Hermes Workspace, hermes-webui and the dashboard: which is which, and how to set one up

Three different things

Each one gives you a page in the browser for talking to your agent. They differ in who writes them and how they reach the agent.

For the built-in dashboard, its pages, and how to reach it safely, read the Hermes Agent dashboard guide; this page does not repeat it.

Who makes Workspace and hermes-webui

Both READMEs were read on GitHub on 2 November 2026. Both repositories belong to individual GitHub accounts, not to an organisation, and both are under the MIT licence. Each had been pushed to on 1 or 2 November 2026, so both are actively developed.

• Hermes Workspace is by the GitHub user outsourc-e and describes itself as a command centre with chat, files, memory, skills, MCP, a terminal, jobs and a dashboard view. The README badge showed version 2.3.0. It says it runs on stock Hermes Agent installed with Nous’s own installer, with no fork needed.
• hermes-webui is by the GitHub user nesquena. It describes a three-panel browser interface with sessions on the left, chat in the middle and a workspace file browser on the right, plus a settings area it calls the Control Center. It is meant for a laptop, a server or a phone.

Neither README says it is made, endorsed or supported by Nous Research, the company behind Hermes Agent, and the Hermes 0.22.5 documentation does not mention either project. Treat them as community software: problems go to their issue trackers, not to Hermes support. The README of each project is the place to confirm anything this page says about it, because both change often.

What Hermes needs before Workspace can connect

Workspace talks to two things on the machine that runs Hermes: the gateway’s OpenAI-compatible API server, and the dashboard. Both listen on the local machine by default. In Hermes 0.22.5:

• The API server listens on 127.0.0.1 port 8642. Change them with API_SERVER_HOST and API_SERVER_PORT.
• API_SERVER_KEY is required, and it is what switches the API server on. In the gateway code the server is turned on when this key is present and usable, and it refuses to start with a missing key, a placeholder, or a key shorter than 16 characters. Generate one with openssl rand -hex 32.
• API_SERVER_ENABLED=true, which the Hermes docs and the Workspace README both tell you to set, is not read anywhere in the 0.22.5 gateway code. It does no harm. The key is what counts.
• The one thing that overrides the key is an explicit enabled: false for the API server in config.yaml. It wins over the environment, so a key in .env will not start the server while that line is there. The block can sit under gateway.platforms.api_server or platforms.api_server.
• The dashboard (hermes dashboard) listens on 127.0.0.1 port 9119 and needs no login on that address.

One mismatch to know about: the Hermes Docker page says the key needs at least 8 characters, while the code requires 16. The code is what runs. The Workspace README also reads as if the key were optional (“if API_SERVER_KEY is set”). On 0.22.5 it is not optional.

Set up Hermes Workspace, step by step

This is the route for someone who already runs Hermes 0.22.5 and wants Workspace beside it. It follows the README’s “attach to an existing agent” path, with the 0.22.5 key rule added. If you do not have Hermes yet, start with how to install Hermes Agent.

1. Put a key in ~/.hermes/.env and keep it somewhere you can copy it from:

   API_SERVER_KEY=<output of: openssl rand -hex 32>

2. Start the gateway in one terminal, and the dashboard in a second:

   hermes gateway run
   hermes dashboard

3. Check both answer. The first should return an OK status and the second dashboard metadata:

   curl http://127.0.0.1:8642/health
   curl http://127.0.0.1:9119/api/status

4. Get Workspace. It needs Node.js 22 or newer and pnpm:

   git clone https://github.com/outsourc-e/hermes-workspace.git
   cd hermes-workspace
   pnpm install
   cp .env.example .env

5. Add these lines to the Workspace .env. The token must be the same value as API_SERVER_KEY:

   HERMES_API_URL=http://127.0.0.1:8642
   HERMES_DASHBOARD_URL=http://127.0.0.1:9119
   HERMES_API_TOKEN=<the same value as API_SERVER_KEY>

6. Start it with pnpm dev and open http://localhost:3000. Finish the onboarding, then send a chat message to prove the whole path works.

