# Cloudgate: full site text > Cloudgate is a deployment platform you point at your own servers and your own AWS or Google Cloud account. Deploy apps, databases, Compose stacks and AI models with domains, TLS, backups and monitoring built in. This is every page of https://cloudgate.octabyte.io as plain text, for AI assistants. The short index is https://cloudgate.octabyte.io/llms.txt. The source is public at https://github.com/octabyte-io/cloudgate. App templates live on their own website, https://cgt.octabyte.io/; each deploys from https://cloudgate.octabyte.app/get-started?template=. --- Page: Cloudgate: deploy apps to servers you own, by hand or by AI URL: https://cloudgate.octabyte.io/ # Deploy what you and your AI build, on servers you own Cloudgate puts apps, databases and AI models on your own server, AWS or Google Cloud, with domains, https, backups and monitoring already set up. Click Deploy in the console, run one command, or let your AI agent do it over MCP. Start 30-day free trial (https://cloudgate.octabyte.app/sign-up) Deploy an app template (https://cgt.octabyte.io/) Rather run it yourself? Cloudgate is free to self-host (https://cloudgate.octabyte.io/self-hosted). Runs on - Any Ubuntu server - AWS - Google Cloud - Docker Swarm - PostgreSQL - MySQL - Redis - MongoDB - Ollama - vLLM - GitHub - GitLab ## One platform, three places to run Each Environment picks where its Services run. Keep production on AWS and staging on a cheap server, or start on one server and move later. The Project config stays the same. ### Your own server Any Ubuntu machine you can reach over SSH, or one you buy from Cloudgate in the console. Cloudgate sets up Docker Swarm and Traefik on it and runs everything as containers. - Apps from git, a Docker image or a folder - PostgreSQL, MySQL, MariaDB, MongoDB, Redis, libSQL - Docker Compose stacks - AI models on your GPUs ### Your AWS account Connect an AWS account and Cloudgate makes the resources with OpenTofu, keeps their state, and shows you any change someone made by hand. - Web apps, workers and cron on ECS Fargate - PostgreSQL and MySQL on RDS - Redis on ElastiCache - Buckets and static sites on S3 and CloudFront ### Your Google Cloud project Connect a Google Cloud project and the same Project config deploys there. You pay Google for what runs, at Google’s prices, in your own account. - Web apps on Cloud Run - PostgreSQL on Cloud SQL - Redis on Memorystore - Compose stacks on their own VM What runs where, in detail (https://cloudgate.octabyte.io/features#where-it-runs) ## Built it with AI? Put it online in three steps You don’t need to know what a container is. Cloudgate asks for an account, a server and a click, and gives you back a link you can share. ### Sign up Start the 30-day free trial. Deploy your own app or pick a ready-made template. ### Get a server Buy one from Cloudgate in a few clicks, or paste one command into a server you already rent. ### Press Deploy Cloudgate builds it, starts it and gives you its address. Add your own domain whenever you’re ready. Deploying an app you built with AI (https://cloudgate.octabyte.io/vibe-coding) ## Let your AI agent deploy, inside limits you set An Agent in Cloudgate is a member of your Organization with its own key, role and access, so you decide what it can touch and see everything it did. - Its own identity: A Reader or Operator role, access to named Projects and Services, and keys that work only at the MCP endpoint. - Every call recorded: Each tool call is a row in the audit log, whether Cloudgate allowed it or refused it. - Secrets stay secret: Passwords and keys are masked out of every result the agent reads, deployment logs included. - Previews that clean up: It can build a branch into a preview that expires on its own, and ask for a Plan without applying it. How Cloudgate works with AI agents (https://cloudgate.octabyte.io/ai-agents) Your AI agent, connected to Cloudgate over MCP you The checkout page is broken. Fix it and send me a preview. agent Pushed a fix to fix-checkout. Asking Cloudgate for a preview. create_preview applicationId "shop-web" branch "fix-checkout" queued, expires in 60 minutes read_deployment_log build finished, container healthy DATABASE_URL=•••••• get_service_health uptime check up, error rate under threshold agent The preview is live. Every call above is in your audit log. ## What every app gets without extra setup The parts of running an app in production that usually take a week of setup, ready on day one. https://shop.example.com Certificate issued, renews by itself ### Domains and https Point a domain at your app and Cloudgate gets the TLS certificate. Every app also gets a free address that works straight away. Uptime check upError rate under 5% ### Monitoring that needs nothing from the app Uptime checks, error rates read from the proxy, logs, traces and server alerts, sent to Slack, Discord, Teams, email and more. - PostgreSQL - MySQL - MariaDB - MongoDB - Redis - libSQL ### Databases with backups Six database engines, backed up on a schedule to any S3-compatible storage, and restored from the console. #1 Detected Node.js app #2 Building with Nixpacks #3 Image pushed #4 Deployment done ### Builds without a Dockerfile Nixpacks works out how to build most apps. Railpack, buildpacks and your own Dockerfile are there when you want them. mainpull request: its own preview ### Previews and rollbacks A preview for every pull request, and a way back to any earlier Deployment when a change goes wrong. - AKOwner - MLDeveloper - AIAgent, Operator ### Teams and access Members, roles and grants down to a single Service, and an audit log of who did what. SSO and SCIM on Business. Your appGateway, OpenAI-compatiblellama-3 on vLLM, 1 GPU Token spend counted per model and per calling Agent ### AI models on your own GPUs Serve a model with Ollama, vLLM or llama.cpp on your Server, and call it through Cloudgate's gateway like any OpenAI-compatible API. Every Cloudgate feature (https://cloudgate.octabyte.io/features) ## Self-host popular apps in one click Each template sets up the app, its database and its secrets for you. Replace Zapier with n8n, Google Analytics with Plausible, or 1Password with Vaultwarden. - n8nAutomate work between your apps, with no limit on runs. (https://cgt.octabyte.io/templates/n8n/) - WordPressBuild a website, blog or shop with themes and thousands of add-ons. (https://cgt.octabyte.io/templates/wordpress/) - GhostPublish a blog and paid newsletter on a site that you own. (https://cgt.octabyte.io/templates/ghost/) - Plausible AnalyticsSimple website visitor stats, with no cookie banner needed. (https://cgt.octabyte.io/templates/plausible/) - VaultwardenA shared password manager for your team, on your own server. (https://cgt.octabyte.io/templates/vaultwarden/) - NextcloudYour own cloud for files, calendars and contacts. (https://cgt.octabyte.io/templates/nextcloud/) - MattermostOpen-source team chat like Slack, with your full history kept. (https://cgt.octabyte.io/templates/mattermost/) - Uptime KumaKnow the moment your website goes down, and tell customers. (https://cgt.octabyte.io/templates/uptime-kuma/) Browse the template catalogue (https://cgt.octabyte.io/) Deploy n8n now (https://cloudgate.octabyte.app/get-started?template=n8n) ## Pay for the platform, not a markup on compute Members, Projects and Environments are never counted. Servers you bring are billed by their provider, and cloud resources by AWS or Google, straight to you. ### Starter $15 a month For one team running its own apps. - 3 Servers and 3 Cloud Environments - Unlimited members, Projects and Environments - Apps, databases, Compose stacks and AI models - Domains, TLS, backups, metrics and uptime checks Start 30-day free trial (https://cloudgate.octabyte.app/sign-up) ### Business $35 a month For companies with an identity provider. - Everything in Starter - SSO sign-in for your proven domains - SCIM provisioning - Custom roles Start 30-day free trial (https://cloudgate.octabyte.app/sign-up) ### Self-hosted Free under the Elastic License 2.0 Run Cloudgate on your own machine. - Install on one Ubuntu 24.04 server - One Organization, one build at a time per Server - Enterprise license adds SSO, SCIM and more How self-hosting works (https://cloudgate.octabyte.io/self-hosted) Add-on: $5 a month for one more Server and one more Cloud Environment. Compare plans and see worked examples (https://cloudgate.octabyte.io/pricing) ## Questions people ask ### What is Cloudgate? Cloudgate is a deployment platform for servers and cloud accounts you own. It builds and runs your apps, databases, Docker Compose stacks and AI models on your own Linux server, your AWS account or your Google Cloud project, and handles domains, TLS certificates, backups, logs and monitoring for you. ### Can an AI agent deploy with Cloudgate? Yes. You create an Agent in Cloudgate, give it a role and access to the Projects it should reach, and connect your AI tool to Cloudgate’s MCP endpoint with the Agent’s key. It can deploy, read logs and health, and open previews that expire. Every call is in the audit log and secrets are masked out of everything it reads. How agents work (https://cloudgate.octabyte.io/ai-agents). ### I built an app with AI and don’t know servers. Can I still use Cloudgate? Yes. The get-started wizard asks three things: your account, a server (buy one from us with a few clicks, or connect your own with one command), and Deploy. You get a working address at the end. Deploying an app you built with AI (https://cloudgate.octabyte.io/vibe-coding). ### How is Cloudgate different from Heroku, Vercel or Render? Those platforms run your app on their machines and bill you for their compute. Cloudgate runs it on machines you own or rent yourself, or in your own AWS or Google Cloud account, so you pay providers directly and can move between them. You can also self-host Cloudgate itself. ### How much does Cloudgate cost? The hosted plans are $15 a month (Starter) or $35 a month (Business, with SSO and SCIM), each with 3 Servers and 3 Cloud Environments and a 30-day free trial. An Add-on is $5 a month for one more Server and one more Cloud Environment. Self-hosting is free. See pricing (https://cloudgate.octabyte.io/pricing). ### Is Cloudgate open source? Cloudgate is source-available under the Elastic License 2.0. Anyone can use, self-host and modify it for free. What the license does not allow is offering Cloudgate to others as a hosted service. Self-hosting Cloudgate (https://cloudgate.octabyte.io/self-hosted). ## Put your next app online today Every plan starts with a 30-day free trial. Bring a server, buy one from us, or connect AWS or Google Cloud. