
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
hermes-web-ui
Advanced tools
Self-hosted AI chat dashboard for Hermes Agent β multi-model web UI with multi-platform integration
Hermes Web UI δΈζ
A full-featured web dashboard for Hermes Agent.
Manage AI chat sessions, monitor usage & costs, configure platform channels,
schedule cron jobs, browse skills β all from a clean, responsive web interface.
npm install -g hermes-web-ui && hermes-web-ui start
/chat-run; API Server runs consume Hermes Gateway streaming responses~/.hermes/auth.json credential poolUnified configuration for 8 platforms in one page:
| Platform | Features |
|---|---|
| Telegram | Bot token, mention control, reactions, free-response chats |
| Discord | Bot token, mention, auto-thread, reactions, channel allow/ignore lists |
| Slack | Bot token, mention control, bot message handling |
| Enable/disable, mention control, mention patterns | |
| Matrix | Access token, homeserver, auto-thread, DM mention threads |
| Feishu (Lark) | App ID / Secret, mention control |
| QR code login (scan in browser, auto-save credentials) | |
| WeCom | Bot ID / Secret |
~/.hermes/.env~/.hermes/config.yaml~/.hermes/auth.json)/v1/models)/v4).tar.gz)AUTH_TOKEN env var)AUTH_DISABLED=1npm install -g hermes-web-ui
hermes-web-ui start
Automatically installs Node.js (if missing) and hermes-web-ui on Debian/Ubuntu/macOS:
bash <(curl -fsSL https://raw.githubusercontent.com/EKKOLearnAI/hermes-web-ui/main/scripts/setup.sh)
bash <(curl -fsSL https://raw.githubusercontent.com/EKKOLearnAI/hermes-web-ui/main/scripts/setup.sh)
hermes-web-ui start
WSL auto-detects and uses
hermes gateway runfor background startup (no launchd/systemd).
Single-container deployment with integrated Hermes Agent:
# Use pre-built image (Recommended)
WEBUI_IMAGE=ekkoye8888/hermes-web-ui docker compose up -d
# Or build from source
docker compose up -d --build
docker compose logs -f hermes-webui
./hermes_data./hermes_data/hermes-web-ui/.tokendocker-compose.ymlFor detailed notes and troubleshooting, see docs/docker.md.
These variables configure Hermes Web UI itself. Provider API keys and Hermes Agent settings are managed separately through Hermes profiles.
| Variable | Default | Description |
|---|---|---|
PORT | 8648 | Web UI listen port. |
BIND_HOST | 0.0.0.0 | Web UI bind host. Set :: explicitly for IPv6. |
HERMES_WEB_UI_HOME | ~/.hermes-web-ui | Web UI data home for auth token, credentials, logs, DB, and default uploads. HERMES_WEBUI_STATE_DIR is also supported as a compatibility alias. |
UPLOAD_DIR | $HERMES_WEB_UI_HOME/upload | Upload directory override. |
CORS_ORIGINS | * | Koa CORS origin setting. |
AUTH_DISABLED | unset | Set to 1 or true to disable Web UI auth. |
AUTH_TOKEN | auto-generated | Explicit bearer token. If unset, Web UI creates one under HERMES_WEB_UI_HOME. |
PROFILE | default | Initial Hermes profile name. |
LOG_LEVEL | info | Server log level. |
BRIDGE_LOG_LEVEL | $LOG_LEVEL or info | Bridge log level. |
MAX_DOWNLOAD_SIZE | 200MB | Maximum file download size. |
MAX_EDIT_SIZE | 10MB | Maximum editable file size. |
WORKSPACE_BASE | /opt/data/workspace | Base directory for workspace browsing. |
GATEWAY_HOST | 127.0.0.1 | Default gateway host written into profile config. |
HERMES_WEB_UI_STOP_GATEWAYS_ON_SHUTDOWN | environment-dependent | Whether Web UI shutdown also stops managed gateways. |
| Command | Description |
|---|---|
hermes-web-ui start | Start in background (daemon mode) |
hermes-web-ui start --port 9000 | Start on custom port |
hermes-web-ui stop | Stop background process |
hermes-web-ui restart | Restart background process |
hermes-web-ui status | Check if running |
hermes-web-ui update | Update to latest version & restart |
hermes-web-ui upgrade | Alias for update |
hermes-web-ui -v | Show version number |
hermes-web-ui -h | Show help message |
update / upgrade first attempt npm cache clean --force, then run npm install -g hermes-web-ui@latest and restart. Cache cleanup is best-effort; if it fails, the updater continues with the install.
On startup the BFF server automatically:
~/.hermes/config.yaml and fills missing api_server fieldsconfig.yaml.bak if modifiedgit clone https://github.com/EKKOLearnAI/hermes-web-ui.git
cd hermes-web-ui
npm install
npm run dev
npm run build # outputs to dist/
See DEVELOPMENT.md for project development guidelines.
Browser β BFF (Koa, :8648) β Hermes Gateway (:8642)
β
Hermes CLI (sessions, logs, version)
β
~/.hermes/config.yaml (channel behavior)
~/.hermes/auth.json (credential pool)
Tencent iLink API (WeChat QR login)
The frontend is designed with multi-agent extensibility β all Hermes-specific code is namespaced under hermes/ directories (API, components, views, stores), making it straightforward to add new agent integrations alongside.
The BFF layer handles API proxy (with path rewriting), SSE streaming, file upload and download (multi-backend: local/Docker/SSH/Singularity), session CRUD via CLI, config/credential management, WeChat QR login, model discovery, skills/memory management, log reading, and static file serving.
Frontend: Vue 3 + TypeScript + Vite + Naive UI + Pinia + Vue Router + vue-i18n + SCSS + markdown-it + highlight.js
Backend: Koa 2 (BFF server) + node-pty (web terminal)
FAQs
Self-hosted AI chat dashboard for Hermes Agent β multi-model web UI with multi-platform integration
The npm package hermes-web-ui receives a total of 28,609 weekly downloads. As such, hermes-web-ui popularity was classified as popular.
We found that hermes-web-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.