Hermes Agent Web UI: Setup, Security, Options (2026)

Do not index

The Hermes agent web UI is the browser control panel that ships with Hermes agent: run hermes dashboard and it serves the official Hermes Web Dashboard at http://127.0.0.1:9119, with chat, channels, skills, MCP servers, cron jobs, and credentials in one tab. Setup is two commands, and securing it before you expose it is the part most guides skip. If you would rather not operate any of it, managed hosts like Agent37 give you a browser console on an always-on Hermes instance from $3.99/mo.

This guide covers the whole map: which "web UI" people actually mean, the official setup, the npm build error half the internet hits, the auth story that changed in June 2026, remote access, Docker, and what the managed options look like.

Which Hermes agent web UI are you looking for?

Four different projects answer to "Hermes web UI", and they do not even share a port. Sort this out first and you will save an afternoon:

Name	What it is	Default port
Hermes Web Dashboard	The official admin panel + chat, ships with the agent, run with `hermes dashboard`	9119
hermes-webui	Community web and phone UI by nesquena (18k+ GitHub stars), runs the agent in-process, no gateway needed	8787
Hermes Workspace	Community command center: chat, files, Monaco editor, terminal, multi-agent views	3000
Open WebUI	A general-purpose chat UI that connects to Hermes' OpenAI-compatible API server on 8642	3000 (Docker) or 8080 (pip)

Hermes Desktop is the fifth thing people mean, and it is not a web UI at all: a free native app for macOS, Windows, and Linux that can attach to a remote backend on port 9119.

Most searches mean the official Web Dashboard, so that is what the rest of this guide sets up and secures. If you are weighing the Hermes Workspace command center specifically, we compared all three meanings of "workspace" in our Hermes agent workspace guide. And hermes-webui is worth knowing about: it is the most-starred community UI, phone-first, and architecturally different because it runs Hermes in-process reading your HERMES_HOME instead of attaching to a gateway.

How do you set up the Hermes agent web UI?

The official dashboard needs two optional extras on top of a base Hermes agent install, because the default install does not ship an HTTP stack. Install them, then launch:

cd ~/.hermes/hermes-agent
uv pip install -e ".[web,pty]"
hermes dashboard

The web extra pulls FastAPI and Uvicorn. The pty extra powers the embedded Chat tab (it is the real Hermes TUI running over a pseudo-terminal, not a lookalike). If you skip the extras, hermes dashboard tells you exactly what is missing when you run it. Your browser opens http://127.0.0.1:9119, and everything stays on your machine.

Useful flags: --port if 9119 is taken, --no-open for headless boxes, --host 0.0.0.0 only after you have configured auth (more on that below), and --isolated if you want a single-profile server instead of the default machine-level dashboard with its profile switcher.

Inside you get more than most people expect from a "web UI": Status, Chat, a form-based Config editor covering 150+ fields, API Keys, Sessions, Logs, Analytics, Cron, Profiles with a dedicated Profile Builder, Skills, MCP, Webhooks, Pairing, Channels, and a System page with gateway controls, memory, the credential pool, and one-click doctor, security-audit, and backup runs. On native Windows the management pages all work, but the Chat tab needs a POSIX terminal, so it shows a banner pointing you at WSL2.

As of the v0.21.2 release (September 11, 2026), the dashboard is the closest thing Hermes has to a control plane. Nous Research's docs still brand it the Hermes Web Dashboard.

How do you fix "Web UI npm install failed"?

On first launch the dashboard builds its frontend (a Vite-built SPA) automatically if npm is available. When that build breaks, you get the error people paste into Google:

✗ Web UI npm install failed
Run manually:  npm install --workspace web && npm run build -w web

The fix is exactly what the message says: run those two npm commands from the Hermes agent directory, then start hermes dashboard again. If the error says npm is not available at all, install Node.js first, then run cd web && npm install && npm run build.

Two related gotchas. First, a missing-frontend error is not a broken agent: your gateway and channels keep working, only the browser UI is unavailable. Second, do not chase this with hermes doctor: doctor checks core packages and connectivity, but the dashboard's own launcher is what reports missing web dependencies.

How do you secure the Hermes agent web UI?

