# Fractera — full knowledge base > Open Code (source-available), AI-native self-hosting platform. Deploy a complete AI coding > workspace — 5 AI engines, an autonomous Hermes orchestrator, and private graph > memory (LightRAG) — onto your own Ubuntu VPS in about 10 minutes. This file is > the complete /mcp-info knowledge base plus the full /ai-workspace-architect and > /ai-development-loop references (with their canonical diagrams) in one document: > architecture, Zero-Ops deployment, customization, pricing, the full FAQ, > real-world use cases, the workspace architecture, the development loop, the > Next.js Aircraft Carrier (the pre-built 50,000-line parallel-routing framework), > the token economics of the MCP-First / Zero-Agent paradigm, the interactive > AI consultant, the authentication scheme (roles & providers), and the legal text. > The same content is queryable section-by-section via the MCP connector at > https://www.fractera.ai/api/mcp (get_project_info, > get_ai_workspace_architect_info, get_ai_development_loop_info). ## What is Fractera Fractera is a source-available (Open Code) platform that turns a bare Ubuntu VPS into a complete, self-hosted, AI-native development environment in about 10 minutes — with one click or a short chat. On your own server you get: five AI coding platforms (Claude Code, Codex, Gemini CLI, Qwen Code, Kimi Code), the **Hermes** orchestrator, **LightRAG** persistent memory, authentication, a database, and file storage — all pre-wired. No Clerk, no Supabase, no Vercel. One bill (your VPS), one place, full ownership of code and data. You can install the full stack, or pick only the components you need — down to a plain server with a database and sign-in and no AI at all. --- ## How deployment works 1. You provide a server (IP + root password) — or buy a VPS first (see "VPS & pricing"). 2. You choose what to install — the full stack or only the components you need. 3. Fractera's automated setup service configures everything on your server for you: it installs the tools you selected and sets up the database, authentication, file storage, and web routing, then brings all services online. You never run any commands yourself. 4. In ~8–14 minutes the workspace is live. You get email notifications when setup starts and when it finishes. The result is **IP-first**: when it finishes, your workspace is live on plain HTTP at `http://:3002` — that is the Admin workspace where you start coding. Attaching your own domain with HTTPS is an optional later step you do yourself, inside the workspace (Admin → Personal Domain). Three ways to start: the one-click form on the website, a partner/embed widget, or by chatting with an AI agent through the Fractera MCP connector. --- ## Zero-Ops deployment — from a bare VPS to a full stack in ~10 minutes Traditional self-hosting is plagued by DevOps friction — hours spent configuring an Nginx reverse proxy, wrestling with Let's Encrypt SSL renewals, securing the database, and wiring up authentication gates. Fractera removes that barrier. You provide nothing more than your bare Ubuntu server credentials, and an automated orchestration layer configures the entire infrastructure from scratch — with no terminal commands on your end. Better still, you don't even need to open a browser: you can trigger the whole deployment — and check its status on demand — programmatically through our custom MCP (Model Context Protocol) connector, right inside your AI coding environment. It's the simplicity of Vercel, brought natively to your own private hardware. --- ## Components you can choose You decide what gets installed (a lighter, cheaper server). Selectable components: - **Claude Code** — Anthropic coding agent - **Codex** — OpenAI Codex CLI - **Gemini CLI** — Google coding agent - **Qwen Code** — Alibaba Qwen coding agent - **Kimi Code** — Moonshot Kimi coding agent - **Memory** — LightRAG vector knowledge base - **Brain** — Hermes orchestration agent Always installed (the core, never optional): the web app, authentication, database, object/file storage, the admin panel, and the admin panel's own **system terminal**. Unchecking every box above gives you a plain server with a database and sign-in — no AI. You are never locked in: any recommended or custom tool can be installed later from the terminal built into your admin panel. --- ## The five AI coding platforms Claude Code, Codex, Gemini CLI, Qwen Code, and Kimi Code — all preconfigured on your server, each driven through a WebSocket bridge. Key principle: they run on your existing **subscriptions**, not pay-per-token API keys. Sign in to each platform once (standard browser-based login, like a local CLI). No API keys to manage, no per-token billing surprises. You can switch platforms mid-task without losing your project context — LightRAG keeps the thread. "Bridge online" means the process is alive and the WebSocket handshake works; logging into each platform's subscription is a separate one-time step after that. --- ## Subscriptions vs. API keys — what you actually pay Two separate billing models — do not conflate them: - **The five coding platforms (Claude Code, Codex, Gemini CLI, Qwen Code, Kimi Code) run on YOUR existing subscriptions.** You sign in once with your normal account (standard browser login, like a local CLI) — no API keys, no per-token billing. This is where the heavy AI work happens, and it costs you nothing beyond the subscription you already pay the AI vendor. - **Brain (Hermes) and Memory (LightRAG) use one small OpenAI API key** — the cheap gpt-5-mini (about 1 cent per hour) is plenty to start, or a Codex subscription if your usage is heavy. This is the only per-token piece, and it is tiny and auxiliary. So: **a Claude Code user pays through their Claude subscription, not per token.