Browser UI

muaz ships an optional browser UI — a React app served by the muaz-gateway server. It gives you a graphical surface for chat, agents, providers, plugins, skills, MCP status, and sessions, backed by the same agent runtime as the CLI.

Starting the UI

1. Launch the gateway.

   muaz gateway                 # binds 127.0.0.1:7878 by default
   muaz gateway --port 9000     # custom port

   On startup it prints a URL containing a one-time token, e.g. http://127.0.0.1:7878/?token=….

2. Open the printed URL. Visiting it with the token sets a muaz_token cookie, so every later request in that browser authenticates automatically.

The runtime is reachable over HTTP

The gateway can run shell commands, so every /api route requires the token. The server binds loopback by default; --host 0.0.0.0 exposes it to the network and prints a warning. There is no CORS layer (same-origin only). Only expose it on a trusted network, and prefer a fixed --token (or $MUAZ_GATEWAY_TOKEN) over the generated one when scripting.

What’s in the UI

Page	Purpose
Chat	Talk to an agent with streamed responses, an in-browser approval dialog for tool calls, and an inline banner to enter an API key and retry when a turn fails authentication
Agents	Browse agents across namespaces, create/edit/delete local agents, and “Fork” built-in/plugin agents into your local workspace
Providers	Manage provider profiles, the default binding, and per-agent bindings; store API keys (with a Key set / From environment / Not set status) and Test a profile’s credentials
Plugins	Install (by name from the registry), enable/disable, trust, and uninstall plugins
Skills	View discovered Agent Skills
MCP	See registered MCP servers and their status
Sessions	Browse and resume saved sessions
Settings	View the active configuration

How it relates to the CLI

The UI is a thin front-end over the same muaz-core runtime the CLI uses — agents, skills, sessions, tools, and the approval policy are shared. Anything you configure on disk (see Configuration) applies to both. Tool approvals that would prompt in the terminal instead surface as an approval dialog in the browser.

Authentication at a glance

The gateway token can be supplied three ways on each request:

• Authorization: Bearer <token> header
• a muaz_token cookie (set automatically after the first ?token= visit)
• a ?token= query parameter (used by EventSource, which can’t set headers)

Comparison is constant-time, and the static UI shell is the only public route.