By default there is nothing to do: the dashboard binds 127.0.0.1, is reachable only from your machine, and needs no login. Security work starts the moment you bind anything else.

Since the June 2026 hardening (shipped in v0.18.0), a non-loopback bind requires an auth provider, full stop. The old --insecure flag and the Docker HERMES_DASHBOARD_INSECURE variable are deprecated no-ops: they print a warning and change nothing. If no provider is configured, the server refuses to start rather than starting open. Several guides still claim the dashboard "has no authentication of its own". That was never quite true and is now the opposite of true.

The backstory is worth knowing because it explains the strictness. In June 2026, scanners fingerprinted dashboards that operators had exposed with --insecure --host 0.0.0.0 (the dashboard's MCP page is publicly indexable), then drove the agent through the also-exposed API server to plant a shell-command MCP entry that re-installed an attacker's SSH key on every cron tick and startup. At least one production instance was publicly confirmed compromised (PR #50476 documents the whole campaign). The dashboard reads and writes your .env, manages channel credentials, and can create shell hooks, so treat it like root on the box it runs on.

Three auth providers ship in the box:

Provider	Turn it on with	Best for
Username + password	`HERMES_DASHBOARD_BASIC_AUTH_USERNAME` and `_PASSWORD` (or `_PASSWORD_HASH`)	Trusted LAN or VPN only, never the open internet
Nous Portal OAuth	`hermes dashboard register`, sets `HERMES_DASHBOARD_OAUTH_CLIENT_ID`	Public exposure with the least setup
Self-hosted OIDC	`HERMES_DASHBOARD_OIDC_ISSUER` + `_CLIENT_ID`	Teams already on Keycloak, Auth0, or Okta

One gotcha bites almost everyone using basic auth: set HERMES_DASHBOARD_BASIC_AUTH_SECRET to a stable value (openssl rand -base64 32). Sessions are stateless signed tokens, and without a fixed secret the signing key regenerates on every restart, which logs you out every time the process bounces.

To verify what you actually deployed, the status endpoint is deliberately public:

curl -s http://<host>:9119/api/status | jq '.auth_required, .auth_providers'

If auth_required is not true on a reachable host, stop and fix the bind before doing anything else.

What is the best way to reach the dashboard remotely?

The official recommendation is to not expose it at all: keep the loopback bind and tunnel in. Here is how the four sane options compare:

Path	Effort	The trade
SSH tunnel (`ssh -L 9119:127.0.0.1:9119 user@host`)	One command	Ephemeral; re-run it every session
Tailscale	Install once, then loopback stays private	Best default for phones and laptops; needs the tailnet on every device
Reverse proxy + OAuth/OIDC + TLS	Most setup	The only correct shape for a truly public URL; set `HERMES_DASHBOARD_PUBLIC_URL`
Hermes Desktop remote gateway	Install the app, point it at `http://<host>:9119`	Native app comfort; the server keeps running a dashboard or headless `hermes serve`

A nice defensive detail: declaring a non-loopback HERMES_DASHBOARD_PUBLIC_URL engages the auth gate even when the backend itself binds loopback behind a proxy, so a half-finished reverse-proxy setup fails closed instead of open.

How do you run the web UI in Docker?

Docker is the cleanest self-host path to an always-on dashboard, and it is where the auth rules stop being optional, because the container binds 0.0.0.0 by default so published ports work. One-time setup, then the long-running gateway with the dashboard enabled:

mkdir -p ~/.hermes
docker run -it --rm -v ~/.hermes:/opt/data nousresearch/hermes-agent setup

docker run -d --name hermes --restart unless-stopped \
  -v ~/.hermes:/opt/data \
  -p 8642:8642 -p 9119:9119 \
  -e HERMES_DASHBOARD=1 \
  -e HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin \
  -e HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=change-me \
  -e HERMES_DASHBOARD_BASIC_AUTH_SECRET="$(openssl rand -base64 32)" \
  nousresearch/hermes-agent gateway run

HERMES_DASHBOARD=1 enables the dashboard as a supervised service inside the image (s6 restarts it if it crashes), and without an auth provider the dashboard fails closed at startup rather than serve an open admin panel: the gateway keeps running, and docker logs names the missing env var. The volume matters more than anything else here: /opt/data holds your .env, config.yaml, sessions, memories, and skills. Lose the mount and you lose the agent's state. The official docs include a full Compose example, and one hard rule: never run two gateway containers against the same data directory.