** Per-token API spend, if any, is limited to the small Brain/Memory model — not the coding platforms. **Track Brain and Memory spend separately (optional).** Brain and Memory keep their OpenAI keys in two independent places, so you can meter each one on its own. Create **two separate API keys** in OpenAI and paste one into the Memory key field and the other into the Brain key field (in the OpenAI settings). One key works fine for both — but two keys let you watch each line item independently in the Usage dashboard at platform.openai.com. --- ## Memory (LightRAG) Memory is a persistent vector knowledge base (LightRAG by HKUDS) shared across all your coding platforms. Feed it your codebase, documents, and architectural decisions; the agents query it to stay grounded in your context. Why it matters: without persistent memory, every AI session starts from scratch — tokens spent re-explaining "where is the navbar?" are tokens not spent on your feature. Memory compounds with every iteration, so tasks that take 10–20 back-and-forth messages in a vanilla chat often resolve in 2–3. It does not auto-learn — it stores only what agents explicitly push. Activating it needs an OpenAI API key (used economically — the embedding model is among the cheapest), set in Admin → Memory settings. --- ## Brain (Hermes orchestrator) Brain is the Hermes Agent (by Nous Research) deployed and configured on your VPS — the thinking centre of the workspace. It coordinates the connected AI subscriptions through shared context and can run autonomous, multi-step pipelines where each loop refines the next ("let Claude do this and Codex do that" — in parallel). You talk to Brain through its **built-in web chat**, which opens automatically in the admin panel and is the primary way you use the system — just add a model to start. Talking to Brain from your phone via a Telegram bot is an optional secondary channel. (See "Hermes Web Chat — the main way you talk to Brain".) --- ## How authentication blankets the whole layer Authentication is not a single login screen bolted on — it is a layer-wide gate. A dedicated Auth service is the **only** component that issues the session, and every other service and page checks that session before serving anything. - **One session authority.** The Auth service (NextAuth) is the sole writer of the session cookie. Providers: email + password (bcrypt) and Google OAuth / magic link. Client code never calls the auth service directly — pages ask a single `/api/me` endpoint, which resolves the current session. - **Per-service gate.** The user-facing app and the admin workspace each run a request gate ("proxy") that runs BEFORE any page or API handler: no valid session → redirect or 401. So hitting any of these services without a session gets you nothing. - **Gate for the non-web services too.** The database/storage service, Memory, and Brain don't serve web pages, so in secure mode the web server (Nginx) enforces an auth check (`auth_request`) on each of their subdomains — every authenticated host requires a valid session, closing any side door. - **Roles.** Each user has roles (default `user`). `user` can use the app; `admin` has full access to the admin workspace and the coding platforms. The **first person to register on a fresh server becomes the admin**; admins can promote others. - **Modes.** In open/IP onboarding mode the gates are intentionally relaxed for friction-free first access; once you attach a domain (secure mode) the cookie becomes `Secure`, scoped to your domain, and every gate strictly enforces. --- ## How the database and object storage live in the layer Both the database and the file/object storage run on your own server as part of the layer — there is no external Supabase, no S3 bill. - **Database.** A single SQLite database file (`app.db`) holds the application data. The schema is defined in ONE place and applied automatically at startup, so the local and remote paths always agree — there are no migration files to juggle and no "run migration" button. A dedicated data service owns the database and exposes it over an authenticated HTTP API; the app talks to it through that service. - **Object / file storage.** The same data service stores media and files on the server's local disk and handles image work (icon generation, thumbnails, crops). Uploaded media is served back through the app, never from a third-party bucket. - **Ownership.** Because both live on your VPS, your records and files never leave your server. Back them up (export) and restore (import) whenever you like; pausing the project never deletes your data. --- ## How Brain (Hermes) drives the coding agents via MCP Each of the five coding platforms runs on your server behind its own WebSocket bridge — a live process you can drive interactively. Brain (Hermes) sits above them as the orchestrator. - **Delegation over MCP.** Brain reaches each coding agent through a per-platform MCP delegation tool (each platform gets its own MCP endpoint on its own port). Through these tools Brain can hand a task to Claude Code, Codex, Gemini CLI, Qwen, or Kimi — individually or several at once. - **Parallel, multi-step work.