# Dashboard

> Open the ChainGPT marketplace dashboard — a localhost web UI with six read-only panels (Overview, Wallet, Skills, Activity, Health, About). Bind 127.0.0.1 only, admin-token auth, same-origin CSRF defense. Triggers: dashboard, open the dashboard, ChainGPT dashboard, marketplace dashboard, show me the dashboard, web UI, control panel, skills overview, agent wallet panel, env check, plugin health.

- Skill: `jiayaoqijia/dashboard` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add jiayaoqijia/dashboard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jiayaoqijia/dashboard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: jiayaoqijia (https://skillmd.com/u/jiayaoqijia)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jiayaoqijia/dashboard

---


# ChainGPT Dashboard

A single localhost web UI that gives a glance-at-it view of the marketplace: which plugin/MCP/marketplace version is installed, what skills are available, recent agent-wallet activity, environment-variable health, and pointers to docs + changelog.

**Read-only.** No signing flows are proxied through the browser. The dashboard intentionally cannot move funds — that stays in MCP tool calls with explicit user confirmation.

## How to open

The fastest path is the slash command:

```
/chaingpt:dashboard
```

That calls the underlying MCP tool, prints a URL and a one-time admin token, and asks if you want to open the URL in your browser.

You can also call the tool directly:

```
> Use chaingpt_dashboard_serve to start the dashboard on port 8788
```

## Panels

| Panel | What it shows | Source |
|---|---|---|
| Overview | Plugin / MCP / marketplace versions; skill count; agent-wallet init state; docs link | `.claude-plugin/*.json`, `mcp-server/package.json`, `~/.chaingpt-mcp/agent-wallet/keystore.json` |
| Wallet | Agent EOA address (copy button); policy summary (kill switch, unrestricted mode, allowed chains, allowed/blocked address counts, max tx value, max gas, memo requirement, policy digest); tracked-token + custom-chain counts; signed-tx count; CTA to launch the full Wallet Admin UI (port 8787) for editing. Read-only — reads the public address from the keystore, never decrypts. | `~/.chaingpt-mcp/agent-wallet/{keystore,policy,tracked-tokens,custom-chains}.json` |
| Skills | One card per skill in `skills/` with name + description from its SKILL.md frontmatter | `skills/*/SKILL.md` |
| Activity | Most recent signed transactions (newest first) | `~/.chaingpt-mcp/agent-wallet/activity.jsonl` (empty if you haven't signed yet) |
| Health | Presence (not value) of CHAINGPT_API_KEY, agent-wallet passphrase, Etherscan/Moralis/GoPlus keys; Node runtime; key paths | `process.env`, filesystem |
| About | Plugin info + top of `CHANGELOG.md` | `.claude-plugin/plugin.json`, `CHANGELOG.md` |

## Security model

- **Bind:** `127.0.0.1` only — never `0.0.0.0`. Cross-host access requires an SSH tunnel.
- **Admin token:** 48 hex chars / 192 bits, written to `~/.chaingpt-mcp/dashboard/.admin-token` with `0600` perms. Rotated on every `chaingpt_dashboard_serve` call.
- **Sessions:** HttpOnly cookie `cg_dash_sid`, 1-hour sliding TTL, in-memory only (no persistence across restarts).
- **CSRF:** All state-changing requests checked against `Origin` (or `Referer`) — must equal `http://127.0.0.1:<port>` / `http://localhost:<port>`.
- **No secrets in the browser.** API keys never leave the Node process; the dashboard reports presence flags only.

## Coexistence with the agent-wallet UI

The dashboard and `chaingpt_agent_wallet_serve_ui` run as separate servers on separate ports (8788 vs. 8787) with independent admin tokens. They share no auth state. Both can run simultaneously.

## Environment variables (optional)

| Var | What |
|---|---|
| `CHAINGPT_DASHBOARD_DIR` | Override the dashboard state dir. Default: `~/.chaingpt-mcp/dashboard/` |

## Troubleshooting

- **Login screen rejects the token:** the token rotates each invocation. Re-run `/chaingpt:dashboard` and use the freshly printed token.
- **Port in use:** pass a different port: `chaingpt_dashboard_serve({ port: 9999 })`.
- **403 Origin check failed:** you're hitting the URL from somewhere other than `127.0.0.1:<port>` / `localhost:<port>`. Open the URL exactly as printed.