For the full container walkthrough, including updates and backups, see our Hermes Docker guide.

What if you want the web UI without the server work?

Honest framing first: Hermes agent and every UI above are free, open-source software. What you pay for is model tokens plus somewhere always-on to run the agent, and the ongoing ops: auth, patches, backups, and the 3 a.m. restart. We wrote up the DIY numbers in our VPS guide for Hermes; a capable box typically lands around $5 to $12/mo before your time.

Two managed routes skip the ops entirely:

Agent37 runs your Hermes agent in an isolated container and puts a browser console on top: a task board, a real TTY web terminal, a visual file browser, a live Linux desktop you can watch the agent work in, scheduled jobs, and 1,000+ app integrations via Composio. Runtime updates and security patches roll out automatically, so the June-2026 class of exposed-dashboard problem is not your problem. Basic is $3.99/mo (1 vCPU, 4 GB RAM, 8 GB disk, bring your own API keys), and Plus at $9.99/mo adds bundled models (GPT-5.6 Luna, DeepSeek V4 Flash, Mercury 2) with usage capped per rolling 5-hour window and per week. Fair warning: Basic ships with community support only; email and chat support start on Pro. That trade is part of why the entry price is $3.99. Deploy a Hermes instance in one click and it answers from WhatsApp, Telegram, iMessage, Discord, or Slack while your laptop sleeps.

Nous Hermes Cloud is the first-party option at portal.nousresearch.com/cloud: a dedicated hosted instance with its own dashboard opened from the Nous Portal, in-browser chat included. The Medium instance is $0.56/day running and $0.03/day stopped, with a $2 credit minimum (or an active Nous Portal subscription) to deploy; inference and tool usage bill separately on top. The gaps to know: the cloud page lists only Telegram, Discord, Slack, Email, and CLI as surfaces (no WhatsApp), and the agent's files live in its cloud workspace, not on your machines.

If you mostly want to poke at the dashboard, self-host free on your laptop. If you want the agent reachable all day from your phone with a UI you did not have to secure, managed is the cheaper path once you price in your own hours.

Frequently asked questions

Is the Hermes agent web UI the same as the Hermes dashboard?

Yes. The official name in the Nous Research docs is the Hermes Web Dashboard, launched with hermes dashboard. "Web UI" and "dashboard" refer to the same thing; the community projects (hermes-webui, Hermes Workspace) are separate.

What port does the Hermes agent web UI use?

The official dashboard uses 9119. Port 8642 is the separate OpenAI-compatible API server. The community hermes-webui defaults to 8787 and Hermes Workspace to 3000.

Do I need extra packages for the web UI?

Yes: the web extra (FastAPI + Uvicorn) for the dashboard and pty for the Chat tab. Install both with uv pip install -e ".[web,pty]" from the Hermes agent directory. Running hermes dashboard without them tells you what is missing.

Can I open the Hermes web UI from my phone?

Yes, but not by binding it to the public internet unprotected (the server will refuse anyway). Put the box and your phone on Tailscale and open http://<tailscale-ip>:9119, or use Nous Portal OAuth for a properly public URL. The community hermes-webui and a managed console like Agent37's are the phone-friendliest options.

Is Hermes Desktop the same as the web UI?

No. Desktop is a free native app for macOS, Windows, and Linux. It can attach to a remote backend over port 9119 (Settings, then Gateways, then Remote gateway), which makes it an alternative front end to the same agent the web UI manages.

Does the web UI work on Windows?

The management pages do. The embedded Chat tab needs a POSIX terminal, so on native Windows it shows a banner directing you to WSL2. Everything works normally inside WSL2.

How much does the Hermes agent web UI cost?

The software is free and MIT-licensed. Self-hosting costs a VPS (roughly $5 to $12/mo) plus your ops time, and model usage is billed by your provider either way; see is Hermes agent free for the full cost breakdown. Managed Hermes with a console included starts at $3.99/mo on Agent37, always-on and deployed in one click.

Hermes Agent Web UI: Setup, Security, and Managed Alternatives (2026)