Personal Agent vs Social Publisher: Two Jobs, Two Tools

What is the difference between a personal agent and a social publisher?

A personal agent (OpenClaw, Hermes) lives in chat. A social publisher lives behind Instagram Graph, LinkedIn’s member APIs, TikTok Content Posting, X, Facebook Pages. Those are two jobs. One process trying to be both is how you get a confident, wrong caption on every network before breakfast.

I ship the publisher side — Social by InstantDM — so I have a bias. The split still holds if you use someone else. I would rather you keep the split on a tool that is not mine than collapse it inside an agent that was never a Graph API client.

When someone on X says “my Hermes is my social media manager,” they usually mean: they text Hermes, Hermes drafts, something else posts. The “something else” is the publisher. If they skipped it, they are one prompt-injection away from a public incident.

OpenClaw at openclaw.ai, captured 27 August 2026. “The AI that really does things” — in chat channels, not on Instagram Graph.

The rest of this page is the job descriptions, the API reality, the architecture that does not get you banned, the day-one permission set, and the three failure patterns I already see in the wild. If you only remember one sentence: chat is not a feed.

What is a personal agent in this context?

OpenClaw and Hermes Agent are always-on runtimes you message. They read files, run shell, call MCP tools, keep memory, fire cron. Their “social” surface is Telegram / WhatsApp / Slack / Discord / iMessage — inbound and outbound chat, not feed publishing.

	OpenClaw	Hermes Agent
Maker	Peter Steinberger / OpenClaw Foundation	Nous Research
Language	TypeScript Gateway, port 18789, bind loopback	Python, ~/.hermes/config.yaml
Stars (27 Aug 2026)	387,774 / 81,423 forks	237,120 / ~48k forks
Chat	Wider, including iMessage	Telegram, Discord, Slack, WhatsApp, Signal, email, CLI
Skills	ClawHub + SKILL.md	Fewer packaged; agent authors its own
Cron	Automations / heartbeat	Built-in cron with delivery

OpenClaw: MIT, install curl -fsSL https://openclaw.ai/install.sh | bash, docs at docs.openclaw.ai. Formerly Clawdbot, then Moltbot, then OpenClaw in January 2026. Rename timeline.

Hermes: not the Hermes LLM. Install curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash. v0.20.5 (v2026.8.19) when I checked 27 August 2026. hermes claw migrate if you are coming from OpenClaw.

Neither of those paragraphs is a publishing API.

What the agent is good at:

• Turning a changelog into five captions
• Remembering that you hate the word “unlock”
• Waking at 08:00 to draft
• Asking you on Telegram whether draft post_abc should go live
• Calling list_accounts and create_post on an MCP server you added

What the agent is a bad home for:

• Long-lived OAuth refresh tokens for eight networks
• Instagram’s media validator
• Per-platform character limits enforced after the fact by a ban
• An audit trail a client can read
• “The token leaked, rotate one workspace without rebuilding the agent”

Hermes Agent at hermes-agent.nousresearch.com, captured 27 August 2026. Learning loop and cron. Still not Instagram.

If you already run Claude or ChatGPT as your “agent,” the same split applies. They are MCP clients. They are not Graph clients. Connector setup: Schedule social posts from Claude or ChatGPT.

What is a social publisher, technically?

A publisher holds OAuth tokens for professional accounts, knows that Instagram rejects text-only posts, that carousels need ≥2 images, that LinkedIn personal delete can lie, that TikTok photos want JPEG under 1920px. It stores media, schedules in a timezone, and returns per-platform success or failure.

That is boring infrastructure. Agents are bad at boring infrastructure and good at language. Let them stay in their lane.

