Self-host the dashboard
Plan a licensed independent installation and connect CLI devices to its own API and browser origin.
On this page
The self-host bundle runs Dashboard v1 behind Caddy with PostgreSQL and an installation-bound license. It is independent of Beam Cloud. Use a tested release with matched dashboard and maintenance image digests, and keep deployment secrets outside source control.
Prepare the installation
Your operator needs a stable HTTPS hostname, the release images, an issued license, an installation ID, and securely generated application/bootstrap secrets. The bundle is in deploy/self-host and includes the Compose file, environment template, proxy configuration, and maintenance instructions.
Database setup and upgrades are explicit operator maintenance steps. Ordinary application startup does not change schema. Review release changes and back up an existing installation before any schema operation. The bundled application liveness endpoint does not establish schema readiness.
Bootstrap workspace access
After the operator initializes the installation, open /onboarding using the configured bootstrap email and private bootstrap token. Create the workspace, invite a second administrator, and test a lower-privilege account. Rotate the bootstrap token after setup.
Subsequent registrations require private invitation links. Protect them as credentials and verify domain and seat restrictions. Platform staff access is separate from workspace ownership.
Connect the CLI
npm install -g @agent-beam/[email protected]
export BEAM_API_URL=https://beam.example.com
export BEAM_DASHBOARD_URL=https://beam.example.com
beam connect
Replace the hostname with your installation and keep both variables in the environment used by the CLI. Re-enroll devices when moving from Cloud to this independent workspace. Do not replace the local loopback collector URL with the remote hostname.
The MCP server remains a local stdio process. Its scanning tools do not automatically upload results; connecting a self-hosted dashboard does not turn it into a hosted MCP HTTP endpoint.
Configure App monitoring
App monitoring works without extra settings. These optional dashboard environment variables keep its data inside your network:
| Variable | Purpose |
|---|---|
APP_MONITOR_LLM_BASE_URL | OpenAI-compatible gateway for LLM review by the dashboard, such as Azure OpenAI, vLLM, or a LiteLLM or Bedrock proxy |
APP_MONITOR_LLM_API_KEY | Key for that gateway; falls back to OPENAI_API_KEY |
APP_MONITOR_LLM_MODEL | Model name; defaults to gpt-4.1-nano |
APP_MONITOR_ALLOW_PRIVATE_WEBHOOKS | Set to 1 to allow integrations to send to private addresses, such as an internal SIEM |
APP_MONITOR_CVE_FEED_URL | Mirror of the CVE feed for networks without internet access; defaults to https://agentbeam.com/cve/feed.json |
APP_MONITOR_ENCRYPTION_KEY | Key for encrypting stored integration URLs and keys; falls back to AUTH_SECRET |
The monthly App monitoring allowance follows the license. Without an appMonitor claim it is unlimited. Servers and apps can also review findings with their own LLM key instead (beam monitor --llm openai, or createAppMonitor({ llm: "openai" }) in the SDK); the key stays with them. A managed settings file can lock that choice for every server; see settings files.
License, backup, and upgrades
License verification is offline and checks the installation binding, edition, expiry, and seats. Back up PostgreSQL, deployment secrets, license, and proxy identity volumes under your encryption and access policy. Test restoring to an isolated environment.
For upgrades, preserve data, review schema compatibility, deploy matching release images, apply the explicit maintenance procedure, and verify login, roles, pairing, ingestion, audit export, and revocation. Roll back images only when compatible with the resulting schema; otherwise restore matching backups and images together. Do not remove data volumes as a troubleshooting shortcut.
Verify operational requirements
The bundle does not implement enterprise SSO, SCIM, MFA, automated retention, or high availability. Alert workflows can deliver App monitoring findings and device alerts to a SIEM; other audit data is not pushed. Authenticated multi-user behavior and your production storage/restore procedures require deployment acceptance. MDM services are deployed and activated separately.
Set this up with your coding agent
Install the agentbeam-setup skill for Claude Code, Codex, Cursor, Gemini CLI, OpenCode and Copilot, then ask your agent to set up AgentBeam on this machine. Beam scans the skill before it installs.
npx -y @agent-beam/beam add skill agentbeam-setup -g --all-agents