Guides
Dashboard
The dashboard is the operator’s view of every agent: what they are doing, what they visited, what they filled from the vault, and what they need from you. Turn it on with --admin. It is served on the same host and port as MCP, at http://127.0.0.1:9876/.
--admin requires --transport http.
Signing in
Section titled “Signing in”On the first start with --admin, BrowserHive generates a 24-character password, prints it once in the startup banner, and writes it to <data-dir>/admin/credentials.txt (mode 0600). Sign in with it; you must choose a new password (12 to 256 characters) before anything else is reachable. The seed file is then overwritten and deleted.
Lost the password? Stop the server and run browserhive admin reset-password.
A dashboard session expires after 15 minutes of inactivity or 8 hours in total. Watching a live view counts as activity. When it expires the dashboard sends you back to the login page.
Layout and keyboard
Section titled “Layout and keyboard”A sidebar lists the pages (collapsed to icons on medium screens, a drawer on phones). The header shows connection health and notifications.
| Key | Action |
|---|---|
| ⌘K / Ctrl+K | Command palette: pages, sessions, actions |
| ⌘B / Ctrl+B | Toggle the sidebar |
/ |
Focus the page’s filter |
? |
Keyboard shortcuts |
| Esc | Close the topmost overlay |
j / k, Enter |
Move through and open table rows |
Theme follows the system, or pick light or dark. Filters, sorting and pagination live in the URL, so any view can be bookmarked or shared.
Overview
Section titled “Overview”Fleet health over 24 h, 3 d, 7 d, 14 d or 30 d: live sessions, sessions and tool calls in the window (with sparklines), open attention requests, errors with the error rate, active live views, and blocked URLs. The activity chart shows calls per bucket with errors stacked; click a bar to open the sessions of that time slice. Below it, a live feed of websites visited, the most frequent recent failures, and Harnesses: sessions and tool calls per agent in the window, with Unknown always listed; click one to see its sessions.
Sessions
Section titled “Sessions”Every session, live and finished. Filter by state (live, closed, archived), owner, channel, persistence mode and harness (the agent that launched the session, see Harness identity); search by slug or id; sort by any column. Columns show the last URL, calls and errors, blocked attempts, the agent (harness, with the workspace or model when declared), the lease countdown and the state (including “needs attention” and “being watched”). Select rows to archive, unarchive or delete in bulk. Deleting names exactly what is erased: events, trace, screenshots, profile and downloads, terminating live sessions first.
Session detail
Section titled “Session detail”The header shows the session id, state and actions: terminate, open the trace viewer, download trace.zip, archive, delete. When the agent is waiting on you, a banner shows the attention request or pending vault confirmations. A side rail lists owner, channel, headless or headed, persistence, current URL, lease and identity. The Client panel shows the harness and how it was recognised, the declared model (“not reported” when none), the workspace, the client’s name, version and protocol, and any extra labels it sent. The Session panel shows the browser with its real version and whether it ran inside Chromium’s sandbox. Both are recorded when the browser launches, so a closed session still shows them. A session from before this was recorded (BrowserHive 0.1.x) shows not recorded, which does not mean the sandbox was off; a session whose browser never started shows not launched.
Tabs:
- Live. The screencast of the agent’s browser. Controls: start/stop, stream size (fit, 720p, 1080p, native; per viewer), Resize agent browser (changes the agent’s real viewport), fullscreen. While an attention request is open for this session you can take over: mouse, wheel, keyboard and touch input go to the page. Outside that window input is refused. See Human takeover.
- Timeline. Every tool call with parameters, result, duration, error code and screenshot, plus navigations, vault access, blocked URLs and attention requests. Filter by kind, follow live, expand rows. When telemetry is on, each call shows its
trace_idand, with--otelTraceUrlTemplate, a link into your tracing backend. - Vault. This session’s vault access log and pending confirmations.
- Identity. What the browser presents to websites: user agent, client-hint brands, platform, Chrome version, locale, timezone, screen and viewport, and whether fingerprinting and humanized input are on. See Stealth.
- Files. Data directory path,
trace.zipwith size, download, and Open trace viewer (Playwright Trace Viewer with DOM snapshots, network and console, served by BrowserHive), screenshots, downloads, and the command to open the trace locally.