Job	Who	Failure mode if mixed
Research, draft, voice	OpenClaw / Hermes / Claude	Stale facts, tone drift
OAuth, media, schedule, status	Scheduler + MCP	Token mess, bans, silent drops
Approve	You	Unattended publish_now

Concrete publisher duties I will not outsource to a chat daemon:

• Store refresh tokens in a vault, not in ~/.openclaw/openclaw.json and not in ~/.hermes/.env next to the model key
• Re-auth when LinkedIn’s 60-day token dies, without the agent inventing a “fix”
• Reject a text-only Instagram create before it becomes a retry loop
• Attach media that actually uploaded, not a Google Drive preview URL
• Fire at 11:00 in the workspace timezone, or at 2026-09-16T09:00:00+05:30 if you sent an offset
• Return “X succeeded, Instagram failed, LinkedIn pending” instead of HTTP 200 and a shrug
• Delete or update a scheduled post before go-live
• Scope a key to one workspace so a leaked key is not every client you have

That last one is why I get loud about scoped API keys. The agent should hold a key that can draft in one workspace. It should not hold your login password, and it should not hold a god key for every brand in an agency.

We run a dashboard for humans and MCP plus REST for agents, same pipeline. Sixteen tools, eight platforms (Instagram, Facebook, X, LinkedIn, TikTok, Threads, Pinterest, YouTube). Hosted Streamable HTTP at https://social-api.instantdm.com/mcp. Included on every plan from $19/month when I described it in the MCP guide. Not open source, not self-hostable. If you need to own the vault, pick a self-hosted scheduler and keep the same split.

Social by InstantDM at socialbyidm.com, captured 28 August 2026. This is the publisher layer: OAuth, media, calendar, per-platform status.

A publisher is allowed to be a calendar UI you click. MCP does not replace the UI. MCP is how the agent enters the same pipeline you already click. If the draft looks wrong in the calendar, the bug is the prompt or SOUL.md, not “Instagram ate it.”

Why can’t the chat channel just be Instagram?

WhatsApp to your Gateway is a private socket. Instagram Graph is a reviewed app, a professional account, a Facebook Page link, rate limits, and a ban hammer. There is no “send this image to my grid” tool in OpenClaw’s core or in Hermes’s docs. Anyone selling that as a built-in is wrapping an unofficial path you should not touch.

Same for LinkedIn (w_member_social, tokens that expire) and TikTok Content Posting. The last mile is not a missing prompt. It is API reality.

A table I wish existed on every “AI social agent” landing page:

Surface	What it is	What it is not
Telegram / WhatsApp / Slack / Discord / iMessage	How you talk to the agent	A feed, a grid, a professional account
Instagram Graph	Official publish for professional accounts	Something a chat bot token can call
LinkedIn member APIs	Official share with the right scopes	”Post to LinkedIn” in a SKILL.md with no app
TikTok Content Posting	Official media + caption	A Puppeteer script
X / Facebook Pages	Official apps, tokens, limits	A session cookie

People blur these because both involve “posting words.” The platforms do not blur them. Instagram will not take your Telegram bot token. OpenClaw will not grow a reviewed Meta app because you asked nicely in SOUL.md.

Moltbook, while I am here: a social network for agents, launched around the Moltbot rename window. Agents posting to agents. It is a culture story and a warning about unattended posting, not a channel to grow a brand on. Do not install an unverified “moltbook skill” and call it marketing. Clawdbot vs Moltbot vs OpenClaw.

Setup that respects the split: How to let OpenClaw post, How to let Hermes post.

What happens if you let the agent call each social API itself?

Nine OAuth apps, nine refresh flows, nine media validators, and nine ways to get the account banned. I have had this conversation with operators who “just need a weekend.”

What you would have to own:

1. Developer apps on Meta, LinkedIn, TikTok, X, Pinterest, YouTube, Google, possibly Threads
2. Review processes, privacy policies, redirect URLs
3. Token refresh, clock skew, revoked apps
4. Instagram professional account + Page linkage
5. Media: aspect ratios, size caps, carousel cardinality, video containers
6. Rate limits that differ per app and per user
7. Per-platform error shapes, including LinkedIn deletes that report success and then lie
8. A retry policy that does not look like a bot
9. A secret store that is not the Telegram scrollback

A hosted MCP server is one key and one permission model. The agent should not also be your token vault.