** Because delegation is tool-based, Brain can run autonomous pipelines: split a job ("let Claude do this part and Codex do that part"), run them in parallel, collect results, and decide the next step — each loop refining the next. - **Shared context.** The agents are not isolated silos: they share project context (and Memory, below), so switching an in-flight task from one agent to another does not lose the thread. - **You talk to Brain, Brain talks to the agents.** There is no separate chat UI for each agent in normal use — you direct Brain through its built-in web chat in the admin panel (or, optionally, a Telegram bot) and Brain coordinates the rest. --- ## The Product Loop — a deployments table that goes beyond Vercel Inside the admin panel there is a **Deployments** table that logs every development deployment — the running journal of *how your project gets built*. It deliberately mirrors the familiar Vercel deployments list, then adds the columns a generic cloud host cannot have. A standard cloud platform shows you *that* a deploy happened: commit, status, branch, duration. Fractera shows you the whole story of the change: - **Result** — a 1–3 star quality rating (first column). Hermes records each row with a default of three stars; you can change the rating at any time by clicking the stars and saving — your honest feedback on how good the work was. - **Platform** — which AI coding agent actually did the work (Claude Code, Codex, Gemini, Qwen, Kimi). - **Model** — the exact model used. - **Tokens** — the real token cost of producing the change, captured straight from the agent's run (not estimated). - **Page** — the URL where you review the change (last column), alongside a **Created** timestamp and the familiar commit / status / duration / branch / author cells. Every column sorts, and you can split deployments by **project** (a projects list you manage) and filter the table by one or more of them. **Why this is the loop.** Hermes takes a decision, delegates the coding to one or more agents, deploys, then records the result and hands you the page link to review. You rate it. Over time the table becomes a feedback record of agent-driven development — which agent and model produce the best results for your project, at what token cost — something a deploy log alone can never tell you. It is the visible heart of Fractera's "product loop": build, deploy, review, rate, improve. See the whole agent-driven cycle visualized in the [Fractera development loop](/ai-development-loop). --- ## How Memory accumulates knowledge and how Brain & agents use it Memory (LightRAG) is the shared accumulator of the whole layer — one vector knowledge base that every agent reads from and writes to, so context compounds instead of resetting each session. - **Shared accumulator.** There is a single Memory for the server. Whatever any agent stores there — your codebase, documents, architectural decisions, solved problems — becomes available to every other agent. Knowledge accrues over time rather than living in one chat's history. - **How information gets in.** Memory does **not** auto-learn. Agents (and you) push content into it explicitly through an ingest endpoint; each write is tagged with the identity of the agent that made it. This keeps the store curated, not noisy. - **How Brain and each agent use it.** When working a task, Brain and the coding agents **query** Memory to ground their answer in your accumulated context before acting — so an agent starts a session already knowing your project instead of asking "where is the navbar?". Brain in particular leans on Memory to coordinate: it pulls shared context, then delegates with that context in hand. - **Practical effect.** Tasks that take 10–20 back-and-forth messages in a vanilla chat often resolve in 2–3, because the model arrives already grounded. Activating Memory requires an OpenAI API key (used economically — the embedding model is among the cheapest), set in the admin panel. --- ## Two modes: IP (open) and Secure (your domain + HTTPS) **IP / insecure mode** (the default right after deploy): the workspace is reachable at `http://:port` over plain HTTP, with open onboarding. This gets you into your workspace in seconds, with no DNS or certificate wait. Your browser will show a "Not secure" warning — that is normal until you attach a domain. **Secure mode** (after you attach your own domain): everything runs on `https://` with a free Let's Encrypt certificate (auto-renewed), strict role-based sign-in, and a host firewall that closes all service ports except 80/443. For regions or compliance rules where Let's Encrypt is unavailable, you can upload your own certificate. You switch from IP to Secure yourself, inside the workspace (Admin → Personal Domain), whenever you want — and you can switch back. --- ## Connecting your domain: the IP → Secure transition in detail A fresh deploy is IP/insecure by default. Moving to secure mode is a guided wizard in Admin → Personal Domain, run entirely from your own server: 1. **DNS.** Point your domain's A-records — the apex plus the service subdomains (www, auth, admin, data, hermes, lightrag, and **chat** for the built-in web chat) — at the server IP. The wizard verifies they resolve. 2. **Certificate.** The admin app runs certbot on the server to issue a single Let's Encrypt certificate covering all those hostnames. Alternatively you **upload your own certificate** — a first-class path for regions where Let's Encrypt is unavailable or where compliance requires specific (e.g. national / GOST) certs. 3. **Activate.