Server installation
Requirements, installer options, HTTPS modes, updates and uninstalling.
Requirements
| Operating system | 64-bit Linux with systemd: Ubuntu 22.04+, Debian 12+, Rocky/Alma 9+, and most modern distributions |
| Python | 3.10 or newer (the installer adds python3-venv if needed) |
| Access | root or a user with sudo |
| Network | outbound HTTPS to https://mcp.opsgates.com and to PyPI (to install dependencies); ports 80 and 443 reachable from the internet for the certificate, unless you use EasyPanel or your own proxy |
| Resources | about 80 MB of RAM and 150 MB of disk |
The install command
curl -fsSL https://mcp.opsgates.com/install.sh | sudo bash -s -- --key og_your_key [options]
| Option | What it does |
|---|---|
--key KEY |
Your license key (required on the first install). |
--domain NAME |
Use your own hostname, e.g. mcp.example.com. Its DNS A record must point to the server. Without it, <your-ip>.sslip.io is used. |
--proxy MODE |
auto (default), easypanel, caddy, nginx or none. |
--email ADDRESS |
Contact for Let's Encrypt (nginx mode). |
--port N |
Local port of the agent (default 8765, or the next free one). |
--allow-write DIRS |
Comma-separated folders the AI may modify, e.g. /var/www/app,/etc/nginx/sites-available. |
--allow-restart SVCS |
Comma-separated services the AI may restart, e.g. nginx,myapp. |
--access PROFILES |
What the AI may do: readonly (default), network, asterisk, full (comma-separated). Without it, a menu asks while installing. Change it later with sudo opsgate access. |
--no-firewall |
Do not open ports 80/443 in ufw or firewalld. |
--update |
Update an existing install, keeping the password, key and settings. |
Want to read the script first? Download it, read it, then run it:
curl -fsSL https://mcp.opsgates.com/install.sh -o install.sh
less install.sh
sudo bash install.sh --key og_your_key
How HTTPS is set up
The agent itself only listens on a local address. A reverse proxy in front of it provides HTTPS. With --proxy auto the installer picks:
- EasyPanel — if EasyPanel is installed, a route is added to its Traefik (
/etc/easypanel/traefik/config/custom.yaml, with a backup; your other routes are kept). The certificate comes from EasyPanel's Let's Encrypt resolver. - Caddy — if Caddy is already running, a site is added through
import /etc/caddy/opsgate.caddy. - nginx — if nginx already uses ports 80/443, a server block is added and certbot gets the certificate.
- Caddy (new) — if ports 80 and 443 are free, Caddy is installed and configured. This is the simplest option.
- none — if something else uses the ports, nothing is changed and you are told where to point your proxy (
http://127.0.0.1:8765, with response buffering disabled).
The first certificate usually takes less than a minute. Check with sudo opsgate doctor.
What gets installed
| Path | Contents |
|---|---|
/opt/opsgate/app |
The agent's code (owned by root, read-only for the service) |
/opt/opsgate/venv |
Its Python environment |
/etc/opsgate/env |
Configuration, root-only: password hash, token hashes, license key |
/var/lib/opsgate |
OAuth database (hashes only) and usage counter |
/var/log/opsgate/audit.jsonl |
Audit log of every tool call |
/var/backups/opsgate |
Automatic backups made before each write |
/etc/systemd/system/opsgate.service |
The hardened service |
/etc/sudoers.d/opsgate |
The exact restarts you allowed (empty by default) |
/usr/local/bin/opsgate |
The management command |
Update
sudo opsgate update
It downloads the latest agent from https://mcp.opsgates.com, verifies its signature, keeps your settings and restarts the service (a few seconds). If the new version fails to start or to answer, the previous version — code, Python environment and management command — is restored by itself. Your dashboard shows Update available next to a server that runs an older version.
Automatic updates (optional)
sudo opsgate autoupdate on # every day around 03:30, this server's clock
sudo opsgate autoupdate on 05:00 # or the time you prefer
sudo opsgate autoupdate status
sudo opsgate autoupdate off
Once a day it checks for a newer signed version and installs it only if there is one. If the AI used the server in the last 10 minutes, it waits for the next day. A failed update rolls back by itself. Every attempt is written to /var/log/opsgate/autoupdate.log.
Move to your own domain
Point the domain's A record to the server, then run the update command with --domain (it verifies the vendor signature first):
sudo opsgate update --domain mcp.example.com
Then update the connector URL in your AI apps.
Uninstall
sudo opsgate uninstall # keeps /etc/opsgate (password, settings) for a reinstall
sudo opsgate uninstall --purge # removes everything, including logs and backups
Then remove the server in your dashboard so its license key stops working.