NeuralTrust | Platform for Agent Security.

Generated setup

Start in TrustGate’s private gateway wizard. The runtime choices are Docker, Kubernetes, and Manual. Docker displays a generated Compose command. It fetches the maintained TrustGate Compose manifest and injects:

A generated CONFIG_SYNC_LKG_KEY
The wizard-issued CONFIG_SYNC_TOKEN
The wizard-issued ENROLMENT_TOKEN

Before running it, provide these additional values required by the Compose manifest:

SERVER_SECRET_KEY — a random value of at least 32 bytes
CONFIG_SYNC_GRPC_ENDPOINT — the SaaS config-sync endpoint as host:port
DATABRIDGE_ADDR — the DataBridge endpoint as host:port

The generated Compose path starts the TrustGate LLM/proxy process and publishes port 8081. It does not start or expose the MCP process on 8082. Use Kubernetes for production MCP support, or run the full local TrustGate stack when you need both processes locally. Kubernetes displays generated values.yaml and a Helm command. Kubernetes is recommended for production-grade deployments, but this output is setup and credential input rather than an install-ready chart contract. Use the maintained neuraltrust-platform chart or manifests as the deployment source, and map the generated credentials and settings into its current values and Secret interfaces before applying. Manual displays exactly these generated environment values and does not display a deployment command:

CONTROL_PLANE_JWT
DATA_AGENT_JWT

Treat these values as secrets except for service URLs. Inject them into your maintained deployment manifests through an approved secret manager; do not commit them. After deployment, expose separate LLM/proxy and MCP entry points. Enter the LLM/proxy URL as the wizard’s bootstrap Dataplane URL, then select Save and Finish. The wizard initially seeds both URLs with that value. Open Settings → Agent Gateway → General and set the final LLM URL and MCP URL independently. TrustGate listens on these ports by default:

Entry point	Port
Admin	`8080`
LLM/proxy	`8081`
MCP	`8082`

When the full local TrustGate stack runs both processes, use the same hostname with different ports, such as http://gateway.example:8081 and http://gateway.example:8082. Do not configure an MCP URL for the generated Compose path unless you separately run and expose the MCP process.

Kubernetes

Choose Kubernetes in the wizard to obtain setup and credential input. Do not apply its generated values or local-chart Helm command unchanged. Platform operators must review and map that input into the current maintained neuraltrust-platform chart or manifests. Use Manual when you maintain a fully custom deployment. For production, set deploymentMode: hybrid and point the maintained chart at managed PostgreSQL and Redis (deploy: false):

global:
  deploymentMode: hybrid
  platform: kubernetes
  domain: platform.example.com
  postgresql:
    deploy: false
    host: postgres.example.com
    port: 5432
    user: neuraltrust
    database: neuraltrust
    sslMode: require
    existingSecret:
      name: hybrid-postgresql
  redis:
    deploy: false
    host: redis.example.com
    port: 6379
    tls: "true"
    existingSecret:
      name: hybrid-redis

The wizard-generated Kubernetes file contains credentials directly. Do not commit or use it as a production values file. Move its credentials into pre-created Kubernetes Secrets or an approved secret manager, then use the maintained chart’s documented Secret interfaces. For custom manifests, inject the two Manual JWT values through an approved secret manager. See Credential contracts.

Cluster sizing

Chart defaults are a sensible starting point. For Hybrid, plan on about 3–4 workers at 8 vCPU / 16–32 GiB; for External, about 4–5 of the same class. Right-size and fine-tune for your traffic — see Cluster sizing.

Managed stores

Managed PostgreSQL and Redis are recommended for production. Pre-create the database, role, and Redis credentials; Helm does not create users in managed services. The maintained chart supports in-cluster PostgreSQL and Redis with deploy: true for evaluation and non-production environments. For regional active/passive deployments, each region uses independent stores; runtime and historical data are not replicated between regions. See High availability.

Store	Minimum size
PostgreSQL	2 vCPU, 4 GiB RAM, 20 GiB storage
Redis	1 GiB memory

Provider	PostgreSQL	Redis
AWS	RDS/Aurora `db.t4g.medium`, 20 GiB+	ElastiCache `cache.t4g.small`
GCP	Cloud SQL `db-custom-2-4096`, 20 GiB+	Memorystore 1 GiB
Azure	Flexible Server 2 vCores / 4 GiB, 20 GiB+	Cache for Redis C1 (1 GiB)+

Reach both over private networking from the cluster. Secret key contracts: Secrets.

Ingress

global:
  platform: aws
  domain: platform.example.com
  storageClass: gp3
  ingress:
    className: alb
    aws:
      certificateArn: arn:aws:acm:region:account:certificate/id

global.domain is used with the default host prefixes to render two public names:

gateway.<global.domain> for the LLM/proxy Ingress
mcp.<global.domain> for the MCP Ingress

The maintained chart creates separate agentgateway-gateway and agentgateway-mcp Ingress resources backed by separate Services. Each Service exposes port 80: the proxy Service targets TrustGate container port 8081, and the MCP Service targets container port 8082. Set the corresponding full URLs, including https://, in Settings → Agent Gateway → General. global.domain does not update those console settings. For regional active/passive deployments, put global LLM and MCP endpoints in front of the regional Ingress resources and configure those stable URLs in the console. See High availability. Render and install with your maintained deployment manifests. See Feature flags and Secrets.

Platform

Organization

Identity & Access

Telemetry

Audit & Compliance

Infrastructure

Configuration

Generated setup

Kubernetes

Cluster sizing

Managed stores

Ingress

​Generated setup

​Kubernetes

​Cluster sizing

​Managed stores

​Ingress

Generated setup

Kubernetes

Cluster sizing

Managed stores

Ingress