Deploying Trinity

• •A machine with 8 GB of RAM for a working fleet (4 GB runs the platform and one or two agents). Prebuilt images and the DigitalOcean paths are x86-64; on an ARM server, build from source.
• •Docker with the Compose v2 plugin (docker compose, no hyphen), and Git. The DigitalOcean paths install both for you.
• •A Claude credential for your agents: a subscription token from claude setup-token (Pro or Max) or an Anthropic API key. Connecting one is the one required step of Trinity's first-run setup; the DigitalOcean installer does it for you.
• •Claude Code, to connect to your instance and deploy agents onto it.

Marketplace 1-Click (no terminal)

Trinity 0.9.5 is published on the DigitalOcean Marketplace. Create a Droplet from the Trinity image (8 GB recommended, 4 GB minimum). First boot obtains a Let's Encrypt certificate for the Droplet's IP and starts Trinity from images baked into the snapshot, so it is serving over HTTPS about ninety seconds later. No admin account exists yet: open https://<droplet-ip> and the first visitor creates it with an email and password.

Sizing, first boot and hardening →

$ bash <(curl -fsSL https://raw.githubusercontent.com/abilityai/trinity/v0.9.5/scripts/deploy/trinity-do-create.sh)

On a server, pull-only is the path you want: every platform image and the agent base image are published to GHCR on each release, so nothing is compiled on the box.

git clone https://github.com/abilityai/trinity.git && cd trinity
cp .env.example .env                     # set ADMIN_PASSWORD (12+ chars)
echo 'TRINITY_IMAGE_TAG=v0.9.0' >> .env  # pin a release
./scripts/deploy/start.sh --hosted --unattended

Pin a release rather than latest, which moves on every release. The checkout must stay beside the compose file (it mounts ./config/*), and upgrades are a re-run of start.sh --hosted with a new TRINITY_IMAGE_TAG, not a bare docker compose pull. Put TLS in front before exposing it: a reverse proxy with a certificate, or a Cloudflare Tunnel. Plain HTTP on a public IP sends passwords in the clear.

Full details, TLS and tunnel choices, building from source, and every .env key: Single-Server Deployment. Want a walkthrough for creating the VM on Hetzner, AWS or GCP? The Ops Agent's /provision skill guides you through it.

Or let Claude Code do the install: /trinity:deploy-new-instance from the trinity plugin installs Trinity on any server you can SSH into (or in local Docker) and sets up an Ops Agent to manage it.

With Docker Desktop running:

git clone https://github.com/abilityai/trinity.git
cd trinity
./scripts/deploy/start.sh --unattended

--unattended generates the admin password and prints it at the end; without it, start.sh asks you to set ADMIN_PASSWORD in .env first. It also generates every other secret (SECRET_KEY, CREDENTIAL_ENCRYPTION_KEY, AGENT_AUTH_SECRET, the Redis passwords) and writes them to .env. Never change CREDENTIAL_ENCRYPTION_KEY or AGENT_AUTH_SECRET afterwards: stored credentials become unreadable and running agents lose their tokens.

The first run builds the agent base image, which takes 5–10 minutes. When the backend reports healthy, open http://localhost and sign in as admin. If port 80 is taken, set FRONTEND_PORT=8090 (or any free port) in .env.

Details: Local Development. An AI coding agent can also drive the whole install from the runbook at docs/AGENT_INSTALL_GUIDE.md.

Once Trinity is running, from any agent directory in Claude Code:

# Once per machine: your instance URL, then an emailed sign-in code
/trinity:connect

# Per agent: deploy this directory to the instance
/trinity:onboard

/trinity:connect creates an MCP API key for you and writes .mcp.json pointing at <your instance URL>/mcp. The sign-in code only goes to addresses on the instance's whitelist (Settings → Access → Email Whitelist); if none arrives, add your email there. MCP keys are listed under Settings → MCP Keys. See Building Agents.

All five share one installer (scripts/deploy/start.sh), one .env contract, and one set of day-two procedures.

# Stop (keeps agent containers; picks the right compose file)
./scripts/deploy/stop.sh

# Start (add --hosted on a prebuilt-image install)
./scripts/deploy/start.sh

# Health check after any change
./scripts/deploy/verify-platform.sh

• •Upgrading: on a prebuilt-image install, set the new TRINITY_IMAGE_TAG, check out the matching tag, and re-run start.sh --hosted. On a source install, pull and rebuild the platform images. Upgrading has the full procedure with rollback.
• •Backups: Trinity backs up its database nightly at 03:30 UTC, plus a copy at boot before any migration, on the same disk. Copy them off the machine for disaster recovery. See Backup and Restore.
• •Monitoring: health probes, resource thresholds and recovery patterns are in Monitoring.
• •Ops Agent: trinity-ops-public is a Claude Code agent that runs these operations for you, locally or over SSH. See Ops Agent.