Hermes Agent Dashboard: How to Open & Use It (2026)

Do not index

The Hermes agent dashboard (officially the Hermes Web Dashboard) is the browser admin panel that ships inside the open-source Hermes agent from Nous Research. Run hermes dashboard and it opens at http://127.0.0.1:9119, no login needed on your own machine; bind it to anything past localhost and a mandatory auth gate switches on. It manages configuration, API keys, sessions, channels, skills, MCP servers, webhooks, cron jobs, memory, logs, and analytics from one tab. And if you want all of that reachable 24/7 without babysitting a server, Agent37 runs the whole Hermes stack always-on from $3.99/mo.

This guide covers what the dashboard actually does, the launch flags worth knowing, the login rules that trip people up on a VPS, a tour of every tab, and the honest math on keeping it running around the clock.

What the hermes agent dashboard actually is

The dashboard is not a separate product. It ships with the agent itself: a FastAPI and Uvicorn backend serving a React frontend, started by one CLI command. Nous's docs describe it as the "browser-based administration panel for managing configuration, API keys, MCP servers, messaging pairing, webhooks, the gateway, memory, credentials, sessions, logs, analytics, cron jobs, and skills."

It grew up fast in 2026. The v0.16 "Surface" release (June 2026) turned it from a status page into a full admin panel with in-browser chat and point-and-click channel, MCP, and credential management. v0.17 unified it into a single machine-level dashboard with a profile switcher and the Profile Builder. As of v0.21.3 (September 14, 2026), it is the default way most people operate Hermes without memorizing CLI flags.

One naming note: the docs say "web dashboard," not "web UI," but both names point at the same thing. If you have seen community projects like hermes-webui (port 8787) or Hermes Workspace (port 3000), those are different tools; more on that below.

How to open the dashboard

If Hermes is installed with the web extras (from source that is uv pip install -e ".[web,pty]"; the pty half powers the Chat tab), one command does it:

hermes dashboard

That starts the server and opens http://127.0.0.1:9119 in your browser. The docs are explicit that in this default mode nothing leaves your machine.

The flags that matter:

Flag	What it does
`--port`	Change the port (default 9119; 0 lets the OS pick)
`--host`	Change the bind address (default 127.0.0.1; anything else triggers the auth gate)
`--no-open`	Skip auto-opening a browser (servers, SSH sessions)
`--isolated`	Per-profile server instead of the unified machine-level one
`--skip-build`	Serve the existing frontend build without rebuilding
`--stop` / `--status`	Stop or list running dashboard/serve processes

Two related commands: hermes serve runs the same server headless (it is what Hermes Desktop and remote backends use, and it never opens a browser), and hermes dashboard register provisions a Nous Portal OAuth client for a self-hosted dashboard you plan to expose.

First launch builds the frontend automatically when npm is available. If you instead see "Web UI npm install failed," run the fix it prints: npm install --workspace web && npm run build -w web from the Hermes source directory. hermes update rebuilds the frontend on every update, and if a build fails when an older build exists, the dashboard serves the stale build rather than dying.

A tour of the tabs

This is what you actually get for that one command, grouped by job:

Watching the agent. Status shows the agent version, gateway state and PID, connected platforms, and active plus recent sessions, refreshing every 5 seconds. It also raises resource-pressure banners when memory or disk run low, and flags a suspected OOM kill from the previous boot, which on a small VPS is often the first honest answer to "why did my agent die overnight?" Sessions, Logs (with per-level filtering), and Analytics cover the history.

Talking to it. The Chat tab embeds the full Hermes terminal UI in the browser over a PTY and WebSocket, rendered with xterm.js. You can resume any session by ID. It needs a POSIX PTY, so native Windows shows a banner; WSL2 works.

Configuring it. Config is a form editor over config.yaml. API Keys, Skills, MCP, Webhooks, Pairing, and Channels give you point-and-click management of the things that used to require editing YAML and rereading docs. Profiles hosts the Profile Builder, which assembles an agent's identity, model, skills, and MCP servers in one flow.

Operating the box. System shows host stats and runs update checks and applies them from the browser.

You can also skin and extend it without forking: drop YAML themes into ~/.hermes/dashboard-themes/, plugin bundles into ~/.hermes/plugins/<name>/dashboard/, and persist choices via the dashboard.theme and dashboard.font config keys.

Is there a hermes dashboard login?

On your own machine, no. Bound to 127.0.0.1 (the default), the dashboard has no login page and no account requirement.

The moment the bind host is anything other than 127.0.0.1, ::1, or localhost, an auth gate engages, and it fails closed: with no auth provider configured, hermes dashboard refuses to start rather than serving an open admin panel to the network. The startup error spells out your two options: set a username and password (dashboard.basic_auth in config.yaml, or the HERMES_DASHBOARD_BASIC_AUTH_USERNAME, HERMES_DASHBOARD_BASIC_AUTH_PASSWORD_HASH, and HERMES_DASHBOARD_BASIC_AUTH_SECRET environment variables) or register an OAuth provider (Nous Portal via hermes dashboard register, or your own OIDC server). The docs are blunt that password auth is for trusted networks like a Tailscale mesh, not the open internet; internet-facing dashboards should use OAuth or OIDC.

