Base setup#

This page covers the prerequisites and instance hardening required before connecting any external AI agent to the EIQ MCP Server. Every agent setup page links back here.

Requirements#

Your instance must be Public — it must have a public DNS address and a public IP address.
You must have root SSH access.
The Intelligence Center instance must be publicly accessible over HTTPS.
You must generate an API Token from the Intelligence Center (see Generate your API Token).

1. Harden your instance#

Extra precautions must be taken when your instance is public:

No insecure passwords. Use a password manager to generate strong passwords.
Add a firewall (instructions below).

1.1 Add a firewall (firewalld)#

For simple use cases, use firewalld. Run the following commands as root.

Install:

dnf install firewalld

Enable the systemd service:

Caution

This may terminate your current session. You should be able to reconnect with SSH.

systemctl enable --now firewalld

List all rules:

firewall-cmd --list-all

Add critical services:

firewall-cmd --add-service http --add-service https --add-service ssh --permanent

Reload:

firewall-cmd --reload

2. Install snapd#

We install snapd so we don’t have to deal with an outdated Python. Prefer the official snapd documentation.

For convenience, run the following as root:

dnf install epel-release
dnf install snapd
systemctl enable --now snapd.socket
# certbot requires classic install
ln -s /var/lib/snapd/snap /snap
systemctl start snapd

Note

After installing, run logout or exit to completely exit your terminal session, then log back in. If you don’t, snap will complain and ask you to log out.

3. Install certbot#

snap install --classic certbot

4. Create certs#

/var/lib/snapd/snap/bin/certbot certonly -d <PUBLIC.DOMAIN.NAME.example.com> --webroot -w /opt/eclecticiq-platform-frontend

5. Symlink certs#

# backup old certs
mv /etc/eclecticiq-nginx/ssl/eclecticiq-default.fullchain.pem{,-$(date +%s)}
mv /etc/eclecticiq-nginx/ssl/eclecticiq-default.privkey.pem{,-$(date +%s)}
# symlink certbot certs
ln -s /etc/letsencrypt/live/<PUBLIC.DOMAIN.NAME.example.com>/fullchain.pem /etc/eclecticiq-nginx/ssl/eclecticiq-default.fullchain.pem
ln -s /etc/letsencrypt/live/<PUBLIC.DOMAIN.NAME.example.com>/privkey.pem /etc/eclecticiq-nginx/ssl/eclecticiq-default.privkey.pem

6. Test and reload nginx#

# test nginx config
nginx -t
# reload
nginx -s reload

Generate your API Token#

Generate an API Token from the Intelligence Center. This token is used as the Bearer token in each agent’s MCP configuration, so keep it handy — you’ll paste it into the Authorization header when configuring your agent.