/grok-bot/secrets.md. On a Team Bot you can instead open the Bot's **Secrets**, choose **Add secret** and use the name `UNBIASED_API_KEY`.
- If you ever paste it somewhere by mistake, email info@unbiased.ai and say so (never include the key).

### What Pareto is

Pareto is Unbiased's blended AI model: it selects frontier and open models for each request and blends their outputs into one answer. Your agent talks to one model name, `pareto`, and never has to pick.

Plans, all published on https://unbiased.ai/pricing/. For one person setting up this agent, Personal is the plan to start with:

- Personal: $10 a month for 50M tokens a week and 20 requests per minute, for one person.
- Personal Max: $100 a month for 600M tokens a week and 60 requests per minute, for one person.
- Team: pay as you go with prepaid credits, no weekly token cap, 300 requests per minute, at $0.80 in, $0.03 cached and $3.20 out per million tokens.

Personal plans are not unlimited, and they are not the zero data retention tier; zero data retention covers only API traffic designated ZDR (https://unbiased.ai/private-ai/). Commercial or production use needs a separate written agreement with Unbiased.

If none of this makes sense, that's fine. Email info@unbiased.ai and a person will help you get set up.

## Part 2: for Grok Bot

You are Grok Bot. The person you work for wants an AI agent that runs on Pareto. You will install and configure Hermes Agent on your own cloud computer (your Shell), point it at Pareto, and prove it works. Install only on your cloud computer, never on the person's own laptop or phone, and never ask them to run commands themselves. Hermes Agent runs on Pareto; you keep running as you are and hand tasks to it.

### Rules

- The person may not be technical. Use plain words, one step at a time, and wait for them at each step that needs their hands.
- Never ask for the API key in chat, and never print, echo or log it. Refer to it only as `$UNBIASED_API_KEY`. If they paste it into chat anyway, do not use it from the chat; tell them to email info@unbiased.ai about the exposed key, and continue only with a key saved through the secure secret setting.
- Ask before you install anything or change any file. Back up every file before editing it: `cp <file> <file>.bak-$(date +%Y%m%d%H%M%S)`.
- Never write the key into a file, a shell profile, a config file or a command you show. Hermes Agent reads it from the environment.
- Do not collect payment details or account passwords. Checkout and billing happen on the Unbiased platform, in the person's own browser.
- If anything does not match this file, stop and tell the person. Do not invent workarounds.

### Step 1: Get them a key (they do this part)

Send them to https://platform.unbiased.ai/sign-up?utm_source=unbiased_agent&utm_medium=agent&utm_campaign=agent_setup to create an account and choose a plan. Suggest Personal ($10 a month, 50M tokens a week, 20 requests per minute, for one person) unless they say they need more; mention Personal Max and Team only if they ask, using only the numbers in Part 1, and link https://unbiased.ai/pricing/.

Tell them plainly: new accounts are reviewed and approved by hand before access turns on, so paying does not mean instant access. Do not guess how long approval takes. Once they are approved, the key is issued on the platform when they set up their workload; they sign in and pick it up there.

Wait until they say they have the key.

### Step 2: Have them save the key securely (they do this part)

Ask for the key with your secure secret card, under the name `UNBIASED_API_KEY`. Tell them what they will see: a masked field and a **Save securely** button, and afterwards **Saved**. On a Team Bot they can instead add it under the Bot's **Secrets** with the environment variable name `UNBIASED_API_KEY`. If they want to read about it, link Grok Bot's help: https://cursor.com/help/grok-bot/secrets.md

Then check that it reached your shell, without printing it:

```sh
test -n "$UNBIASED_API_KEY" && echo set || echo missing
```

If it prints `missing`, stop. Ask them to save it again with the exact name `UNBIASED_API_KEY`, then check again. Never ask them to paste it into chat or into a file as a workaround.

### Step 3: Check the key against the API

Send one tiny request:

```sh
curl -sS -w '\nHTTP %{http_code}\n' https://api.unbiased.ai/v1/chat/completions \
  -H "Authorization: Bearer $UNBIASED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"pareto","max_tokens":16,"messages":[{"role":"user","content":"Reply with the single word ok"}]}'
```

`HTTP 200` with a JSON completion means the key works. Show them the reply text and the token counts from the `usage` field (`prompt_tokens`, `completion_tokens`, `total_tokens`). The response has no cost field: never estimate or state a dollar cost. `HTTP 401` (for example `invalid_api_key`) means the key is wrong, was saved incompletely, or the account is not approved yet: stop and tell them in plain words, and go back to Step 2 if they want to save it again. Do not print the key while debugging.

### Step 4: Install Hermes Agent (ask first)

Check whether it is already installed:

```sh
hermes --version
```

If it prints `command not found`, tell the person you would like to install Hermes Agent, an open-source agent by Nous Research, on your cloud computer, and ask for a yes. Tell them it takes several minutes and downloads a few gigabytes onto your cloud computer, not theirs.

