Hermes Agent dashboard: start it, reach it safely, and use it

What the Hermes dashboard is

The dashboard is a small web server that comes with Hermes Agent and serves a single-page app. It is an administration panel for the same files the command line uses: config.yaml, the .env file that holds API keys, the session history, the cron jobs and the installed skills. Configuration settings can also be changed with hermes config set or by editing config.yaml. Sessions, scheduled jobs and gateway processes have their own management commands.

It is also a chat window. The Chat tab runs the real Hermes terminal interface in the browser, so slash commands, the model picker and approval prompts all work the way they do in a terminal.

Two things it is not. It is not the Hermes Desktop app, which is a separate native program (see Hermes Agent Desktop), although Desktop can connect to a dashboard running on another machine. And it is not the messaging gateway that talks to Telegram or WhatsApp: the gateway is a separate long-running process, and the dashboard only manages and monitors it.

Start it: command, port and flags

With Hermes installed (see how to install Hermes Agent), run:

hermes dashboard

This starts the server and opens http://127.0.0.1:9119 in your browser. The default port is 9119 and the default bind address is 127.0.0.1, which means only the machine it runs on can reach it. These are the defaults in the command’s argument definitions, and they match the documentation.

• --port: the port to listen on, default 9119. A value of 0 lets the operating system pick one.
• --host: the bind address, default 127.0.0.1. Changing it to anything other than a loopback address turns on login, covered in the next section.
• --no-open: do not open a browser tab on start, which is what you want on a server.
• --skip-build: skip the web interface build step and serve the files already built.
• --isolated: when started from a named profile, run a separate server for that profile instead of the machine-wide dashboard.
• --status and --stop: list or stop the running Hermes web server processes.
• --insecure: kept so old scripts do not break, but it does nothing. Since the June 2026 hardening it no longer switches authentication off.

hermes dashboard --port 8080 --no-open

No extras to install. In version 0.21.5, FastAPI, Uvicorn and the platform-specific PTY library are core dependencies. The pty extra remains as an empty compatibility alias.

The first launch also builds the web interface if it has not been built yet and npm is available. The Chat tab runs the terminal interface in the browser; it works on Linux, macOS and WSL2, and on native Windows too, where version 0.21.5 uses the Windows console instead.

Port already in use? Pick another with --port. One Hermes backend serves a whole machine, so if a dashboard is already running and cannot serve the host and port you asked for, Hermes refuses and names the process that owns it rather than starting a second one.

Reaching it from another machine safely

Treat the dashboard as a control panel for your whole agent. It reads and writes the .env file with your API keys and bot tokens, and it can run agent commands. The documentation says so plainly and sets the default accordingly: bound to 127.0.0.1, only local processes can connect and there is no login.

The simplest safe route is not to expose it at all. Leave it bound to loopback and use an SSH tunnel, optionally over your Tailscale network. Run this command on your computer, then open http://localhost:9119:

ssh -L 9119:localhost:9119 user@your-server

Reachable deployments require authentication. A bind host other than 127.0.0.1, ::1 or localhost enables the login gate. A non-loopback dashboard.public_url also enables it, even when the backend binds to loopback. Protected routes require authentication; public endpoints such as /api/status remain accessible. Without a configured provider, interactive startup offers setup and unattended startup fails. --insecure does not disable the gate.

Three login methods ship with Hermes, and the documentation says which one fits where:

• Username and password. Set HERMES_DASHBOARD_BASIC_AUTH_USERNAME and HERMES_DASHBOARD_BASIC_AUTH_PASSWORD (or a hashed password), plus HERMES_DASHBOARD_BASIC_AUTH_SECRET so sign-ins survive a restart. It is one shared credential with no multi-factor step, so upstream says to use it only on a trusted network or behind a VPN, not on the open internet.
• Nous Portal sign-in (OAuth). Registered with hermes dashboard register. Upstream names it as the provider suitable for a dashboard reachable over the public internet.
• Your own OIDC provider. Keycloak, Auth0, Okta and similar, through standard OpenID Connect.

For a private network, the documentation’s own pattern is Tailscale: bind to the machine’s Tailscale address with --host, configure one of the logins above, and only devices on your tailnet can reach it. Behind a reverse proxy, set the dashboard’s public URL and trust only that proxy’s address in config.yaml.

In Docker. The official image runs the dashboard when you set HERMES_DASHBOARD=1. Inside the container it defaults to 0.0.0.0 on port 9119; override these with HERMES_DASHBOARD_HOST and HERMES_DASHBOARD_PORT. The default bind enables the login requirement. The Hermes Agent Docker guide shows a compose file that publishes the port on the host’s loopback only.

What you can do in the dashboard

The sidebar groups the pages below. All of them read and write the same files as the command line.

