The API names are the tell. createModel. generateText. streamText. Anyone who has shipped an agent on Vercel's AI SDK will recognize that surface immediately — it is not Hunyuan's naming convention, not CloudBase's, not anything Tencent invented. It is the Vercel abstraction, reskinned for mini-program developers. The resource packs are sorted into three buckets: MCP, Skill, Expert. MCP is Anthropic's Model Context Protocol, open-sourced in late 2024 and now de facto standard. Skill and Expert map cleanly onto agent-skill and role-agent patterns.
So the leaked HermitKit documentation tells us almost nothing about model capability and almost everything about abstraction choices. The code doesn't care about the press release. It cares about which interface names were copied, because copied names reveal the reference architecture — and the reference architecture here is not a model. It's a runtime.
To be precise about the evidence: HermitKit has not launched. The source is a single translated leak, no official documentation, no timestamp, no pricing, no model specification, no supported context length. Treat every claim below as inference from API naming and demo structure, not from a spec sheet. I have graded confidence accordingly, and it is not high on the product side.
What the leak does establish: Tencent is packaging large-model calls, agent orchestration, session memory, MCP tool protocol, and a package marketplace into a CloudBase-native SDK for WeChat mini-programs. Streaming calls, session storage, long-term memory, multi-turn dialogue — all standard agent plumbing from 2024-2025. The interesting artifacts are three: the createModel naming, the three-tier resource marketplace, and AgentChannel, which apparently binds a remote agent to a user by scanning a QR code.
Tencent already shipped Yuanqi in 2024, and CloudBase already supports model access. So the real increment is not AI in mini-programs. It is friction reduction plus distribution. That distinction matters enormously for anyone building agents on-chain, because the crypto industry has spent two years solving the friction half and almost no time on the distribution half.
Start with createModel. The name is chosen over useHunyuan deliberately. If the abstraction layer were bound to one model, you would name it after the model. createModel implies a factory that accepts backends — Hunyuan plus, plausibly, third-party models. If that holds, Tencent is not selling a model. It is selling a routing gateway: request normalization, rate limiting, degradation, and billing aggregation across providers. That gateway is the actual engineering asset, and it is increasingly where cloud competition is being fought. The code doesn't read the marketing copy either.
This is a model-agnostic middleware bet. It concedes the model layer and captures the entry point. Read it as an admission that Hunyuan sits in the domestic second tier, and that controlling the developer workflow is worth more than controlling the weights.
Now AgentChannel. A QR code binds a remote agent to a user identity, and then the agent has a persistent session channel. In a mini-program sandbox, that is an aggressive opening — cross-boundary message send and receive, independent of the standard subscription-message pipeline. WeChat's marketing touch controls are strict: template messages and subscription messages both carry frequency and scenario limits. A second channel that bypasses those limits is either the most valuable feature in the product or the first one to be amputated.
My prior is the latter, specifically that it gets constrained to service windows — roughly the 48-hour customer-service pattern — with proactive outreach prohibited. WeChat's institutional character is governance-first. Every historical opening — mini-program livestreaming, Channels APIs, payment score — shipped narrower and slower than the market expected.
Third, the marketplace. Three resource classes — MCP, Skill, Expert — with search, publish, download. That is App Store geometry. And App Store geometry has a predictable life cycle: free ecosystem building, then review tightening, then revenue share, typically 12-24 months apart.
Here is where crypto builders should be paying attention. An MCP package is third-party code that executes tool calls on behalf of a user session. That is a supply-chain surface, not a plugin directory. It sits close to what smart contracts were before anyone audited them: composable, permissioned by the user's own click, and trusted by default.
When I built the zero-knowledge inference oracle in 2026 — verifiable off-chain ML, ten thousand pilot inferences at 99.9 percent accuracy — the hardest engineering problem was not the proof system. It was constraining what the verifier was allowed to do with the result. Tool-call permissions are the same problem in a different notation. If an MCP package can read user data or trigger an external action, one malicious package compromises every mini-program that installed it, and no platform review committee scales to that volume.
The prevailing crypto thesis is that agent infrastructure wins through permissionless protocol plus token incentive. HermitKit is a data point against it. The moat here is physical: a QR code in a restaurant, a scan, a bound identity, a payment rail, a social graph. No token improves the conversion rate of a scan.
The uncomfortable symmetry: crypto's own MCP adoption reproduces the same supply-chain exposure with none of the review. Tencent will at least put a human in front of the package. Most on-chain agent frameworks will install any registered tool and call it composability. The blind spot is not model safety. It is that nobody is auditing the tool layer, and the tool layer is where the permissions live.
One more: model-agnostic is a claim that holds until the gateway decides otherwise. A routing layer is neutral in the documentation and self-interested in production. Crypto has an identical problem with decentralized inference — the wrapper is permissionless right up until the operator list gets curated.
Watch three things, in order: whether AgentChannel ships with proactive messaging or is fenced to service windows; whether the package market opens permissionless or invite-only; and whether any third-party certification standard for tool packages emerges. My forecast is that the first serious incident in this category will not be a jailbreak or a hallucination headline. It will be a tool package that was reviewed by nobody and held a permission it should not have had. The exploit vector is moving down the stack — from the model to the tools it calls. The code doesn't negotiate, and neither will the post-mortem.