Self-hosting

Not a developer? Skip this page.

Everything here is server operations. If you’re using app.tuckit.dev, none of it applies to you, and nothing on the rest of the site depends on it.

The core is source-available and you can run it yourself, including in production. This page covers the part specific to getting agents to connect to your own instance. The web dashboard works the way any Django app does.

What isn’t written yet

So you don’t go looking:

• There’s no install guide and no environment-variable reference yet. The repository’s README is the current source of truth for getting the app up.
• There’s no HTTP API reference. Agents use MCP; there’s no documented REST surface.

What follows is documented because it’s the subset that breaks silently.

You must run the ASGI app

/mcp is mounted by tuckit.asgi:app. manage.py runserver and the WSGI entry point serve the dashboard only, so the endpoint returns 404 and the agent reports a connection failure rather than a configuration problem:

uvicorn tuckit.asgi:app --host 0.0.0.0 --port 8000

The stock Dockerfile does not serve /mcp

The Dockerfile in the repository runs gunicorn tuckit.wsgi:application, so the image as shipped serves the dashboard without the MCP endpoint. Override the command with an ASGI server if you need agents to connect.

Set TUCKIT_MCP_ALLOWED_HOSTS

tuckit guards /mcp against DNS rebinding with an allowlist that covers only localhost out of the box. Behind any real hostname or reverse proxy, every request returns 421 with Invalid Host header until your host is on the list:

export TUCKIT_MCP_ALLOWED_HOSTS="tuckit.example.com"

This is separate from Django’s own ALLOWED_HOSTS. Setting one does not set the other, and the symptom (an agent that authorises fine and then fails every call) looks nothing like a host-header problem.

Pin TUCKIT_OAUTH_ISSUER behind a TLS-terminating proxy

If TLS terminates at a proxy, the app sees plain HTTP and advertises http:// URLs in its OAuth metadata, which the client then refuses. Pin the issuer to your public origin:

export TUCKIT_OAUTH_ISSUER="https://tuckit.example.com"

Connecting an agent to your own host

Everything on Connect your agent applies unchanged. Substitute your own origin for app.tuckit.dev. Two specifics:

Claude Code plugin, without the prompt. Pass the URL at install time instead of typing it:

claude plugin install tuckit@tuckit-plugins --scope user \
  --config mcp_url="https://tuckit.example.com/mcp"

Codex. Point the bundled server elsewhere by editing url in plugins/codex/.mcp.json, or configure it by hand in ~/.codex/config.toml as shown on Connect your agent.

Licence

The core is source-available under the Business Source License 1.1. Readable and runnable, but not OSI open source, and we’d rather say so than blur it. You can self-host it, including in production; the one thing the licence withholds is offering tuckit itself as a hosted service to third parties. Each release’s licence converts to Apache 2.0 on its change date.

Something here wrong or missing? A broken command is a real bug. Open an issue.