AgentOS on AWS

Clone and configure

git clone https://github.com/agno-agi/agentos-aws.git agentos
cd agentos

cp example.env .env

Edit .env and set OPENAI_API_KEY.

Start the platform

docker compose up -d --build

The first build takes a few minutes. Confirm the API is available at localhost:8000/docs.

Verify end to end

./scripts/mcp_check.sh

Prints MCP OK with the tool count and a real agent answer through the MCP endpoint.

Connect the AgentOS UI

1. Open os.agno.com and sign in.
2. Click Connect OS, enter http://localhost:8000, and name it Local AgentOS.

Build your first agent

1. Chat with Platform Builder: "Build an agent that tracks AI news and writes a daily brief". Go through the agent development process.
2. Once created, click Refresh on the top right, pick the new agent from the Agents dropdown, and ask: "What's new with Anthropic?"
3. Ask Platform Manager: "How healthy is the platform?" It answers from eval history, deployment checks, schedules, and the agent you just built.

Create a production env

cp .env .env.production

Edit .env.production with production values: a different OpenAI key, production-only credentials, a different Slack workspace.

Deploy

./scripts/aws/up.sh

Provisions an ECR repo, a private RDS PostgreSQL 17 instance, and Secrets Manager secrets, then makes one aws ecs create-express-gateway-service call. That call brings the Fargate service, an ALB with HTTPS, security groups, autoscaling, CloudWatch logs and alarms, and a public URL (https://ag-<id>.ecs.<region>.on.aws, generated per service). The script pins scaling to a single always-on task as the template’s default configuration, and sets AGENTOS_URL to the generated URL so scheduled jobs reach the platform. It also generates MCP_CONNECT_SECRET into .env.production when it's missing, so chat apps can connect over OAuth from the first deploy.

The first run takes 30-45 minutes end to end. Certificate and DNS provisioning is the long pole, and the script waits until the gateway actually answers before declaring success. Redeploys take minutes. Region comes from AWS_REGION (default us-east-1).

Mint your JWT key

The script pauses for a JWT_VERIFICATION_KEY. Token-Based Authorization is on by default. Production startup requires that verification key or a readable JWKS file at the container path in JWT_JWKS_FILE; otherwise the process exits.

1. Open os.agno.com, click Connect OS → Live, and enter your service URL.
2. Name it Live AgentOS, turn on Token-Based Authorization (JWT) on the connection panel, and connect. The UI generates the public key. If the OS is already connected, enable the setting under Settings → OS & Security.
3. Copy the public key and paste the full PEM into the up.sh prompt. The script saves it to your env file, pushes it to Secrets Manager, and rolls a fresh task-definition revision.

If you skip the prompt, add JWT_VERIFICATION_KEY to .env.production later and run ./scripts/aws/env-sync.sh. For JWKS, add the file to the image build context and rebuild, or configure a mount. Set JWT_JWKS_FILE to its container path, then redeploy the service. up.sh and env-sync.sh only forward the path.

Connect your MCP clients

Re-run uvx agno connect, this time pointed at your deployed domain:

uvx agno connect --url https://<service-url>

For claude.ai and ChatGPT on the web: add https://<service-url>/mcp as a custom connector in the chat app's connector settings. Leave the form's optional OAuth fields (client ID / client secret) empty. Click Connect and, on the consent page, enter the MCP_CONNECT_SECRET that up.sh generated during deploy (saved in .env.production).

Confirm it's live

aws logs tail /ecs/agent-os --follow --region <region>

The app finishes rolling out behind the gateway; first boot pulls the image and waits for the database. Open https://<service-url>/docs to confirm the API is serving.