First-Time Setup
Install Trinity, create your admin account, and start managing agents in minutes.
I Built a DevOps Agent That Deploys Other Agents
Apr 2026
Key Concepts
Admin Account — Primary account with full platform access. Created either from ADMIN_PASSWORD in .env at first boot, or through the first-run setup form in the browser. The admin signs in with the username admin or their registered email address, plus the password.
Email Login— Passwordless authentication where users receive a one-time code via email. Requires an email service to be configured.
Prerequisites
Installation
Clone the repository
git clone https://github.com/abilityai/trinity.git
cd trinityOptionally set ADMIN_PASSWORD in .env
cp .env.example .env
# Optionally set ADMIN_PASSWORD to a strong password (min 12 chars)If set, the admin account is created automatically from this value on first start and no setup screen appears.
If left blank, the first visit to the web UI shows a one-page “Create your admin account” form: enter your admin email (required — this becomes your sign-in identity), a password (12+ characters with uppercase, lowercase, number, and special character; a live strength meter guides you), confirm it, and optionally your company name. An optional checkbox opts you in to occasional security and product update emails from the Trinity team; it sends only your email and company name, nothing else, and can be disabled entirely on air-gapped installs via OPERATOR_INTAKE_ENABLED=false or DO_NOT_TRACK=1. The form works exactly once — it disables itself permanently after the admin account is created.
Security note: until setup completes, the setup form is reachable without authentication. On an internet-facing server, keep the instance behind a tunnel, VPN, or firewall until you have completed first-time setup.
Start all services
./scripts/deploy/start.shOn first run, detects if the base agent image is missing and builds it automatically (takes 5–10 minutes). Then starts backend, frontend, MCP server, Redis, scheduler, and Vector.
No-prompt install: run ./scripts/deploy/start.sh --unattended (or set TRINITY_UNATTENDED=1) and the script never stops to ask for input — it auto-generates the admin password and prints it in the final summary. Save it: it lands in .env and is shown only once. An AI coding agent (Claude Code) can drive the entire local install for you via the runbook at docs/AGENT_INSTALL_GUIDE.md.
Open in your browser
Navigate to http://localhost. If you set ADMIN_PASSWORD, log in with those credentials. If you left it blank, complete the “Create your admin account” form that appears on first visit.
Logging In
Admin login — Username admin or the admin email you registered at setup, plus the password. Admins created via ADMIN_PASSWORD in .env have no registered email at first; bind one later with PUT /api/users/me/email to enable email + password sign-in.
Email login (passwordless) — Enter your email, receive a 6-digit code, submit. Requires email service configuration. The admin manages allowed emails under Settings > Email Whitelist.
Your Default Agent
On a fresh install, Trinity auto-seeds a ready-to-use Cornelius second-brain agent so you land on a working agent without cloning or configuring a template first. Cornelius ships with the Brain Orb enabled — a self-rendering 3D knowledge graph on its Brain tab.
This runs once, only on a truly fresh install: it is skipped when the instance already has agents, and deleting Cornelius does not re-create it. Installs without Docker (demo mode) skip it entirely.
After setup, a guided onboarding wizard opens on your first Dashboard visit to launch your first agent. Relaunch it any time at http://localhost/?onboarding=1.
Key URLs
| Service | URL |
|---|---|
| Web UI | http://localhost |
| Backend API docs | http://localhost:8000/docs |
| MCP Server | http://localhost:8080/mcp |
Settings Page (Admin Only)
The admin can configure the following from the Settings page:
For Agents: Authentication API
Authenticate programmatically using the token endpoint:
POST /api/token
Content-Type: application/x-www-form-urlencoded
username=admin&password=YOUR_PASSWORDReturns a JWT access_token. Use it in subsequent requests:
Authorization: Bearer YOUR_ACCESS_TOKENToken Details
JWT tokens are valid for 7 days
Tokens are invalidated when the backend restarts
MCP API keys (prefixed trinity_mcp_) also work as Bearer tokens
Unauthenticated Endpoints
Limitations
Backend restarts invalidate all JWT tokens
Email login requires a configured email service
Trinity requires Docker Desktop