Desk is local, single-user, self-hosted software. It runs on your own machine (or your own remote development box) for you — the person who owns the code, the Moor sessions, the agent CLIs, and the credentials on that host. It is not a multi-tenant service and is not meant to be hosted for other people.
Desk has direct access to the host filesystem, Moor, Git, and any credentials available to the user that runs it. Run it as yourself, on a machine you control, and keep it bound to localhost.

​
Choose a runtime

Install the complete CLI and run its private compiled runtime:
This serves the embedded UI and backend without Vite.
Both bind to 127.0.0.1:5173 by default and fail rather than switching modes. Keep the localhost default.

​
Working on a remote development box

If your code and agents live on a remote box, you still run Desk as yourself on that box and reach it over an SSH tunnel — Desk stays on localhost at both ends, and nothing is exposed to the network:
Then start Desk on the box (bound to 127.0.0.1) and open http://127.0.0.1:5173 in your local browser. The tunnel is authenticated by SSH; Desk itself never listens on a public interface.
Do not bind Desk to 0.0.0.0 or put it on a shared address. It has no user accounts, no login, and no request authentication — it trusts whoever can reach the port. The supported way to use Desk from elsewhere is an SSH tunnel to your own machine, not network exposure.

​
Install agent hooks

Managed agents report lifecycle and attention events through Desk-owned hooks:
This installs or merges hook configuration for Codex, Claude, and OpenCode under the current home directory. Use --home when preparing another user’s home directory:

​
Verify your setup

The curl and source installation paths provide the same CLI. Check:
In the UI, verify:
  • the agents sidebar lists expected sessions
  • terminal cells connect
  • the system segment updates
  • channels load
  • Git and GitHub panels use the expected repository
  • notes and editor roots are the expected local paths

​
Local safety checklist

  • Keep the default 127.0.0.1 bind; never use 0.0.0.0.
  • Run Desk as the user that owns the intended repositories and Moor sessions.
  • Reach a remote box over SSH forwarding, not by exposing the port.
  • Let each agent CLI manage its own credentials. Desk never reads or proxies them — but a session bound to an agent profile authenticates into ~/.config/desk/profiles/<id> instead of the CLI’s usual home, because Desk sets CLAUDE_CONFIG_DIR / CODEX_HOME for that launch. Treat that directory with exactly the sensitivity of ~/.claude or ~/.codex: it holds real credential files, Desk creates it 0700, and anything that can read it can act as that account.
  • Use desk up --dry-run before starting a large manifest.
  • Use the emergency kill switch only when you intend to stop all matching agent processes on the host.
  • Back up ~/.config/desk/desk.yml before large manifest edits.
  • Treat everything under ~/.config/desk as local user data — channels, notes, and profiles most of all.

​
Next steps