Attention
Section titled “Attention”The human-in-the-loop queue. Each pending request shows the agent’s reason, the mode (takeover or notify), how long the agent has waited, any options it attached, and a message box. Resolve or Reject sends your message back to the agent; Open live & take over jumps to the live view. Below the queue, the history of settled requests with outcome, wait time and who resolved them.
Websites
Section titled “Websites”Every URL any agent visited, with the most visited domains, category tags for non-public destinations (IP addresses, local hosts, FTP), and filters by session, domain and time window.
Blocklist
Section titled “Blocklist”The loaded rules and how often each one fired, lines in the file that do nothing (duplicates, refused patterns), attempts by source (tool boundary or network), sessions affected and top domains. Reload blocklist re-reads the file without a restart. When no blocklist is configured the page explains how to add one.
Available with --vault bitwarden.
- Status and unlock: lock state, unlock by pasting a session token from
bw unlock --raw(the dashboard never asks for your master password), sync. - Confirmations: fills waiting for your approval, with the requesting session, target URL and tool. Approve, or deny with a reason recorded in the audit log only.
- Origin tester: type a URL and see which entries would fill there.
- Folders: each vault folder has a policy (manual, allow all, reject all) and folder-wide flags.
- Bindings: per entry, the allowed origins, authorized sessions and flags.
Details in the vault guide.
Vault log
Section titled “Vault log”The audit trail of every vault_fill and denied listing: time, entry, result, origin check, whether evaluate was enabled, session and page URL. Filterable. It never contains secrets.
A live tail of the server log with level, module, session and trace filters, pause-on-scroll, and NDJSON export. Change the log level at runtime from the System page.
System
Section titled “System”Version, transport, uptime, bind address, sessions live versus the cap, open attention requests, live views, dashboard connections, default persistence, whether evaluate is allowed, vault backend, blocklist, retention, database size and schema version, telemetry endpoint and data directory. A stealth section shows the stealth level, driver, fingerprint and humanize defaults and CAPTCHA mode. Browsers and sandbox lists the browsers found on the machine (the bundled Chromium, an installed Google Chrome or Microsoft Edge) with version and path, marks the default one, and shows for each whether it runs inside Chromium’s sandbox, with Chrome’s own reason when it cannot. MCP connections lists the agents connected over MCP, live ones first, then recent ones; select one to see how its harness was recognised, its model and workspace, client and protocol, User-Agent, IP, any conflicting signals and extra labels. Public address shows publicUrl and whether it reaches this BrowserHive (see public address), with Check again. A session’s Details tab shows its browser version and whether that session ran sandboxed, for live and closed sessions alike. Banners warn when evaluate is enabled together with the vault, when disk space is low, or when a subsystem is degraded. The configuration table lists every effective setting with its source (cli, file, env, default, derived) and the values it shadowed; secrets are shown as redacted. A value the config file reads from an environment variable has a $NAME chip under its source (outlined when the variable was not set and the default is used); select it to see the value as written in the file, or, for a secret, just the variable. Only values from references narrows the table to those keys, and the filter also matches variable names. See References.
Notifications
Section titled “Notifications”Persisted notifications for attention requests, tool errors, crashed sessions and pending vault confirmations, grouped by day. Mark as read or dismiss, individually or all at once. Once an attention request or vault confirmation is settled (in the dashboard, by a timeout, or elsewhere), its row keeps its place and shows the outcome as a small pill (resolved, expired, or closed when the agent stopped waiting), and a toast still on screen for it closes. See Notifications.
Channels (Notifications → Channels) sends notifications to your phone through Telegram, Discord (webhook or bot), ntfy or a webhook: one card per channel with its status, last delivery, 24-hour counts and, when act buttons are on, whether answers from the chat reach BrowserHive; and an Add channel wizard with a live preview and a test message. Its What to send step switches Answer from the chat on and edits who may answer, and its Reports section sets a daily or weekly digest, the channel’s time zone and the anomaly alerts; a card shows the next digest and Send now (a preview of the real digest, then a send on demand). The delivery log marks a digest sent after downtime as late. Delivery log lists every send, edit and delete, and says why anything was not sent. Actions lists every press of an act button: who, which button, from which chat, and what happened. Reports keeps every digest and anomaly alert once per period (the inbox’s Reports chip shows the same), opens each as a page with its facts, chart and tables, and has Reports in BrowserHive: a digest and anomaly alerts for the dashboard itself, with no channel needed. See Channels, Answer from your phone and Reports in BrowserHive.