Skip to content
Hermes AI Agent + n8n AI Agents Browse on AWS

Troubleshooting

Start with sudo hermes-n8n status. It checks Hermes, n8n and every connection, and says what to do about anything it finds. sudo hermes-n8n doctor fixes most of it.

SSH times out or is refused

  • Port 22 must be open to your current address. If you allowed My IP and your address has changed, update the security group rule.
  • The user name is ubuntu, and the key is the .pem file from launch.
  • Stopping and starting the instance gives it a new public IP. Copy the new one from the console, or attach an Elastic IP to keep it fixed.

The console's Connect button always fails

EC2 Instance Connect connects from AWS's own addresses, not yours. A security group that allows SSH from My IP only turns it away every time.

  • Add an SSH rule whose source is the prefix list com.amazonaws.<region>.ec2-instance-connect, alongside your My IP rule. See Connect to your instance.
  • Check that Username is ubuntu. The console may fill in root, which this image does not allow.
  • The instance needs a public IP address, and your AWS user needs permission to use EC2 Instance Connect.

The dashboard does not load

  • Use https:// and the instance's public IP address, for example https://203.0.113.10/, not the long ec2-...amazonaws.com name.
  • The security group must allow HTTPS (443) and HTTP (80) from Anywhere-IPv4. See Quick start, step 4.
  • After a launch or a restart, give it about three minutes.
  • Stopping and starting the instance gives it a new public IP, and the dashboard moves to it. Copy the new address from the EC2 console.
  • On the instance, sudo hermes-n8n web status shows the address it serves, and whether the dashboard is on. If it is off, sudo hermes-n8n web on turns it back on.

The browser warns about the certificate

The certificate is issued a few seconds after the instance starts, and again for a new address after a stop and start. If the warning stays:

  • Check that you are using the IP address, not the ec2-...amazonaws.com name, which has no certificate.
  • Check that ports 80 and 443 are open to every address. Let's Encrypt checks the instance from the internet, so a rule limited to My IP stops the certificate. It recovers within minutes of reopening them.
  • On the instance, run sudo hermes-n8n web status for the certificate and when it expires, and sudo hermes-n8n doctor to request it again.

The instance ID page refuses the ID

  • Copy the Instance ID from the instance's page in the EC2 console. It starts with i-. It is not the IP address, the instance's name or the AMI ID.
  • "Too many attempts": after ten wrong IDs from one address, that address waits 15 minutes.
  • The page appears only until n8n's owner account exists. After that, the address opens n8n's own sign-in page.

http://localhost:5678 does not load

Only for an SSH tunnel, when you keep n8n off the internet.

  • The tunnel terminal must stay open.
  • The address is http://, not https://.
  • If another program already uses port 5678 on your computer, use a different local port in the tunnel.

Ask Hermes does not reply

  • Run hermes setup and choose a model provider, then sudo systemctl restart hermes-gateway. Hermes reads new settings only when its gateway starts.
  • Run sudo hermes-n8n status. If the Hermes API key differs from n8n's, it says so, and doctor offers to put it back.
  • Check your model provider's key and balance.

Hermes cannot use the n8n tools

hermes mcp test n8n_tools
sudo hermes-n8n doctor

The Hermes tools workflow must stay published. After a reboot, give n8n a minute before testing. The Enable MCP access switch in n8n's settings does not affect Hermes tools.

connect-builder refuses the token

  • "n8n refused this token": copy the token again. In n8n, go to Settings, Instance-level MCP, choose Connect, then the API key tab, and copy the Access Token. If it is hidden, generate a new one.
  • "n8n's MCP access is switched off": switch on Enable MCP access on the same page. It controls the workflow builder only.

Hermes cannot edit a workflow

Hermes edits workflows it created, and workflows you allowed. To allow one, open its ⋯ menu in the workflow list and choose Enable MCP access, or open it, then ⋯, Settings, and switch on Available in MCP. See Let Hermes build workflows.

status says the workflow-builder token is refused

The token was probably regenerated in n8n. Copy the current one and run sudo hermes-n8n connect-builder again.

The gateway restart shows warnings or times out

Use sudo systemctl restart hermes-gateway. Running sudo hermes gateway restart instead reads root's settings rather than yours, and waits for a gateway it cannot see.

Checking first boot

sudo tail -n 30 /var/log/hermes-n8n-firstboot.log

It ends with finished when the first boot is done, usually within three minutes of launch.

Still stuck?

See Support, and include the output of sudo hermes-n8n status.

Last updated October 25, 2026 · Suggest an improvement