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Put your AI-built app online in three steps | Cloudgate URL: https://cloudgate.octabyte.io/vibe-coding # Put the app you built with AI online You made something with Lovable, Bolt, Cursor, Claude, v0 or Replit, and now it needs a home on the internet. Cloudgate gives it one, on a server that is yours, with an address you can send to people. No server knowledge needed. Get started (https://cloudgate.octabyte.app/get-started) Browse ready-made apps (https://cgt.octabyte.io/) ## How do I get my app online? Three steps in the console. Most of the waiting is the server being set up, and Cloudgate does that part. ### Sign up Make an account on Cloudgate. The 30-day free trial needs a card to start. ### Get a server Buy one from us in the console: pick a place on the map and a size, and see the price before you pay. Or use a server you already have: Cloudgate makes a key and gives you one command to paste into it. ### Press Deploy Cloudgate sets the server up by itself once it is ready, then builds your app and starts it. You watch it happen; there is nothing to type. Get started Running notes-app http://notes-app.203.0.113.10.sslip.io Add your own domain for https What you see at the end: your app's address and a button to open it. The free sslip.io address works right away over plain http. Add your own domain and it gets https, the padlock in the browser. ## Which way should I deploy my app? Pick a ready-made app if you want one that already exists. Bring your own if your AI tool made it. ### Start from a ready-made app Popular apps people run for themselves, such as WordPress, Ghost, n8n, Nextcloud, Umami and Uptime Kuma. Pick one, press Deploy, and the get started steps above take you the rest of the way. See all app templates (https://cgt.octabyte.io/) ### Deploy the app your AI made From GitHub. Many AI app builders can save your project to GitHub. Connect that repository in the console, and every time a change is pushed to it, Cloudgate deploys the new version. From a folder on your computer. If you have the project folder, three commands in a terminal send it up. Cloudgate skips your .env file and anything in .gitignore. Terminal, in your app's folder # once npm install -g @octabyte-io/cloudgate@next cloudgate login # from your app's folder cloudgate deploy The command line tool is a beta, installed from npm's next tag, and needs Node 22 or newer. How the Cloudgate CLI works (https://cloudgate.octabyte.io/cli) ## What does Cloudgate look after for me? The parts of running an app that people usually learn the hard way. You get them without having to know their names. - The padlock in the browser: Add your own domain and Cloudgate gets the https certificate for it and renews it. You never touch a certificate file. - A database that is set up for you: PostgreSQL, MySQL, MariaDB, MongoDB, Redis or libSQL, next to your app. Cloudgate links its address into your app, so you do not paste passwords around. - Backups: Copies of your databases and stored files, sent to storage you choose, so a mistake is not the end of your data. - An undo button for updates: If a change breaks your app, roll back to an earlier Deployment, the version that worked, while the change gets fixed. - Logs you can read: When something goes wrong, the build log and your app's own log are in the console, a click away from the app. - Someone watching it: Uptime checks visit your app, and Cloudgate tells you on Slack, Discord, Telegram, email and more when it stops answering. Everything Cloudgate does, in detail (https://cloudgate.octabyte.io/features) ## Can my AI do the deploying too? Yes. If you build with Claude Code, Cursor or another tool that speaks MCP, give it its own Agent in Cloudgate. Then you can ask it to ship a fix, and it deploys, reads the log and checks that your app is up before it tells you it is done. It only reaches the apps you allow, it never sees your passwords, and everything it does is written down for you to read later. Let your AI tool deploy with Cloudgate (https://cloudgate.octabyte.io/ai-agents) ## What will it cost me? Two things: your Cloudgate plan and your server. The Starter plan is $15 a month and covers up to 3 Servers, with a 30-day free trial (a card is needed to start it). A server you buy in the console is billed on the same invoice, monthly, at a price shown before you buy. A server you already have costs whatever you pay for it now. Members, Projects and Environments are not counted. Compare Cloudgate plans (https://cloudgate.octabyte.io/pricing) ## Questions from people new to deploying ### Do I need to know about servers to use Cloudgate? No. The get started path sets the server up for you: buy one in the console, or paste one command into a server you already have. Cloudgate installs what it needs and then deploys your app. ### I built my app with Lovable, Bolt, v0 or Replit. Will it work? If your app's code is in a folder or a GitHub repository, Cloudgate can build it. It works out how to build most apps on its own, and it can also use a Dockerfile if your project has one. Cloudgate does not connect to those tools directly; it works from the code they give you. ### What address does my app get? Right away, a free address ending in sslip.io that works over plain http. For https and a name people remember, add your own domain and Cloudgate gets the certificate for it. ### What if an update breaks my app? Roll back to an earlier Deployment from the console. The version that worked comes back while you, or your AI tool, fix the change. ### How much does it cost? Your plan plus your server. The Starter plan is $15 a month on the Hosted instance, after a 30-day free trial. A server you buy from us is billed on top at the price shown before you buy; your own server costs whatever your provider charges. See Cloudgate pricing (https://cloudgate.octabyte.io/pricing). ### Can my AI tool deploy for me? Yes. Give it its own Agent in Cloudgate and connect it over MCP. It can deploy, read the logs and check your app is up, and it never sees your stored secrets. See Cloudgate for AI agents (https://cloudgate.octabyte.io/ai-agents). ## Your app deserves an address Sign up, get a server and press Deploy. Every plan starts with a 30-day free trial. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Let AI agents deploy over MCP with guard rails | Cloudgate URL: https://cloudgate.octabyte.io/ai-agents # Let your AI agent deploy, with guard rails Cloudgate gives Claude Code, Cursor or any MCP client its own member account: a role, a grant to the Services it may touch, and its own keys. It deploys, opens previews and reads logs and health. Every call lands in the audit log and secrets never reach it. Start free trial (https://cloudgate.octabyte.app/sign-up) See the guard rails ## What is an Agent in Cloudgate? An Agent is a member of your Organization that is not a person. Your AI tool acts as it, so what the tool can reach is decided in Cloudgate, not in a prompt. - Its own role: Reader to look, Operator to deploy and run. Never more than the role allows, whatever the agent is asked. - Its own grant: The Projects, Environments and Services it may reach. A staging grant keeps it out of production. - Its own keys: Agent keys, shown once, that you can let expire or revoke without touching anyone else's access. - It outlives its maker: The Agent belongs to the Organization. When the person who made it leaves, the agent keeps working. ## How does an AI agent connect to Cloudgate? Over MCP. The endpoint is your console's address followed by /mcp, and the agent key goes in the Authorization header as a bearer token. That is the whole of the setup: no OAuth flow, no plugin to install on the Server. Create the Agent in Settings, Agents. The console's Connect panel then shows the configuration for each MCP client it supports, ready to paste into Claude Code, Cursor or another client. On the Hosted instance the console is cloudgate.octabyte.app. On a self-hosted Cloudgate install (https://cloudgate.octabyte.io/self-hosted) it is your own address. HTTP request to the MCP endpoint # What every MCP call carries POST https://cloudgate.octabyte.app/mcp Authorization: Bearer Content-Type: application/json ## What does an agent's deploy look like? The agent queues a build, follows it, reads the log and checks health before it reports back. The tool names below are the real ones. A retried deploy joins the queued build, and the stored database address comes back masked. MCP client session, connected to Cloudgate # An illustrative session. Project, Service and ids are examples. you The checkout page fails on an empty cart. The fix is merged. Ship it to staging and tell me if it is healthy. agent deploy_service { "serviceType": "application", "serviceId": "storefront" } result { "deploymentId": "dep_7f2c", "coalesced": false, "message": "Deployment dep_7f2c is queued; poll list_deployments for it." } # The client timed out and retried. Nothing new is queued. agent deploy_service { "serviceType": "application", "serviceId": "storefront" } result { "deploymentId": "dep_7f2c", "coalesced": true } agent list_deployments { "serviceType": "application", "serviceId": "storefront" } result [ { "deploymentId": "dep_7f2c", "status": "done" }, ... ] agent read_deployment_log { "deploymentId": "dep_7f2c", "lines": 100 } result ... Installing dependencies DATABASE_URL=•••••• Build finished, starting container ... agent get_service_health { "serviceType": "application", "serviceId": "storefront" } result { "uptimeChecks": [ { "name": "checkout", "state": "up" } ], "openIncidents": [] } agent Deployed dep_7f2c to staging. The checkout uptime check is up and there are no open incidents. An illustrative session between an MCP client and Cloudgate. Names and ids are examples. ## Which tools can an agent call? Four groups of tools, each checked against the Agent's role and grant on every call. There is no tool that runs a shell, applies a Plan or changes an alert. - Deploy and operate: Queue a build, start or stop a Service, or cancel a Deployment that should not finish. - deploy_service - start_service - stop_service - cancel_deployment - Previews: Open a requested preview of a branch, give it more time, rebuild it, or end it early. - create_preview - extend_preview - redeploy_preview - delete_preview - list_previews - get_preview - Plans and project config: Read the Project config, ask for a fresh Plan and read what it would change. Applying it stays with you. - get_project_config - request_plan - get_plan - Read health, logs and state: Follow a Deployment, read its log, and read the same health a person sees on the Health tab. - get_service_health - list_deployments - read_deployment_log - get_service - get_environment - list_projects - list_environments - list_domains ## What stops an agent from doing damage? The limits sit in Cloudgate, outside the model, so they hold whatever the agent is told or tells itself. - Every call is in the audit log: One row per call, with the tool and the outcome: succeeded, refused or failed. A refusal names its reason, such as permission, grant or rate limit. - Secrets are masked in every result: Stored secrets, from environment variables to database passwords, are replaced with •••••• in every answer, deployment logs included. - Rate limits per Agent: 120 reads and 10 writes a minute, shared by all of an Agent's keys. Going over answers 429 with