SELF-HOSTED AI AGENT
A self-hosted AI agent on hardware you control
A self-hosted AI agent runs on hardware you own or control instead of as a vendor's hosted service. C5 by Growther.si installs with one command on macOS, Windows or Linux, needs no Docker, and listens on loopback until you decide who else may reach it. Reach it from other devices over your own network, over SSH with growther connect, or through Remote Control.
- No Docker, one command
- Loopback only by default
- SHA-256 checked installer
Install a self-hosted AI agent with one command
You need nothing installed first — not Node, not Docker. C5 is a single program file that brings everything it needs. On macOS and Linux run curl -fsSL https://growther.si/install.sh | bash; on Windows, in PowerShell, run irm https://growther.si/install.ps1 | iex; or use Homebrew with brew install GrowtherSI/tap/growther-c5.
The installer picks the right build for your machine, checks the download against its SHA-256 fingerprint and stops if a single byte is wrong, puts the growther command on your PATH, and creates the data folder.
| System | Chips | Oldest version supported |
|---|---|---|
| macOS | Apple silicon and Intel | macOS 13.5 Ventura |
| Windows | x86_64 and ARM64 | Windows 10 (Windows Server 2016) |
| Linux | x86_64 | glibc 2.28 — Ubuntu 20.04, Debian 10, RHEL 8 and newer |
- Run the installerRun the one-line installer for your system, or install through Homebrew.
- Check the installRun growther --help. If you see the list of commands, C5 is installed.
- Activate this machineRun growther activate. C5 shows a short code and opens a page where you confirm it. This happens once per computer.
- Start C5Run growther. C5 starts and opens the app at http://localhost:4299. Run growther service install if you want it to start by itself.
Run it on a server or a headless box
The first thing to settle on a server is who can reach the install. By default C5 listens on loopback only, so it is reachable from the machine it runs on and nowhere else — the right default for a laptop, and a safe starting point for a server.
- No desktop needed. On a Linux server without an applications menu, start C5 with the command. growther login signs in from the command line on a machine with no browser.
- Keep it running. growther service install starts C5 automatically; growther status and growther stop do what they say.
- Serve it to your network deliberately. Set GROWTHER_BIND_HOST, list the names it may answer to in GROWTHER_ALLOWED_HOSTS, and put it behind a reverse proxy that terminates TLS.
- Data stays on local disk. Databases are refused on network shares, mapped drives and synced folders, and two machines never share one data folder. Network storage is welcome for encrypted backups.
For the full set of bind, host and origin settings, see Network and egress in the docs.
Three ways to reach your install
| Way in | How you get there | Who is in the path |
|---|---|---|
| Your own network, or a name and certificate you supply | Straight to the machine | Nobody but you and the machine |
| Your own SSH connection, with growther connect | A local port forwarded over SSH you already have | Nobody but you and the machine |
| An address Growther.si issues | A tunnel Growther.si creates for your install | Cloudflare, with the connection encrypted to and from it |
The first two need nothing from Growther.si and keep working without it. The third works from anywhere without touching your router; Remote Control is off until you turn it on at the machine itself. See AI agent remote control for pairing a phone and managing devices.
Managed configuration for IT
For a fleet, C5 ships a Windows Installer package (.msi) and a macOS installer package (.pkg) that wrap the same signed program, and it takes its settings from the tools IT already runs.
- Policy from Intune, Group Policy, Jamf or a signed policy file. Locked settings show as managed by your organisation on every user's screen. C5 writes the ADMX, mobileconfig and schema templates itself.
- Sign-in through your directory. Microsoft Entra ID, Okta, Google Workspace and other OpenID Connect providers, SAML 2.0, or on-prem Active Directory over LDAP.
- Audit shipping. Send the tamper-evident audit trail to Microsoft Sentinel, Splunk, OpenTelemetry or syslog, and export signed evidence bundles.
- What may leave, decided centrally. Lock the network posture offline, restrict which providers and models agents may use, set a global cost cap, and control sharing with Mothership.
Self-hosted vs SaaS AI agents
| C5 (self-hosted) | Typical SaaS AI agent | |
|---|---|---|
| Where it runs | Your machine or server | The vendor's servers |
| Where data lives | Your local disk, encrypted at rest | The vendor's storage |
| Who can reach it | Loopback by default; you choose the paths | Through the vendor's website or app |
| Updates | growther update, checked against a signed manifest; rollback available | Whenever the vendor ships |
| Works offline | Yes, with a local model | No |
Self-hosting is the wrong fit if you want a service someone else keeps running, or if your users work on a shared multi-session host such as RDS, Citrix or Azure Virtual Desktop, where C5 refuses to start.
Self-hosting is one part of running a local AI agent. For a machine that must make no outbound connections at all, see the offline AI agent page, and for keeping task data away from cloud providers, the private AI agent page.
Frequently asked questions
Do I need Docker to self-host C5?
No. C5 is a single program file and brings everything it needs. You do not need Docker, Node or any other runtime installed first.
Can I run a self-hosted AI agent on a VPS?
Yes, on Linux x86_64 with glibc 2.28 or newer, such as Ubuntu 20.04, Debian 10 or RHEL 8. C5 listens on loopback by default, so the simplest way in is growther connect over your existing SSH connection. ARM Linux is not supported.
Can C5 run air-gapped?
Yes. Set the egress posture to Offline, which can be locked by policy, place the memory-search, voice and classifier models by hand, and ask Growther.si for an air-gapped licence. Pair it with a local model so tasks never need the internet.
How do updates work?
With one command. growther update downloads the latest release, checks that it is genuine and installs it, restarting C5 if it was running. growther rollback goes back to the version you had. Packages deployed by IT default to not updating themselves, so the package manager stays in control.
How many users can use one install?
It depends on your plan, which sets how many machines can be active. An install can sign people in through Entra ID, Okta, SAML or LDAP, with roles and permissions. C5 refuses to start on shared multi-session hosts such as RDS, Citrix or Azure Virtual Desktop.
In the docs
Put the agent on hardware you control
One command installs C5 on a laptop, a server or a headless box, and it listens on loopback until you open a path. Download C5 and run your first install.