Hermes Agent web UI and dashboard: which is which, on a server

Which is which

They can run side by side: both read and write the same Hermes home. A third route, Hermes’s own OpenAI-style API server, is covered at the end.

Hermes’s dashboard

Nous’s dashboard docs describe it as a way to “configure settings, manage API keys, and monitor sessions from a clean web interface” instead of editing YAML. Its pages cover the config file, the keys in ~/.hermes/.env, sessions, logs, cost, scheduled jobs, skills, MCP servers, messaging channels and pairing, and updates and backups. “The Chat tab embeds the full Hermes TUI”, so chatting there is the terminal interface, not a chat app.

It is part of every install. hermes dashboard starts it in the foreground and tries to open a browser; on a server add --no-open, and keep it in tmux or a service if it should outlive your login. hermes dashboard --status lists running dashboards and --stop stops them.

Ask it to listen on any other address and, as of Hermes v0.22.0, it refuses unless a sign-in method is configured:

$ hermes dashboard --host 0.0.0.0 --no-open
Refusing to bind dashboard to 0.0.0.0 — the auth gate engages on non-loopback binds (0.0.0.0), but no auth providers are registered.

Run in a terminal, it offers to set one up on the spot. There are three: a username and password, which Nous says to “Use it only on a trusted network or behind a VPN — not for public-internet exposure”; sign-in with a Nous Portal account; and your own OpenID Connect provider. Nous names the last two as the ones suitable for internet-facing use. The address Tailscale gives a machine counts as “anywhere else” too, so binding the dashboard to it needs a sign-in method as well.

The rule dates from the summer. In June 2026, scanners found Hermes dashboards and API servers open to the internet and used them to plant a config entry that added an attacker’s SSH key, which Hermes then re-ran at every start and every scheduled tick. Nous’s fix calls the root cause “operator misconfiguration, NOT a vulnerability in Hermes”: the machines ran as root, with an exposed API server or a dashboard started with the old --insecure flag. Since v0.18.0 that flag does nothing. Keeping Hermes updated matters for the loopback default as well: before 0.16.0, CVE-2026-53869 let a malicious web page reach even a local dashboard’s terminal through DNS rebinding.

Hermes WebUI

Hermes WebUI is what most searches for “Hermes webui” turn up: a browser chat app with tool-call cards, file attachments, a workspace file browser that can edit files, sessions you can tag and export, panels for scheduled tasks, skills and memory, and a layout that works on a phone. It does not talk to Hermes over a network. It imports Hermes’s own code and runs the agent itself, from your Hermes home, so Hermes has to be installed on the same machine, and its maintainers advise upgrading the two together.

With Hermes already installed:

git clone https://github.com/nesquena/hermes-webui.git
cd hermes-webui
python3 bootstrap.py --no-browser --skip-agent-install

Without --skip-agent-install, the script installs Hermes for you if it cannot find it. On a server with Hermes in place, it started in about five seconds, ran under Hermes’s own Python, and printed the tunnel command to use. A clone of the repository runs its experimental line (the server reported exp-v0.52.479); its :latest Docker image is the stable one. ./ctl.sh start, status, logs and stop run it in the background.

Its password is off by default (“zero friction for localhost”, in the README) and set with HERMES_WEBUI_PASSWORD or in its settings. Unlike the dashboard, it does not stop you binding it to a public address without one. It prints a warning that “Anyone on the network can access your filesystem and agent” and keeps running. Its server identifies itself as HermesWebUI, and a search on that header found roughly 5,900 scan events in a month (sightings, not distinct machines), according to a July 2026 Hunt.io report cited by The Hacker News.

On a shared server, the local address is not private

“Only on 127.0.0.1” keeps a page off the internet, not away from the other people and programs on the same machine. Both apps showed this on a test server, where each was started by one account and probed from another:

• The dashboard guards its sensitive endpoints with a session token, but on the local address the token is written into the page it serves, so the page can use it. Fetching that page from the other account and sending the token back, a request to reveal a stored API key returned the key (a made-up one, for the test). On the local address it asks for no login unless dashboard.public_url names an outside address, which turns its sign-in on for every request.
• Hermes WebUI says so itself at startup: “No password set. Any process on this machine can read sessions and memory via the local API.” From the other account, /api/memory returned the memory file. With HERMES_WEBUI_PASSWORD set, the same request got 401, “Authentication required”.

On a machine only you use, that is the same exposure as the .env file itself. On one other people log in to, set the WebUI’s password even on the local address, and either run the dashboard only while you are using it, then hermes dashboard --stop, or give it a sign-in through one of the Tailscale routes below.

Opening them from a laptop or a phone

From a laptop, an SSH tunnel needs no login on either app and exposes nothing. It forwards a port on your laptop to the server’s local address:

# from your laptop: the dashboard, then open http://localhost:9119
ssh -N -L 9119:127.0.0.1:9119 you@your-server

# Hermes WebUI, then open http://localhost:8787
ssh -N -L 8787:127.0.0.1:8787 you@your-server

The dashboard checks the hostname each request arrives with: a request carrying localhost, which is what a tunnel sends, was answered, and one carrying any other name got 400 “Invalid Host header”. So putting a reverse proxy in front of it fails unless you declare the proxy’s address as dashboard.public_url, and declaring one turns the sign-in requirement on. If Tailscale SSH is how you reach the server, the tunnel works over it the same way. Hermes Desktop can also open the tunnel itself: its remote connections include “A Hermes install reached over SSH”.

From a phone, a tunnel is awkward, so the route is Tailscale with a password. For Hermes WebUI, its remote-access guide keeps the app on the local address, sets HERMES_WEBUI_PASSWORD, and runs tailscale serve --bg 8787, which gives it an HTTPS address reachable only from devices on your Tailscale network. For the dashboard, set its username and password, then either bind it to the machine’s Tailscale address (--host that address) or put Tailscale Serve in front and set that HTTPS address as dashboard.public_url. Either way the password is required, and Nous’s password option is for exactly this kind of private network.

Two things to avoid on a rented server. Binding either app to 0.0.0.0 also binds it to the public address, so it is reachable from the internet unless a firewall stops it; check what is listening. And in Docker, a plain -p 9119:9119 publishes on every address: Docker’s own docs say “Publishing container ports is insecure by default”, and on Ubuntu its rules route that traffic before ufw’s rules apply. Write -p 127.0.0.1:9119:9119 instead. Nous’s Docker image runs the dashboard on 0.0.0.0 inside the container when HERMES_DASHBOARD=1 is set, so there it needs a sign-in method before it will start.

The API server, and chat apps built on it

Hermes can also present itself as an OpenAI-compatible endpoint, so any chat front end that speaks that format can use it: Nous documents Open WebUI, and the community’s Hermes Workspace uses it with the dashboard. It runs inside the gateway on 127.0.0.1:8642, switched on with API_SERVER_ENABLED. The API server docs warn that it “gives full access to hermes-agent’s toolset, including terminal commands”, and it requires an API_SERVER_KEY even on the local address. Since the June fix the key must be at least 16 characters (one docs page still says 8); openssl rand -hex 32 makes one. An exposed API server was the other half of the June campaign, so it stays on the local address, reached the same ways as the two apps above.

Of the other front ends, Hermes Workspace refuses to listen beyond the local address without its HERMES_PASSWORD. Ekko Studio, previously named Hermes Web UI and still installable as the hermes-web-ui package, is a different app from the one above; its README gives default credentials of admin / 123456, so change them on first login.