Deploy one service. Keep the boundary yours.

Run the API, MCP surface, and console as one Bun service with SQLite or PostgreSQL, then place the process inside your own authentication, TLS, and network boundaries.

One process, four surfaces

In production, the Bun API serves the built React console alongside REST and MCP. The same process exposes administration, agent execution, health, and readiness surfaces.

Console

Configure the workspace in the built React UI.

REST

Manage integrations, policy, members, keys, and settings.

MCP

Give agents one governed Streamable HTTP endpoint.

Operations

Expose separate liveness and dependency-aware readiness probes.

bun run build
bun run start

Choose the storage model

Database choice does not change the REST, MCP, CLI, or console contracts.

SQLite is the zero-configuration default for development and a single Controller process.

  • * Set CONTROLLER_DB_PATH only when changing the default file.
  • * Keep the database and its generated key sidecar together.
  • * Move to PostgreSQL before running multiple Controller replicas.

The included Compose stack runs Controller with PostgreSQL and file-mounted database, encryption, and administrator credentials.

bun run setup:docker
docker compose up --build

Set the production boundary

Identity and browser access

  • * Require a strong administrator token on every non-loopback listener.
  • * Create narrower API keys for agents and routine operators.
  • * Allow only the browser origins that need the console.

Network and secrets

  • * Terminate TLS at a trusted proxy or load balancer.
  • * Prefer file-backed database, encryption, and administrator secrets in containers.
  • * Add infrastructure-level outbound controls as defense in depth.

Probe the service

EndpointWhat it proves
/healthThe Controller process is running.
/readyThe process can reach its selected database; otherwise it returns 503.

Controller is open source under Apache 2.0. Inspect the gateway boundary, run it in your own environment, and extend its adapters under the repository license.