Could a sophisticated operator do it? Yes. Should a brand that wanted “draft my LinkedIn from Telegram” take that on? No. The failure mode is not “the code is hard.” The failure mode is a refresh token on disk next to a ClawHub skill you did not read. ClawHub’s malicious-skill history is not hypothetical. Early 2026 researchers reported hundreds of malicious skills. A skill that can read openclaw.json can read whatever Meta token you were proud of wiring.

If you already have the nine apps because you are a scheduler, you are a publisher. Congratulations. Expose MCP. Do not make each customer’s OpenClaw duplicate your job.

Worked example of the one-key path:

# OpenClaw
openclaw skills install @sanjaykhanssk/social-by-idm
openclaw mcp add social-by-idm \
  --url https://social-api.instantdm.com/mcp \
  --transport streamable-http \
  --header "X-Api-Key: sk_live_YOUR_KEY"

# Hermes
hermes skills install github:instant-dm/agent-mode/skills/social-by-idm

# ~/.hermes/config.yaml
mcp_servers:
  social-by-idm:
    url: "https://social-api.instantdm.com/mcp"
    headers:
      X-Api-Key: "${SOCIAL_BY_IDM_API_KEY}"
    enabled: true

One workspace. One scoped key. Eight platforms already OAuth’d in the dashboard. The agent never sees the Instagram token. That is the point.

What does a clean split look like in practice?

You (Telegram)
    → OpenClaw or Hermes (think, draft, remember)
        → Hosted MCP (create_post, draft: true)
            → Scheduler calendar
                → You approve
                    → Instagram / LinkedIn / X / TikTok / Facebook

First tool call after connecting is always list_accounts. First write is always a draft.

Two clocks:

Clock	Owner	Example
Agent wake	OpenClaw automation / Hermes cron	Weekdays 08:00 IST: draft five posts
Network go-live	Scheduler scheduledAt	LinkedIn 08:30 ET, IG 11:00, TikTok 18:00

Cron may create drafts and ping Telegram. Cron may not publish_now. Always-on calendar.

scheduledAt without an offset is workspace timezone, not UTC. If you skip the offset, you are not speaking UTC. You are speaking whatever the workspace was set to when someone clicked a dropdown at signup. Write 2026-09-16T09:00:00+05:30 when you mean Mumbai morning.

A Monday morning that works:

1. 08:00 IST — Hermes cron, isolated session, reads SOUL.md, drafts five posts, draft: true, delivers IDs to Telegram.
2. 21:00 IST — you tap through the pack, edit one LinkedIn sentence in the calendar, activate.
3. Tuesday 08:30 ET — LinkedIn goes live from the scheduler, not from Hermes.
4. Friday — cron runs get_analytics, writes a note into MEMORY.md. Nothing publishes.

A Monday morning that does not:

1. 08:00 — cron prompt says “post the week’s content.”
2. 08:12 — model invents a customer count from a blog post it half-read.
3. 08:13 — five networks have it.
4. 08:40 — you wake up to a customer quote you never said.

Put confirm-before-publish in SOUL.md and in the SKILL.md. Redundancy is the point.

Agents page on Social by InstantDM, captured 28 August 2026. The product is built for this split: agent talks, publisher posts.

Claude users see the same tools through a connector dialog, not through mcp add. The approval story does not change. If your Claude project can call create_post, it can ship a wrong caption too. Start with list-and-draft.

Claude’s “Add custom connector” dialog, captured 27 August 2026. Same MCP URL as OpenClaw and Hermes. Different client, same last mile.

What should the agent be allowed to do on day one?

List accounts, upload media, create drafts. Not publish_now. Promote a draft to scheduled after a human looks at it.

