Hermes Agent Web UI

What's in the Web UI

The dashboard is a local web server that ships with Hermes Agent. One dashboard manages every Hermes profile on the machine, with a profile switcher in the sidebar. Its pages include:

• Status — agent version, gateway state, connected platforms and active sessions
• Chat — the full Hermes TUI (hermes --tui) rendered in the browser, with a session list to switch conversations
• Config and API Keys — form editors for config.yaml and .env, so you don't edit files by hand
• Sessions, Logs and Analytics — searchable history with tool calls, live log tailing, and token and cost charts
• Cron — create, pause, edit and trigger scheduled jobs
• Skills and MCP — toggle installed skills, install from the skill hub, and add or test MCP servers
• Pairing and Channels — approve or revoke messaging users, and connect Telegram, Discord, Slack and other platforms from a form
• System — start, stop and restart the messaging gateway, pick a memory provider, run doctor, and create or restore backups

For how the dashboard fits alongside the TUI and the native desktop app, see Hermes Agent GUI options.

How to Open It (Self-Hosted)

With Hermes installed, run:

hermes dashboard                 # opens http://127.0.0.1:9119
hermes dashboard --port 8080     # different port
hermes dashboard --no-open       # don't launch a browser

The default address is http://127.0.0.1:9119. Port 8642 is something else: it is the OpenAI-compatible API server that tools like Open WebUI connect to, not a web UI. If the frontend has not been built yet and npm is available, the first launch builds it automatically.

In the official Docker image the dashboard runs alongside the gateway when you set HERMES_DASHBOARD=1 and publish port 9119:

docker run -d --name hermes --restart unless-stopped \
  -v ~/.hermes:/opt/data \
  -p 8642:8642 -p 9119:9119 \
  -e HERMES_DASHBOARD=1 \
  nousresearch/hermes-agent gateway run

Inside the container the dashboard binds to 0.0.0.0, which switches on its login gate (next section), so configure an auth provider for it too. On Docker Desktop, reusing an existing ~/.hermes from a native install can need a one-time session-database conversion; docker exec hermes hermes doctor flags it and the upstream Docker docs explain the fix.

Reaching It From Outside Your Machine

By default the dashboard binds to 127.0.0.1 and only accepts connections from the same machine. You have three safe ways to use it from somewhere else:

• SSH tunnel or Tailscale, no login — keep the loopback bind and tunnel in, for example ssh -L 9119:127.0.0.1:9119 your-server, then open http://127.0.0.1:9119 locally. This is the route upstream suggests for an auth-free dashboard.
• Username and password on a trusted network — set HERMES_DASHBOARD_BASIC_AUTH_USERNAME, HERMES_DASHBOARD_BASIC_AUTH_PASSWORD and HERMES_DASHBOARD_BASIC_AUTH_SECRET in ~/.hermes/.env, then run hermes dashboard --host <tailscale-or-LAN-ip>.
• Nous Portal OAuth for internet-facing hosts — register the dashboard with hermes dashboard register --redirect-uri https://your-host/auth/callback, set HERMES_DASHBOARD_PUBLIC_URL to https://your-host (without the callback path), and sign in with your Nous account. Self-hosted OIDC is also supported.

A non-loopback bind always requires an auth provider. Without one, the dashboard refuses to start rather than serving an open admin panel.

Securing the UI

The dashboard can read and write your .env (API keys and bot tokens) and run agent commands, so treat access to it like shell access. Two rules from the upstream docs:

• Don't put a password-only dashboard on the public internet. The username/password provider is one shared credential with no MFA. Keep it behind a VPN such as Tailscale, and use OAuth if the dashboard must be reachable publicly.
• There is no “insecure” switch any more. The old --insecure flag and HERMES_DASHBOARD_INSECURE are no-ops. If you want no login at all, keep the default loopback bind and tunnel in.

You can check whether the gate is on from any machine: curl -s http://HOST:9119/api/status reports auth_required and the configured auth_providers.

Common Things People Do In It

• Chat with the agent in the browser, or resume an old session from the Sessions page.
• Approve a new Telegram or Discord user on the Pairing page.
• Connect a messaging platform on the Channels page, then restart the gateway from the same page.
• Add or rotate an API key without opening .env.
• Turn a skill on or off, or install one from the hub.
• Watch the Logs page while a long task runs.

Web UI vs Chat Channels

The web UI is one of several ways to talk to the agent — it's not a replacement for Telegram/Discord/WhatsApp, it's complementary:

• Use the web UI when you want full visibility and control: config, logs, sessions, pairing, skills.
• Use a chat channel when you're on the go or want the agent to talk to other people, not just you.

Skip Self-Hosting: OpenClaw Launch

Everything above assumes you're running Hermes Agent yourself. OpenClaw Launch runs Hermes in the cloud, and each bot's card on your dashboard has an Open Dashboard button that opens that bot's Hermes web dashboard over HTTPS, gated behind your OpenClaw Launch login. There is no port, tunnel or auth provider to set up.

The same card has Quick Chat, a terminal and file access, and connects Telegram, Discord and other platforms in a few clicks. You can also point the Hermes Desktop app at the bot as a remote gateway.

Troubleshooting

Nothing loads on port 8642

8642 is the API server, not the dashboard. Run hermes dashboard and open http://127.0.0.1:9119, or publish port 9119 and set HERMES_DASHBOARD=1 in Docker.

The dashboard refuses to start on a public address

That is the auth gate failing closed. Configure the username/password provider or OAuth before binding to anything other than 127.0.0.1, or keep the loopback bind and use an SSH tunnel.

The Chat tab shows a banner on Windows

The Chat tab needs a POSIX pseudo-terminal. On native Windows the rest of the dashboard works, but chat in the browser needs WSL2.

A channel is configured but not connected

The gateway connects enabled channels when it starts. Use Restart gateway on the Channels page (or the System page), then check the Logs page with the gateway file selected.

Next Steps

• Hermes Agent GUI options — TUI, desktop app, dashboard and chat apps compared
• Deploy Hermes Agent — self-hosted install walkthrough
• Hermes Agent docker-compose — one-file deployment recipe
• Hermes Agent memory — how memory works and where it lives
• Hermes hosting on OpenClaw Launch — skip the ops, keep the UI