a Retry-After and spends nothing. - Deploying twice is safe: If a Deployment of the Service is still queued, a second deploy_service answers that one with coalesced: true and queues nothing. - Plans are requested, never applied: An agent can tell you what a change to the Project config would create, change or destroy. You review the Plan and apply it in the console. - Keys work in two places only: An agent key is accepted at the MCP endpoint and the Gateway. The REST API and the sign-in routes refuse it, and a personal key is refused at /mcp. ## How does an agent test its own fix? With a requested preview: a copy of the Application built from a branch, with its own address, that expires on its own. The agent never touches the Environment you ship from. Pushing to a branch needs git access, which you give the AI tool at your git provider. An Agent's grant reaches Cloudgate's Projects, Environments and Services, never your repository. ### Push a fix to a branch The agent commits its change to a branch, with the git access you gave it. ### Open a preview of that branch create_preview builds the branch as its own preview, which expires by itself. extend_preview gives it more time. ### Read the log and health read_deployment_log and get_service_health show whether the build worked and the app answers. ### Report back, or try again It tells you what it found, or pushes another commit and calls redeploy_preview. ## Can agents call AI models you host yourself? Yes, through the Gateway. Deploy a model served by Ollama, vLLM or llama.cpp as a Service, on your own Server and GPUs. Every call reaches it through Cloudgate's Gateway, which speaks the OpenAI API, so any OpenAI client works by changing its base URL. The caller uses the key of a caller Agent, a third role that may call the AI models it is granted and nothing else. The Gateway counts token spend per model and per calling Agent, so give each app or agent its own caller Agent: its spend shows on its own line, and you can suspend one caller without cutting off the rest. How AI models and the Gateway work (https://cloudgate.octabyte.io/features#ai-models) .env of any OpenAI client # Any OpenAI client, pointed at the Gateway OPENAI_BASE_URL=https:///ai//v1 OPENAI_API_KEY= ## Where to go next - Built your app with AI? (https://cloudgate.octabyte.io/vibe-coding): The plain-language path from a folder or a template to an address you can share, with your AI doing the deploying if you like. - Everything Cloudgate does (https://cloudgate.octabyte.io/features): Ways in, where it runs, and what it looks after once your app is live: databases, backups, domains, monitoring and access. - Deploy from your terminal with the CLI (https://cloudgate.octabyte.io/cli): For scripts and CI, the cloudgate command uses a personal key, kept apart from your agents' keys. - Plans and prices (https://cloudgate.octabyte.io/pricing): Agents are not counted. A plan counts Servers and Cloud Environments, with a 30-day free trial. ## Questions about AI agents ### Which AI tools can connect to Cloudgate? Any MCP client, such as Claude Code or Cursor. It connects to your console address plus /mcp with an agent key as a bearer token. The console's Connect panel has the configuration for each supported client. ### Can an agent see my secrets? No stored secret reaches it as written. Every tool result, deployment logs included, passes through a mask that replaces stored secrets with ••••••. A value the build prints that Cloudgate never stored is not masked, so do not let builds print secrets. ### What is the difference between the Reader and Operator roles? A Reader reads: Services, Deployments, logs, health and plans, and it can ask for a Plan. An Operator can also deploy, start and stop Services, cancel Deployments and manage previews. Both are limited to the Projects, Environments and Services in their grant. ### Can an agent apply infrastructure changes or turn off alerts? No. An agent can ask for a Plan and read it, but no tool applies or dismisses one, whatever its role. It reads a Service's health and never adds, edits or removes an uptime check or an error-rate threshold, so it cannot silence an incident. ### What happens if an agent gets stuck in a loop? Each Agent has two budgets: 120 reads a minute and 10 writes a minute. A call over budget is answered with HTTP 429 and a Retry-After header, and writes a refused row in the audit log. Calling deploy_service twice while a build is queued joins that build instead of queuing another. ### Can I use an agent key with the REST API or the CLI? No. An agent key works only at the MCP endpoint and the Gateway. The REST API and the console's sign-in routes refuse it. Scripts and the CLI use a personal key instead. ### Are Agents included in every plan? Yes. Agents and the MCP endpoint are part of the Starter plan on the Hosted instance, and of every self-hosted install. See Cloudgate pricing (https://cloudgate.octabyte.io/pricing) for what each plan counts. ## Give your agent a key, not your keys Create an Agent, grant it one Environment, and connect your MCP client. Every plan starts with a 30-day free trial. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Cloudgate features: deploy, run and monitor your apps URL: https://cloudgate.octabyte.io/features # Cloudgate features, from first deploy to production Three ways in, three places to run, and what Cloudgate looks after once your app is live. Every Service sits in a Project and an Environment, and every Deployment is one attempt to build and release it. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) ## On this page - Ways in - Where it runs - Builds - Kinds of Service - Databases - AI models - Domains and TLS - Backups - Previews and rollbacks - Monitoring - Notifications - Variables and secrets - Teams and access - Paid features ## How can I deploy with Cloudgate? From the console, from your AI agent or from your terminal. All three reach the same Projects, under the same roles and grants. - The console: The web console for everything, including the get started steps that take someone new from sign-up to a live app: get a Server, press Deploy, open the address. - Your AI agent: Claude Code, Cursor or any MCP client, as an Agent with its own role, grant and keys. It deploys, opens previews and reads logs and health. How agents deploy over MCP (https://cloudgate.octabyte.io/ai-agents). - Your terminal: The cloudgate CLI on npm: cloudgate deploy uploads the current folder, skipping .env and what .gitignore lists. Then status, logs and vars set. The Cloudgate CLI (https://cloudgate.octabyte.io/cli). - Git, images and uploads: Build from GitHub, GitLab, Bitbucket, Gitea or any git URL, with push-to-deploy through webhooks. Or run a Docker image, or uploaded files. - Project config with Plan and Apply: One cloudgate.yaml describes a Project's Services, kept in your repository or in Cloudgate. A change shows as a Plan of what it would create, change or destroy, and nothing happens until you Apply it. - Templates: Ready-made apps, from WordPress to n8n, each one a Project config. Browse the app templates (https://cgt.octabyte.io/). ## Where do my apps run? On a Server you own, on a Server you buy from us, or in your own AWS or Google Cloud account. Each Environment picks one, so staging and production can live in different places. ### Your Server Any Ubuntu machine Cloudgate reaches over SSH, or the machine Cloudgate itself runs on. A Setup run installs Docker Swarm and Traefik, and Domains get Let's Encrypt certificates. Bought Server. On the Hosted instance, buy one in the console: pick a location on a world map and a size, add backups or extra storage from 10 GB to 10 TB. It is billed monthly in advance on the same invoice, at the price shown before you buy. ### AWS - web, worker, web-private, cron: ECS (Fargate) - PostgreSQL, MySQL: RDS - Redis: ElastiCache - bucket, static sites: S3 and CloudFront - Compose stack: Its own Stack VM ### Google Cloud - web: Cloud Run - worker: Cloud Run worker pool - Databases: Cloud SQL - Redis: Memorystore - bucket: Cloud Storage - Compose stack: Its own Stack VM Cloud resources are made with OpenTofu in your own account. Cloudgate keeps the infrastructure state and shows drift, the changes someone made by hand in the cloud's console. Prefer to run Cloudgate itself on your own machine? Read about self-hosting Cloudgate (https://cloudgate.octabyte.io/self-hosted). ## What does Cloudgate look after once my app is live? Builds, databases, domains, backups, monitoring and access, the same wherever the Service runs. ## How does Cloudgate build my code? With Nixpacks by default, which works out how to build most apps on its own. Pick another builder when your project needs it. - Builders: Nixpacks, Railpack, a Dockerfile, Heroku buildpacks, Paketo buildpacks, or a static site. - Ready-made images: Run a Docker image as it is, with no build at all. - Build logs: Every Deployment keeps its build log, readable in the console, from the CLI and by an Agent. - Builds in the cloud: On the Hosted instance, a Service in AWS or Google Cloud builds in that cloud's own build service, CodeBuild or Cloud Build. ## What kinds of Service can I run? Applications, databases, Compose stacks and AI models, each a Service in an Environment of a Project. - web: An Application with Domains that answers the internet. - worker: Always on, with no address: queues, bots and background jobs. - web-private: Answers HTTP only to the other Services in its Environment, never from outside. - cron: A fresh container per run, on a timetable you set. - bucket: Files behind an S3-compatible API. On a Server it is its own Garage container. - Compose stacks: A Docker Compose file deployed as it is. In a cloud it runs on its own Stack VM. - Sizes: From xsmall (0.25 CPU, 512 MB) doubling up to 2xlarge (8 CPU). - A shell when you need one: Open a shell into a running container from the console. ## Which databases does Cloudgate run? PostgreSQL, MySQL, MariaDB, MongoDB, Redis and libSQL, managed next to your apps, or a database you already have. - On a Server: Each database runs as its own Service, with its own volume, backups and logs. - In a cloud: On AWS, PostgreSQL and MySQL on RDS and Redis on ElastiCache. On Google Cloud, Cloud SQL and Memorystore for Redis. - Existing databases: Point Cloudgate at a database made outside it. It uses it as given and never changes it. - Wired into your apps: Link a database's address into an app with a wired variable, such as DATABASE_URL: pg-1.url, filled in at deploy and never saved. ## Can I host my own AI models? Yes. An AI model is a Service that serves one model with Ollama, vLLM or llama.cpp, on your own Server, optionally reserving whole GPUs. - The Gateway: Every call reaches the model through Cloudgate's Gateway, which speaks the OpenAI API, so any OpenAI client works by changing its base URL. - Spend per caller: The Gateway counts token spend per model and per calling Agent, so each app or agent that calls a model shows on its own line. - Nothing else