Dashboard
The bundled web UI, at http://localhost:3000.
It is a debugging and administration tool, not an end-user product. Everything it
does goes through /dashboard/* and /auth/*.
What it is for
Section titled “What it is for”| Question | Page |
|---|---|
| What does the system know about this user? | Datasets |
| Why did it extract that? | Playground |
| How do I issue a key for my app? | API keys |
| What is this costing me, and how fast is it? | Usage |
| How do I change retrieval behaviour? | Project settings |
| Who can sign in here? | Users and sign-in |
| Is anything broken? | Status |
Layout
Section titled “Layout”┌──────────────┬──────────────────────────────────────────┐│ Memory Soda │ Home │├──────────────┼──────────────────────────────────────────┤│ Home │ ││ │ ││ APPLICATION │ ││ Projects │ page content ││ Users │ ││ Status │ ││ │ ││ PROJECT │ ││ Datasets │ ││ Playground │ ││ API Keys │ ││ Settings │ │├──────────────┤ ││ (A) default ▾│ │└──────────────┴──────────────────────────────────────────┘The sidebar splits into two groups:
- Application, global. Projects, dashboard users, service health.
- Project, scoped to whichever project is selected in the switcher at the bottom.
The footer holds your account avatar (click for sign-out) and the project switcher. Changing the project changes what every Project-group page shows.
Signing in
Section titled “Signing in”The first admin user is admin / open-sesame, and a project named default is created alongside it. Change the password when the
sidebar asks. See Users and sign-in.
Sessions last 7 days and are revocable server-side. Deep links survive sign-in,
visiting /datasets?q=abc while signed out returns you there afterwards.
| Build | Vite 6 |
| Framework | React 19 + React Router 7 |
| Data | TanStack Query |
| UI | Tailwind + shadcn-style components on Base UI |
| Auth | session token in localStorage, attached by an axios interceptor |
It is a single-page app, not server-rendered. VITE_API_URL (default
http://localhost:3004) is baked in at build time and must match what the
browser can reach, not what the server can reach.
A launcher grid over the same links as the sidebar, plus a greeting and the current project. It shows no system state, no fact counts, no extraction backlog, no failures.
Create, rename and delete projects; jump to their settings.
Dashboard login accounts. Unrelated to dataset, these are operators, not the
people being remembered.
The most useful page. Per-dataset browser: threads and their messages, episodes, extracted facts and resolved entities.
An interactive console that exercises the real /v1 API and shows every request
and response as it happens.
Issue and revoke integration keys.
All fifteen episodic and semantic tuning values.
Cost, tokens, latency and memory growth for the project, from a log of every model call the platform made. Filter by window, dataset, source, stage or model.
Status
Section titled “Status”Calls GET /health. Green when Postgres answers SELECT 1.
It does not check Gemini reachability, migration state, or whether the extraction pipeline is keeping up. A green Status page is compatible with every episode failing.
What it cannot do
Section titled “What it cannot do”Worth knowing before you go looking:
| Where to go instead | |
|---|---|
| See failed episodes or extraction errors | Query episodes in SQL, semanticStatus is not surfaced anywhere |
| Delete an entire dataset | No UI button; forgetDataset() does it. Privacy and data deletion |
| Reset another user’s password | npm run admin:reset-password from the shell, or delete and recreate their account |
| See which facts drove a past reply | Only the Playground, and only for the current session |
| Per-user project permissions | Any signed-in user can see every project |
Security
Section titled “Security”The dashboard is an administration surface. Anyone who can sign in can read every dataset in every project, issue API keys, and delete memory.
- Serve it on a trusted network, behind your own auth boundary if exposed.
- The session token lives in
localStorageand is therefore readable by any XSS on that origin. - There is no rate limiting on
/auth/login.
See Self-hosting.
- Datasets, inspect what was learned
- Playground, watch the pipeline run