AgentOS on Azure Container Apps

Clone and configure

git clone https://github.com/agno-agi/agentos-azure.git agentos
cd agentos

cp example.env .env

Edit .env and set OPENAI_API_KEY.

Start the platform

docker compose up -d --build

The first build takes a few minutes. Confirm the API is available at localhost:8000/docs.

Verify end to end

./scripts/mcp_check.sh

Prints MCP OK with the tool count and a real agent answer through the MCP endpoint.

Connect the AgentOS UI

1. Open os.agno.com and sign in.
2. Click Connect OS, enter http://localhost:8000, and name it Local AgentOS.

Build your first agent

1. Chat with Platform Builder: "Build an agent that tracks AI news and writes a daily brief". Go through the agent development process.
2. Once created, click Refresh on the top right, pick the new agent from the Agents dropdown, and ask: "What's new with Anthropic?"
3. Ask Platform Manager: "How healthy is the platform?" It answers from eval history, deployment checks, schedules, and the agent you just built.

Create a production env

cp .env .env.production

Edit .env.production with production values: a different OpenAI key, production-only credentials, a different Slack workspace.

Deploy

./scripts/azure/up.sh

The first run takes 15-20 minutes (Postgres Flexible Server is the long pole) and creates everything inside one dedicated resource group, agentos by default: a VNet with private DNS, a container registry with the locally built image, PostgreSQL 17 Flexible Server with private access and pgvector allowlisted, the Container Apps environment, and the agent-os app configured with one always-running replica. The app URL is only known after create. Once the app is up, the script writes AGENTOS_URL back to your env file so scheduled jobs reach the platform. It also generates MCP_CONNECT_SECRET, the OAuth consent secret for connecting chat apps, into the same file.

Mint your JWT key

The script pauses for a JWT_VERIFICATION_KEY. Token-Based Authorization is on by default. Production startup requires that verification key or a readable JWKS file at the container path in JWT_JWKS_FILE; otherwise the process exits.

1. Open os.agno.com, click Connect OS → Live, and enter your Container Apps URL.
2. Name it Live AgentOS, turn on Token-Based Authorization (JWT) on the connection panel, and connect. The UI generates the public key. If the OS is already connected, enable the setting under Settings → OS & Security.
3. Copy the public key and paste the full PEM into the up.sh prompt. The script saves it to your env file, stores it as a Container Apps secret, and applies it together with AGENTOS_URL in a second revision.

If your env file already sets JWT_JWKS_FILE, the script skips the pause, but it only applies the path. Bake or mount the file before deployment. If you skip the prompt, add JWT_VERIFICATION_KEY to .env.production and run ./scripts/azure/env-sync.sh. Adding JWKS later requires an image rebuild or mount plus a redeploy. Env sync alone is insufficient.

Connect your MCP clients

Re-run uvx agno connect, this time pointed at your deployed domain:

uvx agno connect --url https://<container-app-domain>

For claude.ai and ChatGPT on the web: add https://<container-app-domain>/mcp as a custom connector in the chat app's connector settings. Leave the form's optional OAuth fields (client ID / client secret) empty. Click Connect and, on the consent page, enter the MCP_CONNECT_SECRET that up.sh generated during deploy (saved in .env.production).

Confirm it's live

az containerapp logs show -g agentos -n agent-os --follow

The script prints your app URL. Give the revision a couple of minutes to converge, then open https://<container-app-domain>/docs to confirm the API is serving.