Debian packages
For teams that run services on VMs or bare metal. TraceMem and DecisionDB install as separate packages with systemd units, ready to enable.
- tracemem_<version>_<arch>.deb
- decisiondb_<version>_<arch>.deb
Docs / Deployment
Deployment
TraceMem deploys into your own network, on your own Linux servers or cloud machines, and your team operates it. It connects to the identity provider, data systems, models and collaboration tools you already run, so it fits the stack you have rather than asking for a new one.
- Delivered as
- Debian packages, container images
- Runs on
- Linux, amd64 and arm64
- Scales
- From one node to a distributed cluster
- Calls home
- Never. Licences verify offline
How it fits your stack
Agents, model clients and people reach TraceMem. TraceMem reaches everything else, with credentials the agents never hold. Every piece runs inside your boundary, and your team decides what may leave it.
Connects to TraceMem
Agents and applications
Over MCP, the HTTP API or one of our SDKs.
MCP · HTTP · SDKs
Model clients and coding agents
Existing Anthropic and OpenAI clients change their base URL and nothing else.
People
Operators, policy authors and approvers, signing in with your identity provider.
The deployment
TraceMem
The governed runtime. Agents, model clients and people all reach it here, and every action is checked against policy before it goes anywhere.
- API and model gateway
- MCP servers
- Dashboard
DecisionDB
The append-only, hash-chained record of every decision, kept on your own storage.
TraceMem connects to
Your identity provider
Every actor, agent and approver is verified against it.
OIDC
Your data and tools
Databases, SaaS platforms, HTTP APIs and MCP servers, through connectors.
Your models
Commercial providers or models you host, behind the gateway.
Your approvers and your logs
Chat, email and ERP approvals, and log forwarding to your SIEM.
Distributions
Pick the format your platform team already runs. TraceMem and DecisionDB are built for both amd64 and arm64, and customers get artefacts and licence keys through the customer portal.
Container images
For teams that run containers. Images for the runtime, DecisionDB, the dashboard and the PII detection services, with Compose definitions for every topology. Pull them from our private registry or download them as image archives.
- tracemem/server
- tracemem/decisiondb
- tracemem/dashboard
Trial image
Everything in one container, so an evaluation with our team needs one machine rather than a platform project.
- tracemem/trial
Model packages
Optional. If you do not already serve a model for PII protection, we ship text and vision models packaged to run on your own NVIDIA GPU hosts.
- Text reasoning model
- Vision model for images and documents
Topologies
Start small and grow into the arrangement your availability targets call for. The same distributions run in all three.
Single node
TraceMem and DecisionDB on one machine. The quickest way to production for a first set of agents, and the natural home for staging and test environments.
- 1 node
Cluster
TraceMem and DecisionDB side by side on each node. Every DecisionDB node accepts writes and replicates to the others, and TraceMem fails over between them, so losing a node does not stop your agents.
- 3 or more nodes
- Active replication
Distributed
The runtime and the trace store on their own nodes, so each is sized for its own load: request volume on one side, years of retained traces on the other.
- 6 or more nodes
- Each layer scales on its own
The API nodes hold no session state, so they sit behind whichever load balancer you already run. One deployment can serve several tenants, each with its own policies, agents and trace history.
What connects to TraceMem
Each kind of caller has its own entry point. They all lead to the same governed path, so a control applies to every caller whichever interface it uses.
| Entry point | Who uses it | Port |
|---|---|---|
| Agent MCP server | Agents built on MCP, including coding agents and agent frameworks. | 9001 |
| HTTP API and SDKs | Agents and applications calling TraceMem directly, or through our SDKs. | 8080 |
| Model gateway | Anthropic- and OpenAI-compatible clients, pointed at TraceMem instead of the provider. | 8080 |
| Dashboard | Operators, policy authors and approvers, with single sign-on through your OIDC provider. | 3000 |
| Admin MCP server | Administrative tooling and automation that manages agents, products and policies. | 9002 |
How each entry point is used, with the SDKs and framework plugins, is in SDKs and APIs.
What TraceMem connects to
TraceMem holds the connections to your systems, so agents get governed access without ever holding a credential. Everything below is configured in the dashboard.
Data and tools
Databases, warehouses, business apps and developer tools, published to agents as governed data products and capabilities.
- PostgreSQL
- MongoDB
- Snowflake
- Databricks
- Amazon S3
- Salesforce
- GitHub
- and 42 moreplus any REST API or MCP server
Identity
Your OIDC provider verifies every actor, agent and approver, and signs people in to the dashboard.
- Microsoft Entra ID
- Okta
- Google Workspace
- Oracle IDCS
- Keycloak
- and 3 moreor any OIDC provider
Models
Commercial providers or models you host, behind one gateway your agents already know how to call.
- Anthropic
- OpenAI
- Azure OpenAI
- vLLM
- Ollama
- See allor any OpenAI-compatible server
Approvals
Exceptions reach approvers in the tools they already work in.
- Slack
- Microsoft Teams
- SAP S/4HANAAnswered in the ERP
- Dynamics 365Answered in the ERP
- Oracle NetSuiteAnswered in the ERP
- and 9 more
Agent platforms
Agents are discovered on the platforms they are built and hosted on.
- Amazon Bedrock
- Google Vertex AI
- Microsoft Foundry
- Salesforce Agentforce
- LangChain and LangGraph
- and 6 more
Every supported system is listed in Integrations.
Your environment
What a deployment needs from your side. Most of it is infrastructure your team already runs.
| Requirement | Detail |
|---|---|
| Servers | Debian 12 or later, or Ubuntu 22.04 or later, on amd64 or arm64. On premises or on cloud machines you control. |
| Trace storage | Local disks or mounted volumes for DecisionDB, with hot, warm and cold tiers. |
| TLS | A reverse proxy or load balancer terminating TLS in front of the API and dashboard, and certificates for DecisionDB. |
| Model endpoints | Optional, for PII protection: OpenAI-compatible text and vision model endpoints, yours or our model packages. |
Security and operations
No dependency on us
A licence is a signed key verified locally. There is no activation call, no telemetry and no update check, so a deployment runs the same whether or not it can reach the internet.
- Ed25519-signed licence keys
- No call home
Encrypted in transit and at rest
TraceMem talks to DecisionDB over TLS, with mutual TLS available. Connector credentials are stored encrypted, and each tenant's traces can be encrypted under their own key.
- TLS and mTLS to DecisionDB
- AES-256-GCM per tenant
Fits your operations
Health and readiness checks for your load balancer and monitoring, structured JSON logs for your collector, and an audit log in JSON Lines for your SIEM.
- GET /health, GET /ready
- JSON logs, JSONL audit log
The installation guide, with every service, internal port and configuration option, is in the customer portal. If you are scoping TraceMem for your environment, talk to our engineers about your stack.