Install with your coding agent
This page gives one block of instructions to paste into a coding agent (Claude Code, Cursor, any agent with a shell) so that it installs a Vaubaan Gateway instance with Docker Compose on a host it can reach, asks you for what only you know, and verifies the result. The first sign-in and the approval of a mission stay with you, in a browser.
Run the agent on the host that will serve the instance, or on a machine with shell access to it.
The block
Install Vaubaan Gateway, an open source MCP gateway, on this host with Docker Compose.
Docs: https://vaubaan.com/docs/install/docker-compose (Markdown: append .md to any docs URL).
It is pre-release: no image is published, you build it from the repository.
Before you start, ask me and wait for the answers:
1. The DNS name of the instance (for example gateway.example.com). It must already point at this host,
and ports 80 and 443 must be reachable from the internet (the bundled Caddy proxy obtains the certificate).
2. The email address(es) of the administrators.
3. How people will sign in: my company's OpenID Connect provider, or GitHub. I will add it in the
interface after the first sign-in unless I give you its client id and secret now.
Check that Docker with Compose v2, git, openssl and Node.js 20 or later are installed. Do not install
anything else without asking me.
Then run, from a directory of my choice:
git clone https://github.com/vaubaan/gateway.git
cd gateway
cp deploy/config/.env.example deploy/config/.env
cp deploy/config/gateway.example.yaml deploy/config/gateway.yaml
npm run gen-master-key
openssl rand -hex 24
Edit deploy/config/.env only (leave gateway.yaml as copied, every key commented out):
- GATEWAY_DOMAIN = the DNS name
- VAUBAAN_PUBLIC_URL = https:// followed by the DNS name
- VAUBAAN_ADMIN_EMAILS = the administrators' addresses, comma-separated
- VAUBAAN_MASTER_KEY = the output of npm run gen-master-key
- VAUBAAN_BOOTSTRAP_TOKEN = the output of openssl rand -hex 24
Never print the master key or the bootstrap token in your answers or logs, never commit
deploy/config/.env, and tell me to keep a copy of the master key outside this host: losing it
loses every stored credential.
Start it:
docker compose --env-file deploy/config/.env -f deploy/compose.yaml up -d --build
Verify:
- curl -s https://<the DNS name>/healthz answers {"status":"ok", ...} with a version and a commit.
- If the container exits with code 78, read its log: it names every missing or invalid key; fix .env
and start again.
Finish by telling me:
- to open https://<the DNS name>/login, follow the bootstrap link and paste the bootstrap token
(give me the command that prints it from .env, not the value);
- to add the sign-in provider on Settings → Administration → Sign-in, then sign in through it;
- where the docs for connecting accounts and creating missions are: https://vaubaan.com/docs/providers
and https://vaubaan.com/docs/missions.
Afterwards: a mission for the agent
Once you have signed in and connected an account, an agent can prepare its own mission through the management door, in your name and within what you may allow: you authorize it once in the browser, it previews a policy and issues the mission, and the answer carries the mission key and the configuration for the agent that will do the work. Requests the mission raises later — more of a limit, an approval — are answered by you alone, in the interface.
With Claude Code:
claude mcp add --transport http vaubaan-manage https://your-domain/mcp/manage
# then, inside Claude Code: /mcp → vaubaan-manage → Authenticate
Or create the mission yourself in the interface (Missions → New mission) and give the agent its kit: see missions and agents.