The README also describes a one-line installer that installs Hermes and Workspace together, and a Docker Compose set-up that runs both containers, with Workspace on port 3000 and the gateway on 8642. Read what a script does before piping it into your shell. If a URL turns out to be wrong, Settings, then Connection lets you change it without a restart.

hermes-webui in brief

hermes-webui is simpler to attach, because by default it runs the agent inside its own process and reads your existing Hermes configuration. Its README says it does not use the API server to run chat, and that you can route chat through a gateway as an option. Its bootstrap supports Linux, macOS and WSL2, and the README links to a community native Windows setup with limitations.

git clone https://github.com/nesquena/hermes-webui.git
cd hermes-webui
python3 bootstrap.py

The bootstrap looks for Hermes, tries the official installer if it is missing (unless you pass --skip-agent-install), starts the server on 127.0.0.1 port 8787 and opens a first-run wizard. Two settings matter for access: HERMES_WEBUI_HOST (default 127.0.0.1) and HERMES_WEBUI_PASSWORD, which is off by default. The README says to set the password if you expose the port outside the machine, and suggests an SSH tunnel or Tailscale for remote use. It does not state a minimum Hermes version, so check its issue tracker if something fails after an upgrade.

Common failures

• Workspace says Offline or “portable mode”, and sessions, skills and memory show as unavailable. The dashboard is not running or not reachable. Start hermes dashboard, check HERMES_DASHBOARD_URL, and refresh. Before starting another gateway, run curl http://localhost:3000/api/sessions; the README says that if it returns a list, even an empty one, the connection is alive and the page only needs a refresh.
• Unauthorized on every call. The gateway has a key and Workspace has a different one, or none. Set HERMES_API_TOKEN to exactly the value of API_SERVER_KEY.
• The gateway runs but nothing listens on 8642. On 0.22.5 the usual causes are no key, a key under 16 characters or a placeholder, or enabled: false for the API server in config.yaml. Check the key and the config directly, because some of these cases leave the API server off without a specific message.
• The agent is older than the workspace. Workspace reports that it found missing Hermes Agent APIs and tells you to update, then falls back to a basic chat-only mode. Run hermes update and restart the gateway. The reverse also happens: a README written for an older agent can say something, such as that the key is optional, that a newer agent no longer allows. When the two disagree, trust the log and the Hermes docs for your version.
• Cannot connect from another device. Everything defaults to loopback. If Workspace and Hermes run on the same machine, keep both backend URLs on loopback and reach Workspace through an SSH tunnel: run ssh -N -L 3000:127.0.0.1:3000 user@host on your other computer, then open http://localhost:3000 there. Changing API_SERVER_HOST does not move the dashboard, and on 0.22.5 a dashboard bound to anything other than loopback will not start until a login method (username and password, or OAuth) is configured.
• Login does nothing over plain HTTP in Docker. The README says browsers drop secure cookies over HTTP; it tells you to set COOKIE_SECURE=0 for plain HTTP, or COOKIE_SECURE=1 behind HTTPS.
• Chat fails on every model. The agent has no working provider yet. Run hermes setup first; both web pages depend on a model being configured.

Do not put a web interface on a public address

Whatever you choose, remember what these pages control. Hermes can run terminal commands, read and write files and use your connected accounts. A web interface in front of it is a remote control for all of that, and the Hermes dashboard in addition edits the file that holds your provider keys.

• Keep every one of them on loopback unless you have a reason not to.
• If you need a phone or another computer, use a private network or an SSH tunnel. Both READMEs suggest Tailscale; see Hermes Agent over Tailscale.
• If you must listen on a wider address, set the password (HERMES_PASSWORD for Workspace, HERMES_WEBUI_PASSWORD for hermes-webui) and a strong API key first. The Workspace README says it refuses to start on 0.0.0.0 without a password.
• Check which ports are open to the internet. Hermes Agent ports lists the defaults and what each one exposes.

Docker can publish a port past a host firewall, so a firewall rule alone is not proof the page is private. Test from outside your network.

Hermes Workspace on ReadyHermes

ReadyHermes has its own browser workspace. It is not Hermes Workspace, not hermes-webui and not the Hermes dashboard, and it has no connection to those projects. ReadyHermes does not install either project for you. If SSH access is enabled under Bot tools you could try by hand, but neither has been tested there.

What you get after signing in is a page with a chat, plus a menu with Channels, Bot tools, Apps, Skills, Conversation history and Usage, and under Manage: Billing, Model key, Account, Privacy and data, and Help and support. The Bot tools area holds tabs for Files, Backup, Restore, Power, Logs, Live Browser, Plugins and others. Plugins there means a catalog of Hermes plugins, not web interfaces.

There are two ways to reach your assistant from other tools. The API tab turns on an OpenAI-compatible endpoint with its own key, and the Hermes Desktop card gives you connection details for the free Hermes Desktop app (see the desktop guide). We have not tested whether Workspace or hermes-webui can use either.

If you want to run Hermes Workspace itself, run Hermes on a machine of your own. If you want an agent that is already running, ReadyHermes provides one, and you connect your own Telegram, WhatsApp, Discord, WeChat or Lark account. The free trial lasts an hour. See self-hosting versus managed hosting for the trade-off.