Zeqqat

Zeqqat is an open source MCP gateway between AI agents and your APIs. Your agent connects to one Zeqqat URL instead of holding your API keys. Zeqqat decides what it may do, makes the call for it, and records everything. Self-host it on your own Dokploy for free, or use the hosted version at zeqqat.com.

✨ Features

• Keys stay out of the model: API keys are encrypted at rest and never returned to an agent.
• Scrubbed responses: env vars, tokens and private keys are stripped from every response before the model sees it.
• Permissions per connection: allow reading, creating, editing or deleting, one connection at a time.
• Policies: allow exactly the tools you list, and share policies with others.
• Activity log: every request shows who asked, which agent, the reason it gave, what it called and what came back.
• Teams: organizations, workspaces and roles, so teammates get their own access instead of a shared key.
• The whole Dokploy API: all 554 endpoints, found by search, so your agent's context isn't flooded with tool definitions.
• Any API from its OpenAPI spec: paste a link to an app's spec (Stripe, GitHub, your own) and every endpoint becomes a tool under your account, with read, create, edit and delete guessed for each. From the dashboard, from your agent with zeqqat_import, or with POST /api/integrations/import.
• Standard OAuth sign-in: agents connect with OAuth 2.1, and each token only works on the connection it was issued for.
• Self-hosted: one container and Postgres, with migrations applied on startup.

🚀 Getting Started

On Dokploy

1. Create a Docker Compose service from this repository, or paste docker-compose.yml.
2. Set the environment variables listed under Configuration below.
3. Add your domain to the zeqqat service on port 3000 and deploy.
4. Open your domain, sign in, and connect your Dokploy.

The full walkthrough is at zeqqat.com/docs/self-host.

Anywhere with Docker

git clone https://github.com/zeqqat/zeqqat.gitcd zeqqatcp .env.example .env    # fill in the valuesdocker compose up -d

To reach it locally on http://localhost:3000, uncomment the ports lines in docker-compose.yml.

Connect an agent

After you connect your Dokploy, Zeqqat gives you a connection URL like https://zeqqat.example.com/you/mcp/deployment/a39f. Add it to your agent as a remote MCP server and sign in when asked. Your agent reaches Dokploy through a few stable tools: zeqqat_search, zeqqat_describe, zeqqat_run, zeqqat_whoami, zeqqat_policy, zeqqat_secret, zeqqat_import and zeqqat_docs.

⚙️ Configuration

Every option is documented in .env.example.

Anonymous install ping

So we can tell how many self-hosted installs exist and which versions they run, a self-hosted install sends one small ping to https://zeqqat.com/api/telemetry when it starts and once a day after that. The ping is exactly this, and nothing else:

{ "installId": "a random UUID made on first start", "version": "0.2.1" }

No IP address, hostname, users, emails, instances, API keys, connections or tool calls are ever sent, and zeqqat.com doesn't store your IP. The code is in lib/telemetry.ts.

To turn it off, set ZEQQAT_TELEMETRY=0 (DO_NOT_TRACK=1 works too) and restart.

☁️ Cloud vs Self-hosted

🛠️ Development

You need Node 22, pnpm 9 and Postgres.

pnpm installcp .env.example .envpnpm dev

pnpm check runs typecheck, lint and tests. AGENTS.md explains the architecture. Built with Next.js, Postgres, Drizzle and Better Auth.

Contributors 🤝

🤝 Contributing

Read the Contributing Guide before opening a pull request.

🔒 Security

Please report vulnerabilities privately. See SECURITY.md.

📄 License

Apache License 2.0