• Status overview. Gateway status and active-session counts appear in the sidebar. The Sessions page refreshes its status and recent-session overview every five seconds. Resource-pressure warnings appear above the page content.
• Chat. The full terminal interface in the browser, with a list of past sessions beside it and a picker for the working folder.
• Config. A form for config.yaml, with dropdowns for fields that have fixed choices, plus save, reset, export and import. Changes apply on the next session or after a gateway restart.
• API Keys. Set, update or delete model-provider keys, tool keys and other settings in .env. Values are shown redacted. Messaging-platform tokens are managed on the Channels page.
• Sessions. Search all conversations, expand one to read it with its tool calls, rename, export as JSON, delete, or prune old ones.
• Logs and Analytics. Filter the agent, error and gateway logs by level and component. Token analytics is hidden by default; switch on dashboard.show_token_analytics in Config to see local token estimates over 7, 30 or 90 days, per model. Your model provider remains the place to check real usage and billing.
• Cron. Create, pause, edit, trigger and delete scheduled jobs with a cron expression and a delivery target.
• Skills and MCP. Toggle installed skills, browse and install from the skill hub, and add, test and remove MCP servers. See Hermes Agent skills for what skills are.
• Channels, Pairing and Webhooks. Fill in each messaging platform’s credentials, switch it on, restart the gateway, approve or revoke paired users, and manage webhook routes.
• Profiles. Create and manage separate Hermes profiles; a switcher in the sidebar chooses which profile the other pages edit.
• System. Host statistics, update checks, gateway start and stop, memory settings, the credential pool, and operations such as doctor, backups and restore.

There is also a REST API behind the pages, for example /api/status, which reports whether the login gate is on. The bundled themes can be switched from the palette icon at the bottom of the sidebar.

Using it with Hermes Desktop

Hermes Desktop normally starts its own local backend and can also connect to a remote backend under Settings, Gateways. The hermes dashboard server supports these connections. Desktop’s startup probe uses /api/health, with a compatibility fallback to /api/status; its connection test also checks the chat WebSocket. Configure the authentication required by your connection method: a dashboard sign-in, session token or Desktop-managed SSH connection.

The documented check from any machine is to read /api/status and look at auth_required and auth_providers. If it says the gate is off, the dashboard is bound to loopback. If basic is missing, check the basic-auth configuration, its environment overrides and the startup logs. For the app itself, see Hermes Agent Desktop.

Extending it: themes and plugins

The dashboard is built to be extended without cloning the repository. It ships with eight themes, and you can add your own as a YAML file in ~/.hermes/dashboard-themes/, setting the palette, typography, layout and even custom CSS. The font can also be changed on its own from the theme picker.

Plugins add pages. A dashboard plugin is a folder under ~/.hermes/plugins/<name>/dashboard/ containing a manifest.json and a prebuilt JavaScript file, and optionally CSS and a Python file that adds backend routes. Plugins use the SDK the dashboard exposes on the page, so they do not bundle React. The manifest sets the tab’s name, icon and position, and a plugin can also replace a built-in page or inject widgets into existing ones through named slots.

Enable user plugins in plugins.enabled. After adding a frontend extension, call /api/dashboard/plugins/rescan and reload the page, or restart the dashboard. Adding or changing Python backend routes requires a restart. The frontend uses React with TypeScript, and hermes update rebuilds it when npm is available.

The Hermes dashboard on ReadyHermes

ReadyHermes does not offer the upstream hermes dashboard pages. The workspace has no link or button that opens them, and you do not run the command, choose a port or set up a login for it. The equivalent is the ReadyHermes web workspace at readyhermes.com/app, which is built for people who want to use the agent rather than administer a server.

The workspace menu has these items: Assistant, Channels, Bot tools, Apps, Skills, Conversation history and Usage. Account pages such as billing, security and support sit in a separate group.

• Assistant. Chat with the agent, with a New chat button.
• Channels. Connect the agent to Telegram, WhatsApp, Discord, WeChat and Lark, and get the Hermes Desktop connection details: a remote URL, username and password for the free app, valid for 30 days and renewable on the page. See Hermes Agent on Telegram and on WhatsApp.
• Bot tools. Tabs for tools such as Power (start, stop and restart; a restart takes about a minute), Backup, Restore, Files, SSH, Plugins, Logs, Live Browser and Desktop.
• Apps. Connect services such as Gmail, Google Calendar and Notion.
• Skills. Add ready-made jobs.
• Conversation history. Your recent chats to reopen.
• Usage. What the assistant has used. A Model key page for your own model API key sits with the account pages.

The workspace has no equivalent to the upstream config form, Cron page or dashboard-extension interface. Bot tools does offer SSH access over your own Tailscale network for hands-on administration. If you need full control, self-hosting is the better fit; the self-hosting versus managed comparison explains the differences. For a hosted agent you can use from your browser and chat apps, see managed Hermes Agent hosting. New bots are ready in about 10 seconds, and there is a free trial that lasts one hour.