Self-host Rikoo

Rikoo runs entirely on your infrastructure. Conversations, documents, secrets and traces stay in your own database and object store, and the only outbound calls go to the model providers and tools you configure.

Deployment options

Option	Use it for	Guide
Docker Compose	Evaluation, a demo, or a small team on a single machine	Docker Compose
Kubernetes (Helm)	Production: replicas, managed stores, network policies	Kubernetes (Helm)

Both paths run the same services. Infrastructure describes each of them and what the stores they depend on must provide.

Access to the source and the images

The Rikoo source repository (Rikoo-app/rikoo) and the container images are not public yet. Both guides below need access granted by the Rikoo team: ask for it through rikoo.io/contact. The Helm chart (Rikoo-app/rikoo-k8s) is public.

Architecture

            browsers, websites, Slack, API clients
                          │
                          ▼
   ┌──────────────────────────────────────────────┐
   │ api   REST, Studio, widget, auth, enqueueing  │── PostgreSQL + pgvector
   └──────────────────────────────────────────────┘── Redis
                          │ queues (Redis)          ── S3-compatible storage
                          ▼
   ┌──────────────────────────────────────────────┐
   │ worker   runs, model calls, retrieval, tools  │──► model providers, MCP servers
   └──────────────────────────────────────────────┘    (through the egress guard)
         │ optional
         ├── sidecar-parsing   PDF and Office extraction
         └── mcp-sandbox       embedded tools, isolated workspace and browser

• The api serves the REST API, the Studio and the widget script. Apart from exporting its own telemetry, it never calls the outside world: anything that leaves the platform leaves from the worker.
• The worker runs agents: model calls, retrieval, tool calls, e-mails and webhooks. Every outbound request passes an anti-SSRF guard.
• Services marked optional degrade one feature when they are missing; nothing else fails.

Editions

Edition	License	What it adds
Community	GNU AGPL-3.0	Everything needed to build, publish and operate agents, for one organization
Enterprise	Rikoo Enterprise License, with a signed license	SSO, human approval, publication gates, full audit, source connectors, several organizations, per-organization trace export

The Enterprise edition is a different build of the same images, activated by a license. See Enterprise license.

After the installation

• Put the api behind a reverse proxy that terminates TLS, and set PUBLIC_URL to the address users type.
• Back up the PostgreSQL database, the object store, and the vault's private sealing key. Keep the key somewhere other than the database it protects: without it, a restored backup cannot read any stored secret.
• Plug the platform into your monitoring: health endpoints, Prometheus metrics and OpenTelemetry traces are listed in Infrastructure.

Air-gapped installation

Rikoo runs without internet access. The registry of model prices and capabilities ships with the product and is never fetched at run time, so the only outbound traffic goes to the model providers you configure. With a model server on your own network, such as vLLM or Ollama, there is none: allow its address range with RIKOO_EGRESS_ALLOW_CIDRS, as described in Infrastructure.

Building the images from source downloads dependencies, so build them, or pull them, on a machine with access and push them to a registry your servers can reach.