Reach local services

Query a service that only listens on your server — Prometheus, an admin API, a health check — without opening a port or setting up an SSH tunnel. The agent makes the request from inside the machine.

A lot of what is useful on a server only listens on 127.0.0.1: Prometheus metrics on :9090, a service's admin API on :8080, an application health check on :3000. That is the right instinct — none of it belongs on the public internet. You still need to read it.

The usual answer is ssh -L 9090:localhost:9090. Servor does the same thing differently: the agent performs the request from inside the machine and hands you the response. The service stays on 127.0.0.1, no port is opened, no SSH tunnel is set up.

Query a service

Open the server's surveillance view

Go to Servers, pick the machine, then the Local services panel. Your vault must be unlocked — the request is signed by your browser, just like a command.

Pick the target

The locally listening ports detected on the machine are offered as one-click choices, with the process holding each one. Those are exactly the ones nothing outside can reach. You can also type the host and port yourself.

Compose the request

Method (GET, POST, PUT, PATCH, DELETE, HEAD), path, headers, and a body when the method takes one. An Authorization header is entered masked and is never logged, by the API or by the agent.

Read the response

Status, duration, headers and body. The body is shown as text, never rendered as a page: whatever a local port serves has no business executing inside your dashboard.

What this is not

It is a request, not a port forward. There is no local socket open on your machine — a browser cannot open one. So you cannot point psql or redis-cli at it, and you cannot browse a service's web UI as if you were on the box. For that, the web terminal is still the tool: it gives you a shell where the service is reachable.

What you do get is direct reading of anything that speaks HTTP: metrics, health, status, admin APIs.

Limits

HTTP and HTTPS only.
1 MB of response at most; beyond that it is truncated and the panel says so.
256 KB of request body at most.
15 seconds before it gives up.
Redirects are not followed: a silently followed redirect would have you reading a different URL from the one you signed.

Over HTTPS, a local service often presents a self-signed certificate. A Skip certificate verification option exists for that case; the choice is part of what your browser signs, so it cannot be turned on for you along the way.

Security

The request is signed by your browser: method, host, port, path, headers and the hash of the body are all covered. An approval for GET /metrics cannot be replayed as a DELETE, and a relay cannot change a header while keeping the signature valid.
The agent verifies it locally before acting. Servor's servers cannot forge one.
No content is logged. The audit log keeps the target (method, host, port, path) and the status code; never the headers or the bodies.
Member role minimum, the same as running a command — a viewer cannot. That is coherent: anyone who can open a shell on the machine can already curl it.
Strict mode closes this path too, exactly as it closes execution.