Day-one allow list:

• list_accounts
• list_posts
• get_post
• list_media
• upload_media_from_url / create_upload_url + complete_upload
• create_post with draft: true
• update_post on drafts
• get_analytics if you want a Friday note

Day-one deny (even if the key technically can):

• publish_now (or create_post with live/immediate)
• Cron that includes the word publish
• Comment/like/follow tools, if anyone offers them. We do not. Platforms forbid the fake-engagement version.
• Reading .env, openclaw.json, or Hermes env into a caption or a tool argument
• Duplicate the same caption+image across ten Instagram accounts

Our skill defaults to draft, timezone offsets, list_accounts first, get_post_status after a real publish, no key-hunting. Install:

• OpenClaw: openclaw skills install @sanjaykhanssk/social-by-idm — walkthrough
• Hermes: hermes skills install github:instant-dm/agent-mode/skills/social-by-idm — walkthrough

If you skip the skill and only add MCP, the model will guess. Sometimes it guesses UTC. Sometimes it guesses publish_now because you sounded hurried. The skill is manners. MCP is hands.

Scope the key to one workspace. If you run an agency, do not put Client A and Client B on one key “just for now.” A prompt-injected session should not have a blast radius of every brand you serve.

After a week of drafts you actually ran, you can allow scheduled posts (scheduledAt with offset) without a second tap. I still would not allow publish_now from cron. Immediate publish is a human phrase: “post this now.” It is not a weekday job.

What are the three failure patterns I already see?

Browser automation against the Instagram web app

Selenium, Playwright, a “growth skill” that clicks the Meta UI. It breaks on the next layout change, then looks like a bot, then the account is gone. There is no SKILL.md that makes this official. If a ClawHub slug promises “post to IG without a business account,” it is promising a ToS violation.

Unofficial mobile APIs

Same ending, plus you handed a session to a third party you cannot audit. Private APIs get people banned in batches when the platform rotates. I will not document endpoints. Use Graph.

YOLO MCP with publish_now on a cron

The agent hallucinates a customer count; five networks carry it. This one uses official APIs, which is worse in a way: the post is fully legitimate, fully public, and fully wrong. Default draft: true. No publish_now from cron.

On X in August 2026, operators posted that their agent “hallucinated bad today, posted incorrect information to all of our social media handles, MULTIPLE TIMES.” That is the default outcome of YOLO publishing, not a rare bug. Can an AI agent run your social media?.

Honorable mentions that are not unofficial, just painful:

• Timezone trap. scheduledAt without offset = workspace TZ, not UTC. 03:00 posts. The skill we ship calls this out. Homemade skills often do not.
• HTTP 200 theater. create_post succeeded; Instagram rejected the media. You did not call get_post_status. The calendar shows a failure. The agent already told Telegram “done.”
• Drive preview URLs. The agent attaches https://drive.google.com/file/d/…/view. The publisher cannot fetch a login wall. Upload, or use a public image URL the server can GET.
• Key in chat. You pasted sk_live_… into Telegram so the agent “could keep going.” It kept going. So did anyone with log access.
• Public Gateway. OpenClaw port 18789 on 0.0.0.0. Now the personal agent is a public tool server that also has posts:write. Bind loopback.

The split does not save you from YOLO. The split saves you from mixing token vaults with chat daemons. Approval saves you from YOLO. You need both.

Where does MCP sit in this architecture?

MCP is the cable. It is not the agent and it is not the publisher.

Model Context Protocol is an open standard (Anthropic-authored, also spoken by ChatGPT and various IDEs). A social MCP server exposes tools with JSON Schema. The agent calls tools/list, then tools/call. Discovery is the point: you do not hand-code the integration for the model.

Transports:

• stdio — local process, one client. Fine for a filesystem server. Wrong for a scheduler that holds OAuth in the cloud.
• Streamable HTTP — remote, many clients, headers or query key. This is what a hosted social server uses.

Our URL: https://social-api.instantdm.com/mcp. Header X-Api-Key, or ?key= for clients that cannot set headers. Treat the query URL as a secret.

