Install Server and WebUI
vibex-server is a headless Host. It shares the same data directory, agents, conversations, automations, and plugins as the desktop app, without a Tauri window. The browser opens the bundled WebUI. Agents still execute on the machine that runs the Server.
One data directory has one Host at a time. If vibex-server already owns the directory, the desktop app can only connect as a client.
Artifacts
Take the Host-family archive from GitHub Releases, or let the official helper download and verify it:
npx vibexnpx vibex fetches vibex-host-family-{linux-x64,linux-arm64,macos-x64,macos-arm64,windows-x64}.tar.gz, checks the sidecar .sha256 and the inner SHA256SUMS, then starts vibex-server with VIBEX_STATIC_ROOT pointed at web/.
The unpacked layout looks like this:
vibex-server
vibex-mcp
web/
plugins/bundled/Platforms
- macOS: 12 or later, macos-x64 / macos-arm64
- Windows: 10 or 11, windows-x64 today
- Linux: Ubuntu 22.04 baseline, linux-x64 / linux-arm64, or Docker
Open the WebUI in a current Chrome, Edge, Safari, or Firefox. You do not need the desktop app on the viewing machine.
Start
The default bind is loopback only.
| Variable | Default | Meaning |
|---|---|---|
VIBEX_DATA_DIR |
the platform VibeX data directory | Only one Automation engine owner per directory |
VIBEX_SERVER_LISTEN |
127.0.0.1:3080 |
Non-loopback is rejected by default |
VIBEX_SERVER_ALLOW_LAN |
unset | Set to 1 for LAN, and put TLS in front |
VIBEX_SERVER_TOKEN |
generated on first start | At least 32 bytes. Never put it in a URL or argv |
VIBEX_STATIC_ROOT |
unset | Point at the web/ tree from the archive |
The first generated token is printed once on stdout. Store it, then discard that output. Routine logs do not print it. Only a SHA-256 digest is kept on disk.
Open http://127.0.0.1:3080 on the same machine.
LAN
Docker / Compose also publish 127.0.0.1:3080 by default. For other devices:
- Set
VIBEX_SERVER_ALLOW_LAN=1. - Terminate TLS with Caddy, Traefik, or Nginx. Do not hang the raw port on the public internet.
- List exact browser origins in
VIBEX_SERVER_ALLOWED_ORIGINSwhen you need CORS. Wildcards are not supported.
Upgrade
- Stop every desktop and Server process that uses the data directory.
- Snapshot
db.sqlite,db.sqlite-wal,db.sqlite-shm, managed tools, and Artifacts together. - Verify
SHA256SUMSand replacevibex-server,vibex-mcp, andweb/. - Start one Host, check health and capabilities, then turn Automation back on.
Desktop and Server must be the same version family. The phone companion may trail by one minor version. Missing scopes fail closed.
Continue with First conversation. If the Host is already up and you only need another device, see Connect to a Host.

