Servers and CI. A computer no one signs in on, such as a server, a container or a CI runner, runs agents with a license key.

Installing

Install Portelon as on any other computer. On Debian and Ubuntu, to install it from Portelon’s repository without downloading the package first, as in a CI image:

sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -fsSLo /etc/apt/keyrings/portelon.pgp https://dl.portelon.com/keys/portelon.pgp
sudo curl -fsSLo /etc/apt/sources.list.d/portelon.sources https://dl.portelon.com/linux/apt/portelon.sources
sudo apt update && sudo apt install portelon

Keep these paths: the package keeps both files up to date. gpg --show-keys /etc/apt/keyrings/portelon.pgp prints the key’s fingerprint, which must match the release key’s.

License keys

Create a key on your account page, under License keys. It’s shown once, so store it where the machine’s other secrets live.

On the machine, run portelon-mcp license set and paste the key, or pipe it in:

printf '%s' "$PORTELON_KEY" | portelon-mcp license set

The key licenses the user who runs the command, so run it as your agents’ user. Or set PORTELON_LICENSE_KEY in the environment Portelon starts in, and it stores the key the same way. Some agents, such as Codex, pass Portelon only a few variables, so license set is simpler.

portelon-mcp license status says how the machine is licensed, and portelon-mcp license remove forgets its key.

Revoke, on the account page, stops every machine using a key within the hour. Keys are for computers that run agents for you: keep them secret, and don’t sell or give them to anyone else.

How keys count

Your plan covers five devices at once. A machine on a key holds a place while it runs, and gives it back within an hour of stopping, so CI containers, each a new machine, count only while their jobs run.

Signing out a machine on a key doesn’t keep it out: it comes back the next time it renews. Revoke the key instead.

Linux without a desktop

Portelon needs no display, but it needs a keyring to keep a profile. Choose one of these:

1. A fresh profile for each run, --ephemeral-profile, which needs no keyring.
2. A keyring: a Secret Service, such as GNOME Keyring, or KWallet, running and unlocked on the user’s D-Bus session bus.
3. The basic store, --password-store basic, which keeps saved passwords effectively unencrypted. Give it to every agent on the machine: an agent without it can join a browser that’s already running, but can’t start one.

An agent’s entry

Give agents /usr/bin/portelon-mcp, which updates keep in place. Here, with a profile that keeps its logins between jobs:

{
  "mcpServers": {
    "portelon": {
      "type": "stdio",
      "command": "/usr/bin/portelon-mcp",
      "args": ["--unattended", "--profile", "ci", "--password-store", "basic"]
    }
  }
}

--unattended is for agents no one watches: they don’t try to show you anything. In CI, a fresh profile for each job is simpler: "args": ["--unattended", "--ephemeral-profile"]. Options lists the rest.

portelon-mcp doctor checks the machine’s setup.

A browser with no display, or with a fresh profile for each run, never checks for updates, so update servers with their package manager.