** The workspace switches every service into secure mode at once: the mode flag flips in all services, the session cookie becomes `Secure` and scoped to your domain, Nginx is rewritten for HTTPS, and a host firewall closes every inbound port except 80/443. A safety watch probes the new domain and auto-rolls-back to the previous settings if it doesn't come up — so a mistake degrades gracefully instead of bricking the server. **How the coding-platform bridges connect.** In IP mode the browser talks to each platform's bridge directly over `ws://:`. In secure mode they move to path-based **wss** under the cert-covered admin host — `wss://admin./ws/...` — so the interactive terminals keep working over TLS with no mixed-content blocking. **Reading the Step 3 health-check (200 / 307 / 404 are all fine).** The final check marks a host **healthy** when three things hold: DNS resolves to your server, the TLS certificate is valid (strict verification passes), and the service answers with any normal code in the 200–499 range (not a timeout, not a 5xx). The exact code is just informational — it tells you what the service returns at its root `/`: - **200** — the service serves a page at `/` (apex, www, admin, hermes, **chat**). - **307** — the service redirects at `/` (auth → the sign-in form; lightrag → its own UI). A normal redirect. - **404** — the service has no page at `/` (data — a media/DB API that legitimately serves nothing at the root). Only a real failure blocks the switch: DNS not resolving, an invalid certificate, a timeout, or a 5xx. If none of those occur, all hosts are green even with a mix of 200/307/404. **Reversible.** A "switch back to IP / demo mode" option restores the previous configuration and reopens the service ports. Certificates auto-renew (~every 60 days); if a certificate nears expiry an early warning email is sent. --- ## Data ownership & cloud exit Everything your application needs — authentication, database, file storage, AI memory — lives on a server you own. No third party has access to your data. No dependency on someone else's uptime, pricing changes, or terms. This is the cloud-exit promise: no Clerk subscription, no Supabase invoice, no Vercel bill that scales with traffic; one server, one bill. If you pause your business, your data does not disappear — back it up and restore when ready. Your application code lives on GitHub, so recovery is always possible, and the built-in AI assistants can help rebuild even when dependencies have aged. It also helps you meet regulatory or internal-policy requirements and avoid surprise bills. --- ## The admin panel (Bridges) and its default functions The admin workspace — also called Bridges — is the control panel that runs on your server. It is where you actually drive everything, and it requires the admin role (the first person to register on a fresh server). By default it gives you: - **A carousel of your installed coding platforms.** Click one to open its live interactive terminal; an always-present **system terminal** is the last card (see "The system terminal"). - **Brain and Memory canvases** (if those components are installed) — open the Hermes and LightRAG interfaces inline. - **Settings menu:** Users (accounts and roles), Upload media, Database browser (view and edit tables directly), Environment variables, Personal Domain (the IP → secure wizard), Hermes / Memory settings (API keys), Export / Import data (a backup ZIP of database + storage), and Help. - **Footer actions:** Deploy (rebuild the open app layer after changes), GitHub connect with one-click Pull / Push, Info (README), links to Skills and Product Loop, and the current build version. Everything an agent or you build lives behind this panel, and every part of it is gated by authentication (see "How authentication blankets the whole layer"). --- ## The system terminal The admin panel includes a system terminal — a plain project-level shell on the server, always present as the last card in the carousel. Unlike the AI platforms it can never be disabled, because it is part of the core. Use it to install extra tooling, run one-off commands, link your Telegram bot to Brain, install your own copy of a coding agent, or anything else the server level needs. It opens at the project root where the services live. --- ## VPS, specs & pricing Fractera is free. There are **no plans and no tiers** — the platform is always free to use. The only money involved is the VPS you run it on (paid to your hosting provider, never to Fractera) and **optional, voluntary sponsorship** ($1 / $5 / $20 — see "Sponsorship & Fractera Pro"). For full AI-coding workloads the recommended minimum is **4–6 cores and 6–8 GB RAM**; storage depends on your project (75 GB is a solid baseline). Once active AI development wraps up, you can downgrade to ~2 cores / 4 GB RAM — often just a couple of euros per month. A plain server with no AI needs even less. You bring your own VPS from any provider. --- ## Who it is for & use cases - **Vibe-coders and solo founders** who want a production stack (auth, DB, storage, AI) without wiring ten cloud services together. - **Experienced developers** who want to offload cloud-resource management and DevOps — deploy a plain server, sync it with a local IDE (e.g. VS Code) over GitHub, and treat their own VPS as a self-hosted alternative to Vercel. - **Teams needing data sovereignty** — keep user data, auth, and database on infrastructure they control, to meet regulatory or internal-policy requirements. - **Builders