---
title: "Web interface"
---

# Web interface

Run the CLI's agent in a browser on your own machine with neuralinverse web, sign in with a one-time link, and understand how the local web interface is secured.

`neuralinverse web` starts the CLI's [local server](https://neuralinverse.com/docs/cli/sdk/#the-local-server) with a browser interface and opens it, already signed in. The interface is served by the same process, from files built into the CLI; it makes no requests to other hosts.

```bash
neuralinverse web                         # 127.0.0.1:7420, root = current folder
neuralinverse web --root ~/src --port 0   # any free port, sessions anywhere under ~/src
neuralinverse web --no-open               # only print the sign-in link
neuralinverse serve --web                 # the same server, without opening a browser
```

`web` accepts every `serve` option (`--root`, `--port`, `--mode`, `--model` and others).

## What it offers

- **Sessions:** open sessions and saved sessions to resume, per root folder. *New session* picks a folder (limited to the server's roots), a model and a permission mode.
- **Chat:** streaming Markdown, collapsible thinking, and tool cards with live output, full input and output on expand, and inline diffs.
- **Approvals:** permission requests (with diff previews and "always allow" rules), questions and plan reviews open as dialogs. A countdown shows when an unanswered request will be denied.
- **Composer:** multi-line input, `@` to mention workspace files, paste or drop images, send while the agent works to queue the prompt, *Stop* to interrupt.
- **Header:** a model picker grouped by provider with context window, price per million tokens and vision and reasoning badges; a permission mode switch.
- **Panels:** the agent's plan and background tasks; changed files with a diff viewer (unified or side by side).
- **Status bar:** connection state, context used, tokens in and out, estimated cost.
- **Keyboard:** `Enter` send, `Shift+Enter` new line, `Esc` stop, `Ctrl+K` or `Cmd+K` command palette, `/` focus the input, `↑` recall the previous prompt.

It reconnects automatically (reloading the transcript when events were missed), works down to tablet width, follows the system light or dark theme and `prefers-reduced-motion`, and is usable with a keyboard and a screen reader.

## Sign in

Browsers cannot attach a bearer token to page loads, so the web interface uses a cookie session:

1. At start-up the server prints a **one-time sign-in link** `…/login?code=…` (and opens it with `neuralinverse web`). The code is 256 bits, valid for 5 minutes and usable once.
2. Opening it sets an `HttpOnly`, `SameSite=Strict` session cookie (plus `Secure` when the request arrived over HTTPS, for example behind a TLS proxy) and redirects to `/`, which removes the code from the address bar.
3. Without a valid link, `/login` offers a form for the server token, from the start-up output or `~/.neuralinverse/server.json`. Ten failed attempts per minute lock the form for a minute.

Cookie names include the port (`ni_session_<port>`, `ni_csrf_<port>`). Sessions live in memory: restarting the server signs every browser out. *Sign out* in the sidebar ends the session.

## Security

- The bearer token keeps working for every API call; the cookie is an extra credential used only by the web interface.
- Cookie-authenticated requests are refused when the browser reports (`Sec-Fetch-Site`) that they come from another site or another origin on the same site, such as a development server on another `localhost` port.
- State-changing requests with the cookie must also send `X-NI-CSRF` equal to the readable `ni_csrf_<port>` cookie bound to the session, and an `Origin`, when present, equal to the server's own.
- Pages are served with a strict Content-Security-Policy (`default-src 'none'`, scripts, styles and connections only from the server itself, no inline code, `frame-ancestors 'none'`, and Trusted Types), plus `X-Frame-Options: DENY`, `Referrer-Policy: no-referrer` and `X-Content-Type-Options: nosniff`.
- Model output is rendered by a built-in Markdown renderer that escapes everything, allows only `http(s)` and `mailto` links, and never loads images from other hosts.
- Loopback-only binding and `Host` header checks (DNS-rebinding protection) apply to the pages as they do to the API.

Anyone signed in can do everything the server token allows, which is everything the CLI can do as your user. Do not expose the server beyond your machine without a TLS proxy, `--allow-remote` and an explicit token.