NeuralTrust | Platform for Agent Security.

Value	Hybrid guidance	Effect
`global.deploymentMode`	`hybrid`	Required. Selects the Hybrid topology. Use `external` for the self-hosted stack.
`global.products.trustgate`	`true` to run TrustGate	Renders the TrustGate proxy/MCP data plane. Defaults to `false`; select at least one product.
`global.products.trustguard`	`true` to run TrustGuard	Renders the TrustGuard data plane (Firewall follows).
`global.products.dataPlane`	`true` for red-teaming shim	Renders the data-plane API shim.
`global.postgresql.deploy`	`false` in production	Use managed PostgreSQL. Set `true` only for an in-cluster evaluation or non-production store.
`global.redis.deploy`	`false` in production	Use managed Redis. Set `true` only for an in-cluster evaluation or non-production store.
`agentgateway.configSync.existingSecret`	Reference your Secret	TrustGate config-sync token + LKG key. Config sync is on by default in Hybrid — do not restate `enabled: true`.
`trustguard.configSync.existingSecret`	Reference your Secret	TrustGuard config-sync token + LKG key.
`agentgateway.dataagent.enrolment.existingSecret`	Reference your Secret	TrustGate DataAgent enrollment token (OTLP egress + DataBridge).
`trustguard.dataagent.enrolment.existingSecret`	Reference your Secret	TrustGuard DataAgent enrollment token.
`agentgateway.mcp.enabled`	`true`	TrustGate MCP (chart key `agentgateway`).
`firewall.enabled` / `firewall.firewall.enabled` / `trustguard.firewall.enabled`	Keep aligned	Optional Firewall with TrustGuard.
`global.autoGenerateSecrets`	`true`	Chart-owned secrets when values are empty.
`global.preserveExistingSecrets`	`false`	GitOps: pre-create secrets and set `true`.

Leave trustlens.enabled and watchdog.enabled off unless NeuralTrust asks you to enable them.

Product telemetry export is mandatory in Hybrid and always on — there is no global.clickstack.enabled: false opt-out. TrustGate and TrustGuard send OTLP to a co-located, enrollment-backed egress collector, so the tokens you collect when creating each product are required. For a deployment with no NeuralTrust SaaS dependency, use External mode instead.

Configuration sync is pull-based. TrustGate and TrustGuard dial the SaaS control-plane endpoint from the customer environment; no inbound control-plane connection into the customer network is required. Choose Kubernetes in the private TrustGate wizard to obtain setup and credential input. Review and map that input into the current maintained neuraltrust-platform chart or manifests; do not apply the generated values or local-chart command unchanged. Choose Manual for custom manifests; it provides CONTROL_PLANE_JWT and DATA_AGENT_JWT.

Managed stores (required)

global:
  deploymentMode: hybrid
  postgresql:
    deploy: false
    host: postgres.example.com
    port: 5432
    user: neuraltrust
    database: neuraltrust
    sslMode: require
    existingSecret:
      name: hybrid-postgresql
  redis:
    deploy: false
    host: redis.example.com
    port: 6379
    tls: "true"
    existingSecret:
      name: hybrid-redis

Sizes: Configuration.

Platform and routing

global.platform: aws · gcp · azure · openshift · kubernetes.
global.domain combines with the default gateway and mcp prefixes to create separate LLM/proxy and MCP ingress hosts. Enter the corresponding full URLs in Settings → Agent Gateway → General. Ingress class and annotations are provider-specific. global.imageRegistry rewrites the registry prefix for mirrors. See Configuration and Secrets.

Platform

Organization

Identity & Access

Telemetry

Audit & Compliance

Infrastructure

Feature flags reference

Managed stores (required)

Platform and routing

​Managed stores (required)

​Platform and routing

Managed stores (required)

Platform and routing