bringing an existing project** — connect a GitHub repo and continue AI-assisted development on the server. - **People who want autonomous AI workflows** — let Hermes coordinate multiple agents on multi-step tasks. The same server can be used purely as a self-hosted backend (database + object storage + optional auth) with no AI at all. --- ## Real-world use cases — what founders & teams actually build Fractera is not just a theoretical framework — it is a deployment engine for practical, custom automation. Because the architecture enforces a strict split between the public-facing application (open layer) and the authenticated admin panel (guarded layer), builders use it to solve asymmetric operational problems with minimal token spend. Here is what real users have already built and deployed on Fractera. **1. The Collaborative Content Engine (private internal workspace)** - **The problem:** a high-traffic blogger needed a unified workspace where a distributed team of editors could collaborate on content planning, draft preparation, and asset management — without exposing the system to the public. - **The Fractera solution:** deployed entirely in secure, authenticated mode. The team uses the built-in SQLite database and file storage to manage the publishing pipeline. Editors work in an isolated environment, using Fractera's cross-platform AI routing to brainstorm structures and refine texts collaboratively — turning a standard VPS into a private corporate command center. **2. The Local Service Dispatcher & Smart Kanban (automated lead routing)** - **The problem:** a custom-furniture salon manager needed to automate dispatching for kitchen and wardrobe measurement requests — ingesting incoming emails from the marketing site and dynamically routing them to field engineers by geographic proximity to cut city-travel costs. - **The Fractera solution:** a background service fetches inbound emails via API and turns them into structured data. Fractera's local database acts as the state machine, rendering a secure, internal-only Kanban board. It stores field-tech availability and locations, letting authenticated staff orchestrate logistics privately — without a single byte of customer data leaking to third-party cloud platforms. **3. Adaptive AI Tutor (hybrid public/private EdTech)** - **The problem:** a parent wanted a hyper-personalized programming course for her child that adapts daily based on real performance, controlled securely via mobile commands. - **The Fractera solution:** a hybrid public/private structure. The child uses an unauthenticated, lightweight public page to complete interactive daily coding challenges; results are piped securely to the backend database. The parent uses a private dashboard and a dedicated Telegram bot connected to the Hermes orchestrator. Based on the child's performance metrics, the parent issues a voice command, prompting the AI to instantly restructure the next day's lesson database. **4. Viral Trend Scraper & Autonomous Blog Loop (public passive-traffic generator)** - **The problem:** a content creator wanted to monitor trending topics across competitive Telegram channels, enrich those signals with live web data, and autonomously publish optimized long-form articles to a public blog and external resources to capture maximum traffic. - **The Fractera solution:** the server acts as an autonomous data agent. A scheduled script monitors specified Telegram channels, feeds hot topics to the Hermes orchestrator, expands them with real-time search (e.g. the Exa API), and publishes the enriched posts via external APIs. The public site runs as a static, blazing-fast SEO blog with no user registration. Meanwhile traffic metrics are piped back to the creator's Telegram bot, so they can track performance and iteratively optimize publishing schedules. **5. Dynamic School Timetable (collaborative scheduling)** - **The problem:** building a school timetable is notoriously hard and never static. The standard schedule constantly needs exceptions — one teacher requests a day off, another is out sick, someone has to take overtime or cover substitute classes, someone comes in on a day off for school-wide events. Reconciling everyone's constraints by hand is painful. - **The Fractera solution:** the school started by using the agent to generate surveys, sending links through their existing chat to private pages where each teacher's availability and preferences are collected. The agent forms a baseline timetable; each teacher has a private page to request changes; the system reads every teacher's input and the schedule dynamically re-builds until it is approved in a way that suits the maximum number of teachers. When something unplanned happens — a teacher falls ill — the model can even suggest which teachers would be the best fit to offer the substitute lessons to. --- ## Partner program (affiliates for bloggers) Fractera's partners are bloggers and YouTube creators who recommend Fractera to their audience. Instead of a plain referral link — which would send their readers to the general landing page (aimed at a different audience) and leak traffic — each partner gets two conversion-focused surfaces: - **Partner page** — a personal mirror of the Fractera landing at `https://www.fractera.ai/partner//`, trimmed to just the order section (enter server details, pick a provider). It also satisfies what hosting providers require for affiliate approval: a real URL where the affiliate link lives. - **Widget** — an `