gets in: An AI model has no Domain and no published port. A caller Agent's key is the only way to call it. - Deployed like any app: Start, stop and redeploy it from the console or by an Agent, as you would an Application. ## How do domains, TLS and CDNs work? Add a domain to a web Service and Cloudgate gets a Let's Encrypt certificate for it. Before that, a free sslip.io address works over plain http. - Certificates: TLS certificates issued and renewed for every Domain on a Server. - CDN providers: Put a Domain behind Cloudflare, Bunny, Fastly or ArvanCloud. - Static sites in AWS: Served from S3 and CloudFront. ## How are backups taken? Databases and volumes are backed up to S3-compatible destinations that you choose. - Your destination: Any S3-compatible storage. Its keys are stored encrypted, like every secret. - Server backups: A Bought Server can add optional server backups and extra storage, from 10 GB to 10 TB. ## What are previews and rollbacks? A preview is a copy of an Application built from a branch, with its own address. A rollback returns a Service to an earlier Deployment. - Pull request previews: One preview per pull request on GitHub. - Requested previews: A preview of any branch, asked for by a person or an Agent, that expires on its own. - Rollbacks: Go back to an earlier Deployment when a release breaks something. ## What does Cloudgate monitor? Servers, Services and the requests reaching them, with incidents opened when something crosses a line you set. - Server thresholds: CPU and memory thresholds per Server. - Uptime checks: Regular checks against your app, with an incident when it stops answering. - Error rate: Counted from Traefik's 5xx responses per Domain, with a threshold of your own. - Traces: Each Service gets its own trace store. - Logs: Build logs, runtime logs and access logs, in the console and from the CLI. - Incidents: Opened and closed by checks and thresholds, and readable by an Agent, which can never silence one. ## Where can alerts go? Send incidents and other notifications to the places your team already reads. - Chat: Slack, Discord, Microsoft Teams, Telegram, Mattermost and Lark. - Email and push: Email, Resend, ntfy, Gotify and Pushover. - Anything else: A custom webhook. ## How are variables and secrets kept? Environment variables live per Project, Environment and Service. Secrets are encrypted at rest and never shown back. - Wired variables: Link one Service's outputs into another, filled in at deploy and never saved. - Secrets stay secret: API responses say only whether a secret is set. Agents see stored secrets masked as ••••••. - From the CLI: cloudgate vars set KEY asks for the value without echoing it. ## How do teams and access work? An Organization has members with roles, and grants decide which Projects, Environments and Services each one reaches. - Roles and grants: A role says what a member may do. A grant says where, down to a single Service. - Agents: AI agents are members too, with a Reader, Operator or Caller role, a grant and their own keys. - Audit log: What people and agents did, including every agent call allowed or refused. - Personal keys: For scripts, CI and the CLI, acting as you. ## Which features are paid? Most of Cloudgate is in every plan. A few features for larger companies are in the Business plan, or an Enterprise license when you self-host. - Business plan: SSO for domains the Organization has proven with DNS, SCIM, custom roles, forward auth in front of your apps, and more Organizations on one plan. - Enterprise license (self-hosted): The same, plus white-labelling, parallel builds and cloud runs, and more than one Organization. ## Where to go from here - Compare plans and what each counts (https://cloudgate.octabyte.io/pricing) - Put an app you built with AI online (https://cloudgate.octabyte.io/vibe-coding) - Let AI agents deploy with guard rails (https://cloudgate.octabyte.io/ai-agents) - Deploy a ready-made app template (https://cgt.octabyte.io/) ## Questions about Cloudgate's features ### Is Cloudgate open source? No. It is source-available under the Elastic License 2.0: free to use, self-host and modify, but you may not offer it to others as a hosted service. See self-hosting Cloudgate (https://cloudgate.octabyte.io/self-hosted). ### Can I deploy to AWS and Google Cloud as well as my own servers? Yes. Connect a Cloud account and an Environment deploys there: on AWS to ECS (Fargate), RDS, ElastiCache, S3 and CloudFront; on Google Cloud to Cloud Run, Cloud SQL and Memorystore. Cloudgate makes them with OpenTofu and shows drift. ### Which git providers does Cloudgate support? GitHub, GitLab, Bitbucket, Gitea, or any git URL, with push-to-deploy through webhooks. A Service can also run a Docker image or uploaded files. ### Does Cloudgate back up my databases? Yes. Backups of databases and volumes go to an S3-compatible destination you choose. ### Can an AI agent use Cloudgate? Yes. An Agent connects over MCP with its own key, role and grant. It can deploy, open previews and read logs and health, and every call is in the audit log. See Cloudgate for AI agents (https://cloudgate.octabyte.io/ai-agents). ### Which features need a paid plan? On the Hosted instance every plan includes deploys, databases, domains, backups, previews, monitoring and Agents. SSO, SCIM, custom roles and forward auth are in the Business plan. See Cloudgate pricing (https://cloudgate.octabyte.io/pricing). ## Put your next app online today Every plan starts with a 30-day free trial. Bring a server, buy one from us, or connect AWS or Google Cloud. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Cloudgate CLI: deploy any folder from your terminal URL: https://cloudgate.octabyte.io/cli # Cloudgate CLI: deploy a folder from your terminal Run one command in your project folder and Cloudgate uploads it, builds it and follows the build log until it is live. The same commands work in a CI job with a key. Install the CLI View on npm (https://www.npmjs.com/package/@octabyte-io/cloudgate) ~/my-app $ npm install -g @octabyte-io/cloudgate@next $ cloudgate login Approve code QXRT-7PLM in the console $ cd my-app # uploads this folder, builds it, follows the log $ cloudgate deploy Uploading 214 files (skipping .env and .git) Building with Nixpacks Deployment done # running? which address? which Deployment? $ cloudgate status web running shop.example.com The CLI is a beta. The current release, 0.0.2-beta.3, is on npm's next tag: npm install -g @octabyte-io/cloudgate@next. The latest tag (0.0.1) is a placeholder. Commands and flags may still change before 1.0; each beta is listed in the Cloudgate changelog (https://cloudgate.octabyte.io/changelog), and the CLI's source is in the Cloudgate repository (https://github.com/octabyte-io/cloudgate/tree/main/cli). ## How do you deploy a folder with the Cloudgate CLI? Four steps. You need Node 22 or newer and a Cloudgate account. Deploy into an Application made in the console, or let the first deploy make a new Project. ### Install it from npm The package is @octabyte-io/cloudgate; the command it installs is cloudgate. Install the beta from the next tag: the latest tag still holds a placeholder. npm install -g @octabyte-io/cloudgate@next ### Log in through your browser The CLI prints a link and a code. Open the link on any device, check the code matches and approve it in the console. This computer then gets a Personal key that ends in 90 days, kept in the system keychain. For a self-hosted Cloudgate, give its address. cloudgate login cloudgate login --instance cloud.example.com # a self-hosted console ### Deploy the current folder The first time, it asks which Project the folder belongs to (or makes a new one), then whether it is one app or the whole Project, and saves that link in .cloudgate/ (added to your .gitignore). It waits for any build already running, uploads, then follows the Deployment log and exits 0 only if the Deployment is done. cloudgate deploy cloudgate deploy --env production # the same Service in another Environment ### Check it is running Status shows whether it runs, its Domains and its latest Deployment. Logs prints what it writes. cloudgate status cloudgate logs -f ## What does cloudgate deploy upload? The folder as it is on your disk, uncommitted changes included, minus anything that should not leave your machine. - Uploaded: Every file in the linked folder, or the current folder when nothing is linked yet, whether committed or not. - Left out by your ignore files: Anything any .gitignore or a .cloudgateignore lists. Both use the same syntax, and! brings a file back. - Always left out: .git, .cloudgate, and .env files except .env.example. Put secrets in with cloudgate vars set KEY. - Only what changed, after the first time: Each deploy compares the folder with the Instance file by file (SHA-256) and uploads only new and changed files; files you deleted are deleted there too. --full sends every file. This needs an Instance at version 0.2.0 or newer; an older one simply gets the full upload. - Warned about: Symlinks are skipped with a warning, and an upload whose zip is over 100 MB names its biggest folders before it goes. ## How do you deploy a whole Project from one folder? Make the folder a Project folder, usually a monorepo's root. Its cloudgate.yaml describes every app, and one cloudgate deploy plans the change, then builds each app from its own subfolder. New in 0.0.2-beta.3. ### Link the whole Project It asks for the Organization, Project and Environment, never a Service, and saves the Project config here as your working copy. cloudgate link --whole-project ### Edit cloudgate.yaml Give each app a subfolder as its source. cloudgate config pull fetches the current config again when a teammate has changed it. ### Plan, then deploy You see what each Environment's Plan creates, changes and destroys, and it applies on a yes. Destroying a Service asks you to type its Config name. Then every app built from a subfolder is uploaded, built and followed to its end. cloudgate config plan # the plan alone cloudgate deploy # the plan, then every app ~/shop - shop/ - cloudgate.yaml - apps/web/ - apps/api/ - .cloudgate/ # Cloudgate keeps this Project's config; # this file is your working copy. version: 1 services: web: kind: web source: { folder: apps/web } api: kind: web source: { folder: apps/api } - A first deploy asks: In a folder with no link, cloudgate deploy asks which Project, or offers to create one, then whether this is one app or the whole Project. - Edits never cross: If the Project config has moved on since your copy, the plan is refused and nothing is sent; config pull brings your copy up to date. - Only apps from a subfolder are built: Apps from a repository or an image, databases and buckets are listed as skipped. --service deploys one app only. - Safe without a terminal: In CI, --yes applies a plan, but still refuses one that destroys a Service or makes a major upgrade. ## Which commands does the CLI have? Every command explains itself with --help. Several take --json for scripts, and every one that