Skip to content
BMO

HTTP/SSE server

Headless HTTP hub for sessions, health, auth, and session-scoped SSE.

Quick start

Section titled “Quick start”
Terminal window
bmo service start http --listen 127.0.0.1:8080 --auth token --token "$BMO_AUTH_TOKEN"

For local-only development you can run without a token when the bind address is loopback:

Terminal window
bmo service start http --listen 127.0.0.1:8080 --auth local

For the interactive app, enable the in-process hub in bmo.toml:

[services.http]
enabled = true
listen = "127.0.0.1:8080"
auth = "token"
token = "dev-token"

auth = "token" enables Bearer-token authentication. auth = "local" is accepted only for loopback addresses; non-loopback unauthenticated binds are rejected during config validation.

bmo service start autopilot uses the same HTTP server path when you want the API server beside the scheduler.

Which runtime should I start?

Section titled “Which runtime should I start?”
  • Use bmo service start http when you want only the HTTP/SSE runtime.
  • Use bmo service start autopilot when you want the same API server plus the scheduler and long-lived runtime posture.
  • Use bmo --daemon=auto|require when you want an interactive terminal to attach to an already-running compatible loopback daemon instead of starting a second local runtime. That is a TUI reuse path, not an HTTP deployment mode.

HTTP/2

Section titled “HTTP/2”

Plain bmo service start http and [services.http] listeners serve direct HTTP/1.1. HTTP/2 is available when TLS is terminated in front of BMO, or when BMO is embedded with a first-party TLS config; session SSE and OpenAI-compatible streaming are covered by route-level HTTP/2 tests on that TLS path. BMO does not expose h2c as the public API posture.

Maintainer streaming benchmarks label direct plaintext HTTP/1.1 as h1_* and TLS-negotiated HTTP/2 as h2_tls_*; read them as external transport posture benchmarks, not protocol-only comparisons with TLS removed.

Routes and events

Section titled “Routes and events”

Routes live under /v1/ for sessions, messages, teams, config, models, operations, checkpoints, agent runs, eval/shadow, and related readouts. The server also exposes /metrics and /v1/health.

Session events stream from:

GET /v1/sessions/{id}/events

The SSE stream is an observer export. Session state, run ledgers, proposal lifecycle, and control-loop transitions remain in BMO’s canonical app and data store.

Inspect

Section titled “Inspect”
  • bmo service status http --source config
  • TUI /serve
  • Structured logs: http_server.fired, http_server.action
  • Maintainer trace recipes: Agent tracing recipes
  • HTTP API maintainer topic: HTTP API Server
Section titled “Related”