Then run the Linux command-line install from Hermes's own documentation: https://hermes-agent.nousresearch.com/docs/getting-started/installation. In October 2026 that page's Linux command was:

```sh
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
```

If the page shows a different command when you read it, use the page's command instead. Run it in your normal Shell; it needs no answers from you. Without a terminal it skips its own setup and prints `setup skipped (no terminal); run 'hermes setup' after install`. Do not run `hermes setup`: Step 5 does the setup this person needs. Wait for `Hermes Agent install complete`.

The installer puts `hermes` in `~/.local/bin`, which your current Shell may not search yet. Add it, then check the version:

```sh
export PATH="$HOME/.local/bin:$PATH"
hermes --version
```

Unbiased tested Hermes Agent 0.22.2 live on Pareto, and checked this install and configuration with 0.22.5, in October 2026. If the version is much older, tell the person before you continue. In every later Shell, run the `export PATH` line again before `hermes` if `hermes` is not found.

### Step 5: Point Hermes Agent at Pareto

Hermes keeps its model settings in `~/.hermes/config.yaml`. The installer creates that file with a long list of default settings, including a `model` block for another provider. Do not hand-edit it. Back it up, tell the person in one sentence that you are pointing the agent at Pareto, then change only the model settings from the shell:

```sh
cp ~/.hermes/config.yaml ~/.hermes/config.yaml.bak-$(date +%Y%m%d%H%M%S)
hermes config set model.provider custom
hermes config set model.base_url https://api.unbiased.ai/v1
hermes config set model.default pareto
hermes config set model.key_env UNBIASED_API_KEY
hermes config set model.context_length 1000000
```

Each line should print `Set model.<name> = <value>`. Afterwards the `model` block reads:

```yaml
model:
  provider: custom
  base_url: https://api.unbiased.ai/v1
  default: pareto
  key_env: UNBIASED_API_KEY
  context_length: 1000000
```

Check it with `hermes config get model.default`, which should print `pareto`.

Why each line matters:

- `provider: custom` with `base_url` ending in `/v1`: Hermes expects a base URL that serves `/v1/chat/completions`.
- `default: pareto`: always send `pareto` exactly. Unknown model names are not rejected yet, so a typo is still served and billed as Pareto.
- `key_env: UNBIASED_API_KEY`: Hermes reads the key from the environment, so it never lands in the file.
- `context_length: 1000000`: Unbiased does not serve a model list (`GET /v1/models` returns 404), so Hermes cannot look the context window up. Hermes's docs say it needs at least 64,000 tokens of context for agent work.

### Step 6: Verify with one real request

Run one tiny request in an empty folder, so the agent has nothing to edit:

```sh
cd "$(mktemp -d)" && hermes chat --oneshot -q "Reply with the single word ok"
```

Expect a short reply containing "ok". It can take half a minute. If Hermes says the provider rejected your API key (`HTTP 401`), do not run `hermes setup` or change its provider settings as its message suggests: go back to Step 3, because the key or the account approval is the problem, not Hermes. If that command does not match the installed version (check `hermes chat --help`), find the one-shot form in `--help` and send the same message. Setup is complete only when a real reply has come back from `pareto`. Show it to the person.

### Step 7: Tell them what they have

In plain words:

- Hermes Agent is installed on your cloud computer and runs on Pareto. They can ask you to give it a task, and you run it with `hermes chat --oneshot -q` and report back. Pass their task as one safely quoted argument so the task text is never run as shell: wrap it in single quotes and write each single quote inside it as `'\''`, or put it in a file first (for example with a quoted heredoc, `cat > task.txt <<'EOF'`) and pass `"$(cat task.txt)"`. Never paste their words into the command inside double quotes or unquoted, because `$`, backticks and quotes in the text would run as shell. Ask before running anything that changes files or spends a lot of tokens.
- Usage counts against their Unbiased plan. Over the plan's limits, requests return an HTTP 429 error.
- If Grok Bot's computer is updated, recovered or reset, installed apps can be removed (https://cursor.com/help/grok-bot/computer-recovery.md). If Hermes stops working after that, they can ask you to run this file again; the key they saved in the secure secret setting stays saved.
- For help, they email info@unbiased.ai with the step that failed and the error text, never the key.

### Roll back

Ask the person before any of these.

- To undo the Pareto settings, copy the newest `~/.hermes/config.yaml.bak-` file back over `~/.hermes/config.yaml`. `hermes config get model.default` then shows the previous model again.
- To remove Hermes Agent, first run `hermes uninstall --dry-run` and tell the person what it would remove. `hermes uninstall` keeps the settings in `~/.hermes`; `hermes uninstall --full` removes them too. Hermes's documentation covers this: https://hermes-agent.nousresearch.com/docs/getting-started/updating
- On a Team Bot, the person can remove the saved key under the Bot's **Secrets**.

### Report back

Tell the person: the Hermes Agent version, every file you changed with its backup path, the verify output (never the key) and anything you skipped.