acts on a Service takes --org, --project, --env and --service. ### This folder - cloudgate deploy: Upload what changed in this folder and deploy it, then follow the Deployment log until it ends. --full uploads every file. - cloudgate status: Show the Service, whether it is running, its Domains and its latest Deployment. - cloudgate logs: Show the Service's last 100 log lines; -f keeps following, --deployment shows a build log. - cloudgate vars list | set | unset: List, set and unset the Service's variables. Values are never printed. - cloudgate link: Link this folder to a Service, so later commands know where to go. - cloudgate unlink: Remove this folder's link. Nothing changes on the Instance. ### Logging in - cloudgate login: Log in to an Instance through your browser. Add --instance for a self-hosted one. - cloudgate whoami: Show who you are logged in as, where, and when your key ends. - cloudgate instance list: Show the Instances you are logged in to, marking the current one. - cloudgate instance use : Switch the current Instance. - cloudgate logout: Log out and delete this computer's key on the Instance. --all logs out everywhere. ### A Project folder - cloudgate link --whole-project: Link this folder to a whole Project and save its config here as cloudgate.yaml. - cloudgate config pull: Replace this folder's cloudgate.yaml with the Project config as Cloudgate holds it. - cloudgate config plan: Show what your cloudgate.yaml would create, change and destroy, and apply it on a yes. - cloudgate deploy: At the root: plan, then build every app the config builds from a subfolder. ### Templates - cloudgate template try : Start a template's compose part on this computer's Docker, check each Domain answers, then remove it all. Values come from test-values.yaml. - cloudgate template check : Check templates as Cloudgate will read them, without any request. - cloudgate template pack : Build the catalogue.zip a templates release publishes. ## How do you deploy from CI? Use a Personal key instead of logging in. Make one in the console, store it as a secret in your CI, and set it as CLOUDGATE_KEY. A CI job cannot answer questions, so name the target with variables or flags. Add --switch-source if the Service used to deploy from git or an image, and --detach --json to queue the Deployment and move on. A key from CLOUDGATE_KEY is never written to disk. .github/workflows/deploy.yml Any CI job name: Deploy on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 22 - run: npm install -g @octabyte-io/cloudgate@next - run: cloudgate deploy env: CLOUDGATE_KEY: ${{ secrets.CLOUDGATE_KEY }} CLOUDGATE_PROJECT: shop CLOUDGATE_ENV: production CLOUDGATE_SERVICE: web # in your CI job export CLOUDGATE_KEY= export CLOUDGATE_PROJECT=shop export CLOUDGATE_ENV=production export CLOUDGATE_SERVICE=web npm install -g @octabyte-io/cloudgate@next cloudgate deploy --switch-source ## Not working in a terminal? The CLI is one of three ways in. The other two reach the same Projects and Services. ### Put an AI-built app online without a terminal Pick a template or point Cloudgate at your folder, get a server, press Deploy. ### Let your AI agent deploy over MCP An agent gets its own member account, key and grant, and every call it makes is audited. ### Start from an app template Deploy a ready-made app, such as n8n, Ghost or Uptime Kuma, from the console. The CLI works with the hosted console and with a self-hosted Cloudgate (https://cloudgate.octabyte.io/self-hosted). See what the hosted plans cost (https://cloudgate.octabyte.io/pricing). ## Questions people ask ### Which version of Node does the Cloudgate CLI need? Node 22 or newer. The command refuses to start on an older Node and says so. ### Does cloudgate deploy upload my .env file? No. .env and .env.* files are left out (except .env.example), and so is anything your .gitignore or a .cloudgateignore lists. Put secrets in with cloudgate vars set KEY, which asks for the value without showing it. ### Can I use the CLI with a self-hosted Cloudgate? Yes. Run cloudgate login --instance your-console-address. The CLI can be logged in to several Instances at once; cloudgate instance use switches between them. See how to self-host Cloudgate (https://cloudgate.octabyte.io/self-hosted). ### Does the CLI create the app for me? It can create the Project. A first cloudgate deploy in a folder with no link offers Create a new Project: it asks the name and where its apps run (a ready Server, or a Cloud account and region), makes the Project with a production Environment, and saves a starter cloudgate.yaml in the folder. Add your apps there and run cloudgate deploy again. To deploy one app into an existing Project, make the Application in the console first. ### Does cloudgate deploy upload the whole folder every time? No. From version 0.0.2-beta.3 it uploads only the files that are new or changed since the last upload, and deletes on the Instance the files you deleted. Run cloudgate deploy --full to send every file. An Instance older than 0.2.0 always gets the full upload. ### How do I deploy from CI without logging in? Make a Personal key in the console, store it as a secret, and set CLOUDGATE_KEY in the job. Name the target with CLOUDGATE_ORG, CLOUDGATE_PROJECT, CLOUDGATE_ENV and CLOUDGATE_SERVICE, since a CI job cannot answer questions. ## Deploy your first folder today Start a 30-day free trial, make an Application in the console, then run cloudgate deploy from your project folder. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Cloudgate pricing: plans from $15 a month, 30-day trial URL: https://cloudgate.octabyte.io/pricing # Cloudgate pricing: pay for servers, not seats Two monthly plans for the hosted console, each with a 30-day free trial, and a free way to run Cloudgate yourself. Invite as many people and make as many Projects as you like: only Servers and Cloud Environments are counted. ## Plans Hosted at cloudgate.octabyte.app (https://cloudgate.octabyte.app), run by Octabyte ### Starter $15a month For one team running its own apps. - 3 Servers and 3 Cloud Environments - Unlimited members, Projects and Environments - Apps, databases, Compose stacks and AI models - Domains, TLS, backups, metrics and uptime checks - Preview deployments and rollbacks - Agents and the MCP endpoint Start 30-day trial (https://cloudgate.octabyte.app/sign-up) ### Business $35a month For companies with an identity provider. - Everything in Starter - SSO sign-in for your proven domains - SCIM provisioning - Custom roles - Forward auth in front of your apps - Pay for more Organizations on one plan Start 30-day trial (https://cloudgate.octabyte.app/sign-up) On your own server ### Self-hosted $0under the Elastic License 2.0 For teams that want to run Cloudgate themselves. - Install on one Ubuntu 24.04 server - One Organization - One build at a time per Server - No Server or Cloud Environment counts - An Enterprise license adds SSO, SCIM, custom roles, forward auth, white-labelling, parallel builds and more Organizations How self-hosting works (https://cloudgate.octabyte.io/self-hosted) Ask about a license (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise) Add-on, $5 a month: one more Server and one more Cloud Environment, on either plan. Monthly only. A card starts the trial; cancel before it ends and nothing is charged. ## What counts toward a plan? Two things are counted: Servers and Cloud Environments. Each plan includes three of each, and each $5 Add-on raises both by one. An example Organization on Starter Servers2 of 3 Cloud Environments1 of 3 Adding a fourth Server is refused and an Add-on is offered. The three already running keep running. - Members: 14 people, 2 Agentsnot counted - Projects: 9not counted - Environments on Servers: 23not counted - Cloud accounts connected: 2not counted ### Counted - Servers: Every machine you connect over SSH, and every Server you buy from Cloudgate. - Cloud Environments: An Environment that deploys to AWS or Google Cloud. It counts once, however many cloud accounts or regions it uses. ### Not counted - Members: Invite your whole team, and give AI agents their own member accounts. - Projects and Environments: Make as many as you need on your Servers. Connecting a cloud account is free too. ### What happens if you go over? Only the next addition is refused. If your plan holds three Servers and you try to add a fourth, Cloudgate says no and offers an Add-on. Nothing running is switched off, and no app is stopped because of a count. ## What do you pay your server or cloud provider? Your plan pays for Cloudgate. The machines and cloud resources your apps run on are billed separately, and who bills you depends on where they come from. - Servers you bring: Billed by your provider, as they are today. Cloudgate connects to them over SSH and is not part of that bill. - Servers you buy from Cloudgate: Billed by us, monthly in advance on the same invoice as your plan, at the provider's price plus a markup. You see the full price before you buy. - AWS and Google Cloud resources: Billed by AWS or Google to your own cloud account. Cloudgate creates the resources there for you, and the bill for them stays between you and your cloud. - Self-hosted: You pay for the server Cloudgate runs on, plus whatever your apps run on. Cloudgate itself is free unless you buy an Enterprise license. ## What does a month cost? Three setups, worked out from the prices on this page. Each total is what you pay Cloudgate; your servers and cloud resources are billed on top as described above. ### One team, two servers you already have Starter - Starter plan: $15 - Sum: $15 $15a month to Cloudgate, plus your servers Two Servers fit inside the three Starter includes. ### One team, five servers Starter + 2 Add-ons - Starter plan: $15 - 2 Add-ons at $5: $10 - Sum: $15 + 2 × $5 $25a month to Cloudgate, plus your servers Each Add-on raises Servers and Cloud Environments by one. ### A company that needs SSO, with four servers and one AWS environment Business + 1 Add-on - Business plan: $35 - 1 Add-on at $5: $5 - Sum: $35 + $5 $40a month to Cloudgate, plus your servers The fourth Server needs one Add-on; the Cloud Environment fits in the three included. AWS bills its own resources to you. ## How do the plans compare? Every way of running Cloudgate deploys the same things. The differences are who runs it, what is counted, and the identity features larger companies ask for. Weighing other platforms too? See how Cloudgate compares with Heroku, Vercel, Render and Coolify (https://cloudgate.octabyte.io/compare). Show one plan Starter Business Self-hosted Enterprise | Starter | Business | Self-hosted, free | Self-hosted, Enterprise license | Price and counts | Price | $15 a month | $35 a month | Free | Agreed with you | Free trial | 30 days, card needed | 30 days, card needed | Not needed | 30-day trial key on request | Servers | 3, then $5 per Add-on | 3, then $5 per Add-on | Not counted | Not counted | Cloud Environments | 3, then $5 per Add-on | 3, then $5 per Add-on | Not counted | Not counted | Members, Projects, Environments | Not counted | Not counted | Not counted | Not counted | Organizations | One, paying for itself | Pay for more on one plan | One | More than one | Deploying | Apps, databases, Compose stacks, AI models | Included | Included | Included | Included | Your own Servers, AWS and Google Cloud | Included | Included | Included | Included | Buy a Server from Cloudgate | Included | Included | Not included | Not included | Agents and the MCP endpoint | Included | Included | Included | Included | Builds and cloud runs | Run by Octabyte | Run by Octabyte | One at a time per Server | In parallel | Access and identity | Roles, grants and audit log | Included | Included | Included | Included | SSO for your proven domains | Not included | Included | Not included | Included | SCIM provisioning | Not included | Included | Not included | Included | Custom roles | Not included | Included | Not included | Included | Forward auth in front of apps | Not included | Included | Not included | Included | White-labelling | Not included | Not included | Not included | Included | Running it | Who runs Cloudgate | Octabyte | Octabyte | You | You | Console address | cloudgate.octabyte.app | cloudgate.octabyte.app | Your server | Your server | ### Need something the plans don't cover? Enterprise is a custom deal on the hosted console, with counts set for you and the Business features included. For a self-hosted Enterprise license we agree the price and billing period with you. Write to support@octabyte.io (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise). Email support@octabyte.io (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise) Not sure where to start? Deploy an app from a template (https://cgt.octabyte.io/) during the trial, read what Cloudgate does (https://cloudgate.octabyte.io/features), or see how AI agents deploy through Cloudgate (https://cloudgate.octabyte.io/ai-agents). ## Questions people ask ### How does the free trial work? Both hosted plans start with a 30-day free trial. You get the plan's full counts from day one, Add-ons cost nothing until the trial ends, and you can switch between Starter and Business while the clock runs. A Server you buy from Cloudgate is charged from the day you buy it, trial or not. ### Do I need a card to start the trial? Yes. A card is needed to start it, and each Organization, person and card gets one trial. If the trial ends without a card or you cancel, nothing is charged. ### Can I cancel at any time? Yes. Plans are paid monthly, with no yearly contract. Moving up to Business takes effect at once and is charged prorated; moving down to Starter takes effect at the end of the paid month and can be taken back until then. ### What is a Cloud Environment? An Environment that deploys to a cloud account (AWS or Google Cloud). It counts once against your plan however many cloud accounts or regions it uses. Connecting a cloud account counts nothing. ### What happens when I go over my plan? Only the next Server or Cloud Environment you try to add is refused. Nothing already running is stopped. Buy an Add-on for $5 and you can add one more of each. ### Can I self-host Cloudgate for free? Yes. You can run Cloudgate on your own Ubuntu server for free under the Elastic License 2.0, with one Organization and one build at a time per Server. An Enterprise license unlocks the rest. See how to self-host Cloudgate (https://cloudgate.octabyte.io/self-hosted). ### Is Cloudgate open source? No. Cloudgate is source-available under the Elastic License 2.0: you can use, self-host and modify it for free, but you cannot offer it to others as a hosted service. ### Do you offer custom or yearly deals? Yes, through Enterprise. Email support@octabyte.io (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise) and we agree the price, the counts and the billing period with you. ## Put your next app online today Every plan starts with a 30-day free trial. Bring a server, buy one from us, or connect AWS or Google Cloud. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Self-host Cloudgate on your own Ubuntu server for free URL: https://cloudgate.octabyte.io/self-hosted # Self-host Cloudgate on your own server Cloudgate installs on one Ubuntu server with a single command. It is free to run under the Elastic License 2.0, with one Organization and one build at a time per Server, and an Enterprise license for the rest. See the install steps Compare with the hosted plans (https://cloudgate.octabyte.io/pricing) ## Should you self-host or use the hosted console? Both run the same Cloudgate and deploy to the same places. The question is whether you want to look after Cloudgate itself. ### Self-host if - You have to keep the deployment platform inside your own network or provider. - You are comfortable running an Ubuntu server: updates, backups and a firewall. - One Organization is enough, or you plan to buy an Enterprise license. - You want to read or change how Cloudgate works. ### Use the hosted console if - You want to sign up and deploy today, with nothing of ours to install or upgrade. - You want to buy a server from us instead of finding one yourself. - You want SSO and SCIM on a monthly plan, without a license agreement. - You built an app with an AI tool and just want it online. Hosted plans start at $15 a month (https://cloudgate.octabyte.io/pricing) with a 30-day free trial. New to deploying? Read how to put an AI-built app online (https://cloudgate.octabyte.io/vibe-coding). ## What does the server need? One bare machine. The installer was proved on exactly this size, and it is enough to run Cloudgate and deploy small apps onto the same box. Check that no cloud firewall in front of the server blocks ports 3000 and 4000. A blocked port looks exactly like a broken install. - Operating system: Ubuntu 24.04, freshly installed - Processor: x86-64 (amd64) - Size: 2 vCPU, 4 GB memory, 40 GB disk - Access: root over SSH - Open ports: 22, 80, 443, 3000 and 4000, inbound - DNS: None to start. Apps get a free sslip.io address that points at your server’s IP. - 22SSH - 80http - 443https - 3000Console - 4000API ## What does the installer set up? One script, deploy/install.sh, installs Cloudgate natively on the host. There is no container image of Cloudgate itself: it deploys containers, it does not ship as one. - Cloudgate under systemd: The console and the API run as two Node services that restart on their own. Node comes from nodejs.org, checksum-verified. - PostgreSQL on the box: Cloudgate's own database, with a generated role and password kept in a root-only file. - Docker and a Swarm of one: The server becomes a one-node Docker Swarm, so it can run what you deploy straight away. - Traefik: Routes each app's address and gets Let's Encrypt certificates once you add a domain. - Build and cloud tools: Nixpacks for builds, and OpenTofu with pinned providers for deploying to AWS and Google Cloud. - A firewall: ufw with SSH, 80, 443, 3000 and 4000 allowed. Ports Docker publishes later go around it, so treat a database's external port as public. ### Who owns the instance? The first person to sign up. Open http://:3000/sign-up when the installer finishes; your account owns the instance and sign-up closes behind you. Everyone after that joins by invitation. ## How do you install it? One command on the server, then one sign-up in your browser. The command is safe to run again, and running it again is how you upgrade. ### Prepare the server A fresh Ubuntu 24.04 machine with the ports above open, reached as root over SSH. ### Run the install command It clones Cloudgate into /opt/cloudgate, finds the server's public IP address and installs everything. It stops early on anything but Ubuntu 24.04 on x86-64. curl -fsSL https://cloudgate.octabyte.io/install.sh | sudo sh Using a hostname, or a different address? Name it with CLOUDGATE_PUBLIC_HOST; it is built into the console. curl -fsSL https://cloudgate.octabyte.io/install.sh | sudo CLOUDGATE_PUBLIC_HOST=cloud.example.com sh ### Claim the instance Open http://:3000/sign-up and create the first account. Then add the server under Servers and deploy your first app, or start from one of the app templates (https://cgt.octabyte.io/). ### Read it before you run it Cloudgate's source is public on GitHub. The command runs install.sh (https://github.com/octabyte-io/cloudgate/blob/main/install.sh), which hands over to deploy/install.sh (https://github.com/octabyte-io/cloudgate/blob/main/deploy/install.sh). To read it first, download it with -o install.sh in place of | sudo sh. The self-hosting guide (https://cloudgate.octabyte.io/docs/self-host) covers the security notes, upgrades and backups in full. Found a bug or missing a feature? Open an issue on the repository; CONTRIBUTING.md (https://github.com/octabyte-io/cloudgate/blob/main/CONTRIBUTING.md) says how to send a change. View the source on GitHub (https://github.com/octabyte-io/cloudgate) ## How do upgrades and backups work? On your own server, both are your job. They are short, and the secrets file is the part not to lose. ### Upgrading Run the install command again. It fast-forwards /opt/cloudgate, reuses the address the last install was given, migrates the database, rebuilds, restarts both services, and reads your existing secrets back instead of making new ones. root@your-server curl -fsSL https://cloudgate.octabyte.io/install.sh | sudo sh ### Backing up Cloudgate itself Cloudgate backs up the databases and volumes you deploy. Back up Cloudgate on its own: the cloudgate PostgreSQL database, the files /etc/default/cloudgate-*, and the folder /etc/cloudgate. Keep them off the server. Without the encryption secret in /etc/default/cloudgate-secrets, stored keys and passwords in the database cannot be read again. Back up both together. Out of the box the console and API answer on plain http at ports 3000 and 4000. Before you give the server a public address, decide whether that is acceptable, or reach the console over an SSH tunnel or a private network. ## What does the Elastic License 2.0 let you do? Almost everything a team running its own deployments needs, for free. Cloudgate is source-available, not open source. ### You can - Use Cloudgate inside your company, for any apps you run - Run it on as many of your own servers as you like - Read the source and change it for your own use ### You can't - Offer Cloudgate to others as a hosted or managed service - Remove, disable or get around its license checks - Remove its license and copyright notices The Elastic License 2.0 in plain English, with worked cases (https://cloudgate.octabyte.io/license) ## What does an Enterprise license add? The free version deploys everything Cloudgate can deploy. A license unlocks the features larger teams ask for, and they stay on as long as the license is valid. ### Free $0 under the Elastic License 2.0 - Apps, databases, Compose stacks, AI models: Yes - Servers, AWS and Google Cloud: Yes, not counted - Agents and the MCP endpoint: Yes - Organizations: One - Builds and cloud runs: One at a time per Server - SSO, SCIM and custom roles: No - Forward