If you read an older guide claiming --insecure or HERMES_DASHBOARD_INSECURE=1 bypasses all this: both have been no-ops since the June 2026 hardening. Unauthenticated public dashboards were the entry point for the June 2026 MCP-config persistence attacks, where scanners found exposed dashboards and used them to plant backdoors, so Nous removed the bypass entirely. Our Hermes agent web UI guide walks the full security setup, including the session-secret gotcha that logs you out on every restart.

Reaching it on a server or in Docker

On a VPS, the sane pattern is to leave the dashboard on loopback and tunnel to it:

ssh -L 9119:localhost:9119 you@your-server

Then open http://127.0.0.1:9119 locally. Tailscale gives you the same result without the per-session command. If you must bind publicly, configure a provider first and verify the gate is actually on: curl -s http://YOUR_IP:9119/api/status should report auth_required: true. There is also a native app path: Hermes Desktop can attach to a remote gateway on port 9119 from Settings, Gateways, Remote gateway.

In Docker, the dashboard is opt-in: set HERMES_DASHBOARD=1 and publish port 9119 next to the gateway's 8642, with ~/.hermes mounted to /opt/data so config and sessions persist. Inside the official image the dashboard binds 0.0.0.0 by necessity, so the auth gate always engages there: supply auth env vars or the service fails closed. The full container setup, compose file, and update flow live in our Hermes Docker guide.

Dashboard vs Desktop vs Hermes Workspace vs web UI

Four names, four different things:

Name	What it is	Port
Hermes Web Dashboard	Official browser admin panel, ships with the agent	9119
Hermes Desktop	Official native app (Electron); runs its own backend, never needs the dashboard	n/a
Hermes Workspace	Third-party community web command center by outsourc-e	3000
hermes-webui	Third-party community chat UI by nesquena	8787

Port 8642, which you will also see in configs, is the gateway's OpenAI-compatible API and health endpoint, not a UI. If you are untangling the workspace terminology specifically (the product, the working directory, and the dashboard get conflated constantly), our Hermes Workspace explainer maps all three meanings.

The always-on catch

Here is the part every dashboard tutorial skips: the dashboard is only as alive as the machine under it. Close your laptop and the gateway, the cron jobs, the channels, and the dashboard all go down with it. So "where do I run the dashboard?" is really "where does Hermes live 24/7?", and you have three honest options. The baseline math is the same on every path: the agent itself is free software, so your real bill is model API usage plus somewhere always-on to run it.

DIY VPS. Full control, and you own the ops loop: provisioning, hardening, tunneling into the dashboard, updates, and the 2 a.m. OOM kill the Status banner warned you about. Our best VPS for Hermes guide has current, verified prices; budget more than the old "$5/mo box" folklore suggests, because 2026 price hikes hit the cheap tiers hard.

Nous Hermes Cloud. Nous's own hosted agents, billed daily from prepaid credit ($0.56/day for a running Medium agent, $0.03/day stopped, with a $2 credit minimum). Simple, first-party, and metered; you are paying per day for compute, with inference billed separately.

Managed hosting. Agent37 runs hosted Hermes instances starting at $3.99/mo (1 vCPU, 4 GB RAM, 8 GB disk; you bring your own model keys, so model usage is billed by your provider) with the agent always-on and managed from a browser console: task board, full web terminal, file browser, live Linux desktop, and scheduled jobs, plus automatic runtime and security updates. Deploys in one click; fair warning, at these prices support is an AI bot first, not a human. For products embedding agents, the Cloud API's agent37-hermes template starts at $1.99/mo per instance.

If the dashboard is the reason you are setting all this up, weigh what you actually want from it: a control surface. A managed console gives you that on day one, with none of the tunnel-and-auth setup above.

Frequently asked questions

What port does the hermes agent dashboard use?

9119 by default; change it with hermes dashboard --port <n>. Port 8642 is the gateway's API and health endpoint, a different service entirely.

Why does the dashboard refuse to start on my VPS?

You bound it past localhost without an auth provider. Since June 2026 that fails closed by design. Either keep it on 127.0.0.1 and SSH-tunnel in, or configure password or OAuth auth before binding publicly.

How do I fix "Web UI npm install failed"?

Run the printed fix from the Hermes source directory: npm install --workspace web && npm run build -w web, then relaunch hermes dashboard. If a previous build exists, the dashboard keeps serving it in the meantime.

Is the dashboard the same as Hermes Desktop?

No. Hermes Desktop is a native app that runs its own bundled backend and never needs the web dashboard, though it can attach to a remote one. The dashboard is the browser panel on port 9119.

Can I open the dashboard from my phone?

Yes, the practical route is Tailscale: join the server and your phone to the same tailnet and open the dashboard in a mobile browser. A public bind with OAuth works too, but only bother if others need access.

Does Agent37 give me the hermes agent dashboard?

Agent37's hosted Hermes comes with its own browser console (terminal, files, live desktop, scheduled jobs) that covers the same jobs, with the instance always-on from $3.99/mo. You skip the tunnel, the auth gate, and the update loop entirely.

Hermes Agent Dashboard: What It Is and How to Use It (2026)