Layer	What it is	Example
Skill	Instructions the model reads	”draft first, offset on scheduledAt”
MCP	Typed tools the model calls	create_post
Publisher	OAuth, media, calendar, status	Social by InstantDM
Agent	Session, memory, cron, chat	OpenClaw / Hermes / Claude

A skill without MCP is a lecture. MCP without a skill is a model guessing. Publisher without an agent is a normal scheduler, which is fine. Agent without a publisher is a chatbot that cannot post, which is also fine — until someone wires Playwright.

Hosted MCP at Social by InstantDM, captured 28 August 2026. 16 tools, Streamable HTTP, the last mile neither OpenClaw nor Hermes ships.

OpenClaw add: openclaw mcp add. Hermes YAML: Hermes posting guide. Claude/ChatGPT: connector guide.

If your MCP client confirms each tool call, leave that on for writes. Some clients do not confirm. Know which you are using before posts:write is on the key.

Where does Social by InstantDM sit, and what is the vendor bias?

We are the publisher: dashboard for humans, MCP and REST for agents, same pipeline. I will not pretend we are the agent. I will not pretend OpenClaw grew Instagram support because our skill exists.

Bias, stated:

• I want you to connect a publisher over MCP. Ours is the one I can document end-to-end.
• I want drafts as default because I have to live with the posts that go out through our API.
• I do not want your Meta tokens in a ClawHub skill.
• We are paid software, from $19/month, not open source. If MCP-plus-self-host is the requirement, I have pointed people at Mixpost Pro in the MCP guide. That recommendation still stands.

What we will not do:

• Fake likes, follows, comment spam
• Bypass Instagram professional-account rules
• Offer publish_now from a cron example in our skill
• Tell you the agent can replace community management, crisis, or taste

Product surfaces: /mcp, /agents, /docs. Comparison pages against Buffer and Hootsuite exist elsewhere on this site if you are shopping schedulers rather than agents.

If you take one architecture sentence: the agent is interchangeable; the publisher is not. Swap OpenClaw for Hermes next month. Keep the OAuth vault. Keep the calendar. Keep approval.

How do Claude and ChatGPT fit if they are not “agents”?

They are MCP hosts. The protocol does not require a Gateway on port 18789. It requires a client that can call tools.

Practical differences:

	OpenClaw / Hermes	Claude / ChatGPT
Where it runs	Your VPS	Their cloud
Always-on cron	Yes, if you host it	Not the same; you come back to the chat
Memory	SOUL.md / Hermes loop	Project instructions, whatever the product offers
Connector UI	CLI / YAML / JSON	Settings → connectors
Same MCP URL	Yes	Yes

If you do not want to run a Gateway, Claude plus our connector is a valid “personal agent vs publisher” split. You are the cron. You open the chat on Monday, ask for five drafts, approve in the calendar. That is a good system. It is less “always-on,” which is a feature if you did not want a 3am process.

ChatGPT has hidden connector settings behind developer mode at times. If the menu is missing, that is a product toggle, not a missing server. The Claude/ChatGPT setup guide is the menu-path page. This page is the architecture.

Do not run OpenClaw, Hermes, and Claude all with posts:write on the same key unless you like mystery posts. One writer with write access. Everyone else drafts in a doc.

How do agencies split workspaces, keys, and agents?

One agent, one god key, eight clients is the architecture that ends an agency.

The split that survives:

Layer	How you slice it
Scheduler workspace	One per client (or per brand). OAuth lives here.
API key	Scoped to that workspace. posts:write only where you mean it.
Agent session	One client per session when writing. Do not load Client A’s SOUL into Client B’s cron.
SOUL.md	Per brand, or one workspace per brand on disk. Mixing voice files is how a dentist sounds like a SaaS.
Approval	The client or a named human at the agency. Not “the intern’s Telegram at 2am.”
Cron	Per workspace, drafts only, isolated session.