auth in front of apps: No - White-labelling: No ### Enterprise license Agreed with you 30-day trial key on request - Apps, databases, Compose stacks, AI models: Yes - Servers, AWS and Google Cloud: Yes, not counted - Agents and the MCP endpoint: Yes - Organizations: More than one - Builds and cloud runs: In parallel - SSO, SCIM and custom roles: Yes - Forward auth in front of apps: Yes - White-labelling: Yes Ask about a license (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise%20license) Prices are agreed with each customer, and a 30-day trial key is available. Write to support@octabyte.io (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise%20license). If a license ends, your settings are kept and the licensed features stop; nothing is deleted. See every plan side by side on the Cloudgate pricing page (https://cloudgate.octabyte.io/pricing), or what the platform does on the features page (https://cloudgate.octabyte.io/features). ## Questions people ask ### Is self-hosted Cloudgate really free? Yes. The Elastic License 2.0 lets you use, self-host and modify Cloudgate without paying. The free version holds one Organization and runs one build at a time per Server. You pay only for the servers you run it on. ### Is Cloudgate open source? No. It is source-available under the Elastic License 2.0, and the source is public on GitHub (https://github.com/octabyte-io/cloudgate). You can read, run and change it, but you may not offer it to others as a hosted service, and you may not remove or get around its license checks. ### Do I need a domain name to install it? No. The installer works with your server’s IP address, and deployed apps are reachable at a free sslip.io address straight away. Add your own domain later for https. ### Can I deploy to the same server Cloudgate runs on? Yes. Cloudgate can deploy onto the machine it runs on, and you can add more Ubuntu servers over SSH, or connect AWS and Google Cloud accounts. ### How do I upgrade a self-hosted instance? Run the same install command again. It fast-forwards /opt/cloudgate to the latest version, reuses the address the last install was given, migrates the database, rebuilds and restarts Cloudgate, and keeps your secrets. ### What does an Enterprise license cost? We agree the price and billing period with each customer, and a 30-day trial key is available on request. Write to support@octabyte.io (mailto:support@octabyte.io?subject=Cloudgate%20Enterprise%20license). ## Rather not run it yourself? The hosted console is the same Cloudgate, kept up to date by us. Start a 30-day free trial and deploy to a server you bring or one you buy from us. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: About Cloudgate: a deployment platform for servers you own URL: https://cloudgate.octabyte.io/about # About Cloudgate Cloudgate is a deployment platform you point at machines you own: your own servers, your AWS account or your Google Cloud project. It builds and runs your apps, databases and AI models there, with domains, certificates, backups and monitoring built in. See what it does (https://cloudgate.octabyte.io/features) Contact us (https://cloudgate.octabyte.io/contact) Ways in - The console - Your AI agent - Your terminal Places to run - Your own Server - AWS - Google Cloud ## What is Cloudgate? A deployment platform that runs on your infrastructure, not on ours. You bring the machines, Cloudgate does the deploying. - It deploys to Servers you connect: Any Ubuntu machine over SSH, or the machine Cloudgate itself runs on. Cloudgate sets it up with Docker Swarm and Traefik, and gets Let's Encrypt certificates for your domains. - And into your cloud accounts: On AWS it uses ECS, RDS, ElastiCache, S3 and CloudFront; on Google Cloud, Cloud Run, Cloud SQL and Memorystore. Cloudgate makes them with OpenTofu and shows drift when someone changes them by hand. - It runs whole apps: Web apps, workers, cron jobs, static sites, Compose stacks, managed databases and AI models, organised as Organization, Project, Environment and Service. ## Why does Cloudgate exist? Because putting an app online should not mean handing your infrastructure to a platform. Cloudgate gives the Heroku-style experience on machines you already own or can buy, and it was built for three kinds of user from the start. ### People who build with AI You made an app with an AI tool and want it online. Pick a template or point Cloudgate at your folder, get a server from us or bring your own, press Deploy, get an address. How to put an AI-built app online (https://cloudgate.octabyte.io/vibe-coding) ### AI agents An Agent is a member of your Organization with its own role, grant and keys. Over MCP it can deploy, read logs and health, and open previews that expire, and every call is in the audit log. How AI agents deploy with Cloudgate (https://cloudgate.octabyte.io/ai-agents) ### Developers and teams Push-to-deploy from git, a terminal command, or one cloudgate.yaml reviewed as a Plan, on your own servers, AWS or Google Cloud, with roles and grants for everyone. Deploy from your terminal with the CLI (https://cloudgate.octabyte.io/cli) ## How is Cloudgate built? One backend, one web console and a command-line tool, written in TypeScript and developed together. - A backend and a console: A single NestJS application holds the API, the deploy engine and the job queue, with PostgreSQL as its database. The console is a Next.js app written against that API. - A CLI on npm: @octabyte-io/cloudgate logs in through the console, uploads a folder, follows the build and sets variables by name. It is still early: the newest release is a beta on npm's next tag. - An MCP endpoint for agents: Built into the backend at your console's address plus /mcp, with rate limits, an audit row for every call and a mask over every result. - Decisions written down: Every architecture decision is a short record with the alternatives that were rejected, in the repository's docs/adr (https://github.com/octabyte-io/cloudgate/tree/main/docs/adr), and the product's words (Server, Project, Environment, Service, Deployment, Plan) mean one thing each, in the code and on this site. ## How is Cloudgate licensed? Cloudgate is source-available under the Elastic License 2.0. Anyone, a person or a business, may use, self-host and modify it for free. You may not offer Cloudgate to others as a hosted service, or work around the license checks that protect its paid features. The source is public on GitHub (https://github.com/octabyte-io/cloudgate): read it, run it on your own server, and open an issue when something is wrong. The hosted console at cloudgate.octabyte.app (https://cloudgate.octabyte.app) runs the same Cloudgate. Read the license in plain English (https://cloudgate.octabyte.io/license) View the source on GitHub (https://github.com/octabyte-io/cloudgate) Or read how to self-host Cloudgate on one server (https://cloudgate.octabyte.io/self-hosted). ## Who makes Cloudgate? Cloudgate is made by Octabyte (https://octabyte.io), which also runs the hosted console and the public catalogue of app templates. Cloudgate is feature-complete for its first release, and the server reports version 0.2.0. Everything that changes for the people who run it is written up release by release in the Cloudgate changelog (https://cloudgate.octabyte.io/changelog). Questions, sales or a security report: every route is on the contact page (https://cloudgate.octabyte.io/contact), and how we protect your apps is on the security page (https://cloudgate.octabyte.io/security). Bug reports, feature ideas and pull requests are welcome on GitHub; CONTRIBUTING.md (https://github.com/octabyte-io/cloudgate/blob/main/CONTRIBUTING.md) says how to set up, test and send a change. ## Put your next app online today Every plan starts with a 30-day free trial. Bring a server, buy one from us, or connect AWS or Google Cloud. Start free trial (https://cloudgate.octabyte.app/sign-up) Deploy a template (https://cgt.octabyte.io/) --- Page: Cloudgate changelog: what is new in each release and beta URL: https://cloudgate.octabyte.io/changelog # Cloudgate changelog What changed for the people who use and run Cloudgate, newest first. The platform's releases are numbered from 0.2.0; the command-line tool has numbered beta releases on npm. Read the latest changes See every feature (https://cloudgate.octabyte.io/features) Releases - 0.2.0: the platform (13 November 2026) 24 changes - CLI 0.0.2-beta.3 5 changes - CLI 0.0.2-beta.2 1 change - CLI 0.0.2-beta.1 3 changes New here? Start with AI agents over MCP (https://cloudgate.octabyte.io/ai-agents), the Cloudgate CLI (https://cloudgate.octabyte.io/cli) or self-hosting (https://cloudgate.octabyte.io/self-hosted). ## 0.2.0: the platform (13 November 2026) The first numbered release of the Cloudgate server, on the Hosted instance and in a self-hosted install. It is the first version that takes an upload of only the changed files. The Cloudgate CLI works with 0.1.0 and newer. ### The Hosted instance updates itself to each release Each new version of Cloudgate that passes the full test run now reaches the Hosted instance by itself, with a backup taken first. A release that needs a manual step on upgrade waits for a person instead. Self-hosted installs still upgrade when you run the install command again. ### The source is public on GitHub Cloudgate’s source repository, github.com/octabyte-io/cloudgate (https://github.com/octabyte-io/cloudgate), is public. Self-hosting needs no access request (see how to self-host Cloudgate (https://cloudgate.octabyte.io/self-hosted) ). Bug reports, feature ideas and pull requests are welcome as GitHub issues, as CONTRIBUTING.md describes, and a security problem is reported privately on the repository’s Security tab, under Report a vulnerability. The license is still the Elastic License 2.0. ### Self-hosting is one command On a bare Ubuntu 24.04 server, curl -fsSL https://cloudgate.octabyte.io/install.sh | sudo sh installs Cloudgate. It checks the server, clones the public repository into /opt/cloudgate (or brings the copy already there up to date) and runs the installer. The address the console is built for is now optional: a first install uses the server’s public IP address, and running the command again reuses the address the last install was given. Running it again is also how you upgrade. An install made while the repository was private may still fetch over SSH; point it at https://github.com/octabyte-io/cloudgate.git first. ### Fixes to uploads, Project folders and sign-out - Uploads larger than 10 MB through the console’s address no longer fail with an error after four minutes. - A deploy no longer reports the build’s own .env file as deleted, and skips the upload when nothing changed since the last one. - A plan line that removes a setting now says so, for example build.context (removed). - Deploying one app from its own folder inside a Project folder uploads the whole Project folder, so code shared between apps is included and the config entry is left as it was. - Applying a Plan in a root cloudgate deploy