NeuralTrust | Platform for Agent Security.

A Hybrid data plane runs in your cluster but is configured and observed by the NeuralTrust SaaS control plane. To connect the two, each runtime authenticates to SaaS with tokens issued by the console at app.neuraltrust.ai.

Tokens are issued per product instance. TrustGate and TrustGuard are separate console objects, so a Hybrid install that runs both must create both and collect two token sets — one per product.

One product, four names

The same product is spelled differently in the console, in global.products, and in the values block that configures it. Keeping them straight avoids the most common install failure:

Product	In the console	`global.products` key	Values block	Workloads
TrustGate	Agent Gateway	`trustgate`	`agentgateway:`	`agentgateway-proxy`, `agentgateway-mcp`
TrustGuard	Agent Runtime	`trustguard`	`trustguard:`	`trustguard`, `firewall`

TrustGate is the only one where the two chart keys differ. global.products is keyed by product id (trustgate), while the values block matches the chart’s dependency name (agentgateway).

What the console issues

When you create a Private TrustGate or TrustGuard, the console generates two credentials for that instance:

Token	Purpose	Chart key (`CONFIG_SYNC_TOKEN` / `ENROLMENT_TOKEN`)
Config-sync token	Authenticates the runtime’s outbound pull of compiled configuration from SaaS.	`CONFIG_SYNC_TOKEN`
DataAgent enrollment token	Authorizes the co-located DataAgent for OTLP metadata egress and DataBridge retrieval.	`ENROLMENT_TOKEN`

Both are JWTs scoped to the specific gateway or TrustGuard instance. The enrollment JWT already carries the tenant and instance identifiers — you do not set them separately.

Create a private TrustGate

Open app.neuraltrust.ai and go to TrustGate → Agent Gateway → Getting started.
Choose New Gateway, enter a name, and select Private (High stakes — fixed capacity, no cold starts).
Under Where do you want to run your gateway? choose Kubernetes (recommended for production). Creating the gateway issues its config-sync token and DataAgent enrollment token.
Copy the two tokens from the generated values.yaml. Treat the whole file as a secret — see Secrets.
Leave the wizard open. After the data plane is running you return here to set the Dataplane URL — see Register the URLs.

Older consoles emit global.products.agentgateway: true in the generated values.yaml. The chart rejects it:

Error: global.products supports only trustgate, trustguard, and dataPlane (got "agentgateway")

Rename that one key to trustgate. The agentgateway: block further down the file is correct and should be left alone — see One product, four names. TrustGuard is unaffected.

Docker and Manual are also offered. Docker is for local evaluation of the LLM/proxy path only (no MCP). Manual returns CONTROL_PLANE_JWT and DATA_AGENT_JWT for fully custom manifests. Use Kubernetes for production.

Create a private TrustGuard

Go to TrustGuard → Agent Runtime → Getting started.
Choose New TrustGuard, enter a name, and select Private.
Choose Kubernetes. Creating the TrustGuard issues its own config-sync token and DataAgent enrollment token — distinct from TrustGate’s.
Copy both tokens.

The TrustGuard wizard offers Kubernetes and Manual only (no Docker). In a combined install, TrustGate and TrustGuard each keep independent tokens; never reuse one product’s token for the other.

Map tokens to chart Secrets

For a production Kubernetes install, pre-create the Secrets below and reference them from values — keep the raw tokens out of values.yaml and source control. Each Secret holds only what the console issued you.

Kubernetes Secret	Keys	From
`agentgateway-config-sync`	`CONFIG_SYNC_TOKEN`	TrustGate config-sync token
`dataagent-enrolment-trustgate`	`ENROLMENT_TOKEN`	TrustGate enrollment token
`trustguard-config-sync`	`CONFIG_SYNC_TOKEN`	TrustGuard config-sync token
`dataagent-enrolment-trustguard`	`ENROLMENT_TOKEN`	TrustGuard enrollment token

The companion CONFIG_SYNC_LKG_KEY is generated by the chart as of 2.6.0 and does not belong in these Secrets. It encrypts a local snapshot cache, so unlike the token it is not a shared credential the control plane has to know. If you run with global.autoGenerateSecrets: false or global.preserveExistingSecrets: true the chart generates nothing, and it becomes yours to supply alongside the token — see Secrets.

Reference them from the maintained neuraltrust-platform chart. Select the products you run with global.products, then point each config-sync and enrollment block at its Secret:

global:
  deploymentMode: hybrid
  products:
    trustgate: true
    trustguard: true

agentgateway:
  configSync:
    existingSecret:
      name: agentgateway-config-sync
  dataagent:
    enrolment:
      existingSecret:
        name: dataagent-enrolment-trustgate

trustguard:
  configSync:
    existingSecret:
      name: trustguard-config-sync
  dataagent:
    enrolment:
      existingSecret:
        name: dataagent-enrolment-trustguard

Config-sync is on by default in Hybrid (mode-derived) — set only existingSecret; do not restate enabled: true. For local or evaluation installs you may inline the raw values with configSync.token and dataagent.enrolment.token instead of an existingSecret, but those values enter Helm release history.

Register the URLs

The console needs to reach the data plane you just installed, so finish the wizard once TrustGate is serving traffic.

Expose both TrustGate entry points — LLM/proxy on port 8081 and MCP on port 8082 — as described in Hybrid → Expose both entry points.
Return to the wizard, enter the LLM/proxy URL as the bootstrap Dataplane URL, and choose Save and Finish. The wizard initially uses this one URL for both entry points.
Open Settings → Agent Gateway → General and set the LLM URL and MCP URL separately.

Method	Use it for	Wizard output
Kubernetes	Production-grade deployments	Credential and setup input to map into the maintained chart
Docker	Local evaluation of the LLM/proxy path	A Docker Compose command; does not start MCP
Manual	Custom or operator-managed deployments	`CONTROL_PLANE_JWT` and `DATA_AGENT_JWT`

Both URLs must be reachable by their intended clients, and NeuralTrust calls the Dataplane URL from a single source IP that your edge has to allow — see Hybrid → Network. Settings → Agent Gateway → Deployment can regenerate the install configuration and credentials later.

Regenerate tokens

Issue fresh tokens any time from Settings → Agent Gateway → Deployment (TrustGate) or the equivalent TrustGuard deployment settings. Regenerating invalidates the previous install credentials, so update the corresponding Secret and roll the runtime pods.

Next steps

Hybrid

The install these tokens are for, start to finish.

Secrets

Handle config-sync and enrollment tokens safely.

Configuration

Managed stores, ingress, and every values switch.

Troubleshooting

Config-sync and install failures.

Platform

Organization

Identity & Access

Telemetry

Audit & Compliance

Infrastructure

Console setup

One product, four names

What the console issues

Create a private TrustGate

Create a private TrustGuard

Map tokens to chart Secrets

Register the URLs

Regenerate tokens

Next steps

Hybrid

Secrets

Configuration

Troubleshooting

​One product, four names

​What the console issues

​Create a private TrustGate

​Create a private TrustGuard

​Map tokens to chart Secrets

​Register the URLs

​Regenerate tokens

​Next steps

Hybrid

Secrets

Configuration

Troubleshooting

One product, four names

What the console issues

Create a private TrustGate

Create a private TrustGuard

Map tokens to chart Secrets

Register the URLs

Regenerate tokens

Next steps