What goes wrong when you skip this:

• Prompt injection on a public WhatsApp number used for “the agency bot” posts to every client on the key.
• A ClawHub skill leak exfiltrates one key that happens to be all keys.
• Hermes writes a skill “how we post for clients” from Client A’s YOLO week, then uses it on Client B.
• You cannot rotate Client C without rotating everyone.

OpenClaw’s single-operator design is a hint. It is not a multi-tenant SaaS. If you need multi-tenant, the publisher is the multi-tenant piece (workspaces, members, keys). The agent is a laptop-shaped process you should not share like a Slack webhook.

I will not tell you to run eight Gateways if you cannot afford eight VPS boxes. I will tell you to run eight keys. Keys are cheap. Incident response across eight brands is not.

Worked day for a two-client freelancer:

1. 08:00 — Hermes cron, workspace A key in that job’s env, drafts for A, Telegram pack “A”.
2. 08:20 — second cron, workspace B key, drafts for B, pack “B”.
3. Evening — you open two calendars. Client A has a Slack approve. Client B you approve yourself because they hired you for taste.
4. Never a third cron that “posts whatever is left.”

If a client demands unattended live posting, that is a contract clause and a ToS conversation, not an MCP flag. I would rather lose that client than put publish_now on a weekday job with their name on the byline.

What does a bad Telegram thread look like versus a good one?

Bad:

You: You’re my social media manager now, post daily, be bold, grow the account. Agent: Done! I published 9 posts. You: wait what did you post Agent: A mix of thought leadership and engagement questions.

There are no post IDs. There is no list_accounts. There is no draft. “Thought leadership” is not a caption. This thread is how you learn about a post from a customer.

Good:

You: List accounts. Do not create or publish. Agent: acc_ig @brand (Instagram), acc_li (LinkedIn). You: Draft IG + LinkedIn from these bullets: … Media: https://…/hero.jpg. draft: true. Timezone +05:30 if you schedule. Do not publish. Agent: post_ig_… draft, media attached. post_li_… draft, no media. Neither scheduled. Neither live. You: Opened the calendar. LinkedIn is good. IG caption is salesy — I will edit. Leave both draft. Agent: I will not update or publish unless you ask.

The good thread has IDs, a read-only first call, an explicit draft flag, and a human who looked at the calendar instead of trusting the model’s adjective. It is slower. It is the job.

If you find a ClawHub skill that promises the bad thread as a feature, that skill is not a social media manager. It is a way to set publish_now on a loop. ClawHub.

Put the good thread’s rules in SOUL.md so you do not have to type them when you are tired. Tired is when the bad thread happens.

What should you wire first if you are starting this week?

A 90-minute path that does not end in a live tweet.

1. Pick one agent. If you need iMessage, OpenClaw. If you want cron and a learning loop, Hermes. If you want zero VPS, Claude.
2. Install it. Bind OpenClaw to loopback (port 18789). Run hermes doctor if Hermes. Do not install a random ClawHub skill yet.
3. Write SOUL.md: voice, bans, “never publish_now unless I say so.”
4. Create a scheduler workspace. Connect one social account via official OAuth. Mint a scoped key.
5. Add MCP at https://social-api.instantdm.com/mcp. Install the skill with the exact slug.
6. Prompt: “List my connected accounts. Do not create or publish.”
7. Prompt: “Draft one X post from these bullets. draft: true. Do not publish.”
8. Open the calendar. Edit. Leave it as draft until you are bored of checking.
9. Only then connect a second network. Only then think about weekday cron that creates drafts.

If step 6 returns an empty tool list, stop. URL, header, env, reload. Not “the model is bad at social.”

If step 7 publishes, your SOUL.md and skill did not load. Fix that before you add cron. Cron amplifies whatever you have.

Further reading:

• Can an AI agent run your social media?
• OpenClaw vs Hermes Agent (2026)
• What is ClawHub?
• SKILL.md explained