no longer starts a doomed rebuild of each folder app from its previous upload. - A relative build.context is counted from the app’s build path. - An upload that loses its connection to the build host stops instead of carrying on. - Personal key names can be up to 255 characters again, where a sign-in library limit refused names over 32. - Signing out also clears the session cookie of the other instance mode. - cloudgate config plan exits 1 when you answer no, so scripts can tell it from an apply. ### A deploy uploads only the files that changed An Instance at 0.2.0 compares the folder you deploy with what its build host already holds, file by file, and takes only the files it lacks or holds different. Files deleted on your side are deleted there too, and the new set of files replaces the old one only once every file matches; if the files changed meanwhile, the old set is left as it was. The Cloudgate CLI uses this from 0.0.2-beta.3 on; an older Instance still gets the full upload. ### One folder for a whole Project, and a config that knows its version A Project config now has a version that moves with every Apply and every saved change. A whole-file edit that started from an older version is refused, saying when the config last changed and who changed it, so two people editing the same Project cannot overwrite each other. Cloudgate can also list which apps a Project builds from a subfolder of one folder, which is what a root cloudgate deploy builds. An app built from a folder is never built before its first upload, where before that first Deployment ran with no files and failed. ### Deploy an app from the templates website, with no server and no account yet Each “Deploy” button on the templates website now opens the console’s Get started wizard: three steps for someone who has never used a deployment tool. Sign up or sign in on the way, then get a Server (buy one from Cloudgate, or use your own: the wizard makes a key and gives you the one command to run), then press Deploy. Cloudgate applies the setup by itself once the Server is ready and shows Open with its address. The free sslip.io address is plain http; add your own domain for https. ### Buy a Server from Cloudgate on the Hosted instance Servers has a new Buy a Server page: a world map of locations sorted by distance, the sizes sold there, optional backups and extra storage from 10 GB to 10 TB, and a summary with the monthly price and exactly what is charged today. Bought Servers are paid monthly in advance on the same invoice as the plan. Nothing is made until the payment succeeds, Cloudgate runs the first setup by itself, and a machine the provider refuses is refunded in full. Resize, add backups or grow storage from the Server’s settings; Delete credits the unused part of the month. ### Templates come from the official Template catalogue and are set up as a Plan The Templates screen reads the official catalogue on a fresh install, with nothing to configure. Its first release holds 20 apps, among them Ghost, n8n, Nextcloud, Plausible Analytics, Uptime Kuma, Vaultwarden and WordPress. A Template is an ordinary Project config (cloudgate.yaml), so setting one up is an ordinary Plan you review and Apply. Every generated password is made once from a secure source, kept encrypted and never shown in the Plan. The older template.toml format is gone. ### The Template catalogue is one zip, checked whole Each catalogue release is now one catalogue.zip, checked in memory before anything in it is read. A zip with anything a template does not need, an unsafe path, a symlink or an oversized payload is refused as a whole, and the screen keeps the last good copy. ### Compose stacks in a cloud: resize, grow the disk, replace the VM A Compose stack in an AWS or Google Cloud account runs on its own Stack VM. Resizing it, growing its data disk or replacing the VM with a newer pinned image is now a line in the Environment’s Plan, with the old and new monthly price. Stop stops the VM too, so a stopped stack pays only for its disk; Start brings it back as it was; Restart restarts the containers without touching the VM. ### Changing an Application’s port moves its Domains Change an Application’s port and every Domain on the old port moves to the new one in the same step, instead of answering 502 until each is edited. The console says which Domains moved and which stayed. ### One Organization that pays for itself per person, and attached ones on Business On the Hosted instance a person can own one Organization that pays for itself. On Business, that Organization can pay for more. Every member of an attached Organization can see who pays for it. ### Self-hosted: one Organization without a license A self-hosted install holds one Organization for free. An Enterprise license adds more, alongside SSO, SCIM, custom roles, forward auth, white-labelling and parallel builds. An install that already has several keeps them all; only a new one is refused. ### A safer Hosted instance: https only, a Secure session cookie, and a check at sign-up The Hosted instance serves one hostname over https with a Let’s Encrypt certificate, its session cookie is Secure, and its sign-up form asks for a Cloudflare Turnstile check. A confirmation email goes to one address at most once every five minutes. ### On the Hosted instance the paid features come with a plan, not a license key On the Hosted instance SSO, SCIM, custom roles and forward auth come with the Business plan or an Enterprise deal. A self-hosted install still unlocks them with its license key. ### Cloud builds run in your cloud’s own build service On the Hosted instance a Service in an AWS account builds in CodeBuild in that account, and one in Google Cloud builds in Cloud Build in that project. The build log streams live into the Deployment log, Cancel stops the cloud build, and the source goes up without its .git folder, so no git token leaves Cloudgate. A private registry password reaches the build only through the cloud’s own secret store and is deleted when the build ends. ### Hosted billing: one plan, Add-ons, and never switching a Server off The Hosted instance sells one monthly plan that counts 3 Servers and 3 Cloud Environments, and an Add-on for one more of each. Going over a count refuses only the next addition: nothing running is ever switched off by billing. ### Exact machine sizes on AWS and Google Cloud Name a native database class, cache node type or container CPU and memory in the Project config and it wins over size in that cloud, while size still counts on every other target. The Plan shows both, and taking the setting out never shrinks a machine to the smallest. ### Cloud settings in the Project config: native.aws and native.gcp A Service in the Project config can carry the cloud provider’s own settings for what Cloudgate makes: ECS, RDS, ElastiCache, S3 and CloudFront on AWS; Cloud Run, Cloud SQL and Memorystore on Google Cloud. Every Plan checks them against the pinned provider schema, so a typo shows on any Plan, not on the first cloud deploy. Settings that would widen access, drop deletion protection or lose data are locked, and every locked setting names its reason. ### Swarm settings in the Project config: native.docker A Service on a Server can carry its Swarm settings (labels, health check, restart, update and rollback policy, stop grace period and ulimits) in the Project config, written exactly as the Docker Engine API takes them. The Generator writes your current values into the file, so the first Plan changes nothing. ### Agents and the MCP endpoint An Organization can now have Agents: members an AI tool acts as, each with a role (Reader or Operator), grants to the Projects, Environments and Services it may reach, and its own agent keys. An Agent connects to your console’s address followed by /mcp. Every call it makes is a row in the audit log, allowed or refused, and every result passes through a mask that hides stored secrets. Create one under Settings, Agents; its Connect panel has the configuration for each supported client. ### API keys are now personal keys Existing API keys keep working, now called personal keys. Creating, listing or deleting keys needs a signed-in console session, so deleting a key really revokes it, and new keys expire after 90 days unless you choose otherwise. Give an AI agent an Agent with an agent key, never your personal key. ### Smaller additions for the CLI The server gained what the Cloudgate CLI calls: a public “is this a Cloudgate” check the CLI asks before it sends a key, a device login approved in the console, a key that can delete itself on logout, a Service’s variables set and unset by name and never shown, a Deployment’s status, and a Runtime log that can be read as a tail. Uploading a whole project folder of several MB now builds, and an upload during a running build is refused instead of pulling files out from under it. ## CLI 0.0.2-beta.3 ### Deploy uploads only the files that changed cloudgate deploy sends a list of the folder’s files with a checksum of each, and uploads only the ones the Instance lacks or holds different. Files you deleted are deleted there too. It says what it sent, such as Uploading 3 changed files, 12.0 kB (211 unchanged, 1 deleted), and its sizes and the 100 MB warning are about the zip actually sent. --full sends every file. An Instance older than 0.2.0 gets the full upload, with no error and no question. ### Project folders: link --whole-project, config pull and config plan A folder, usually a monorepo’s root, can be linked to a whole Project rather than one Service. cloudgate link --whole-project saves the Project config there as cloudgate.yaml, your working copy. cloudgate config pull replaces it with the current config, asking first if you have edited it. cloudgate config plan shows what each Environment’s Plan creates, changes and destroys, and applies it on a yes; destroying a Service or a major upgrade needs its Config name typed, and --yes in CI still refuses both. A copy the config has moved on from is refused, sending nothing. ### A root cloudgate deploy deploys every app built from a subfolder In a Project folder, cloudgate deploy runs the same plan step first, then uploads the folder to each app whose config entry names a subfolder of it (source: { folder: apps/web }), builds each, and follows every build to its end, with one line per app at the end. Apps from a repository or an image, databases and buckets are listed as skipped. --service deploys one app only. ### A first deploy asks which Project, or creates one In a folder with no link, a first cloudgate deploy in a terminal asks which Project, plus Create a new Project, then whether this is one app or the whole Project. A new Project gets its name (the folder’s by default), a production Environment on a ready Server or a Cloud account and region you pick, and a starter cloudgate.yaml in the folder to add your apps to. In CI, or with a target flag or variable, nothing new is asked. ### cloudgate template try and test-values.yaml, for template authors cloudgate template try