Open source · MIT · One binary for Linux

Build with AI agents.
Ship to production in minutes.
On your own server.

The Middleware turns one Linux machine into a place where websites and apps get built, run and published. Each site has its own AI coding agent that works inside its folder. When the site is ready, one button gives it a public name, a certificate and a deploy that drops no request.

curl -fsSL https://raw.githubusercontent.com/dcimorra/the-middleware/main/scripts/install.sh | sh

Get started View the code

1 binary, no third-party dependencies
10 coding agents to choose from
0 requests dropped on a deploy
2 min to link another machine

Who it is for

Developers who build with AI

You already ask Claude Code, Codex or OpenCode for features. Here each project gets an agent that lives next to it on the server, can run it, test it and restart it, and cannot touch anything else.

Freelancers and small agencies

Dozens of client sites over a few machines at different providers, each with its own domain, logs, tasks and conversation, in one panel. Hardware you control, no per-site bill.

Solo founders and small teams

The “push and it is live” workflow of a hosting platform without renting one: deploy from GitHub or from a conversation, roll back by writing a file, watch it all from your phone.

Anyone tired of the stack

A repo, CI, a proxy, DNS, certificates and a dashboard per service is too much machinery for most projects. Here they are one panel.

Build by talking

Every site has its own agent, jailed in its folder

The agent works in the site's folder, reads its logs, runs its commands and restarts it. Other sites, the machine's secrets and the house's configuration are out of its reach, and every step it takes is on record.

Your choice per conversation. Sign in with your Claude, ChatGPT or Google subscription, or give it an API key. The CLIs install themselves and stay current.
Watch it work, or not. Turns keep running with the panel closed; the bar tells you which conversation is waiting for you.
Know what it costs. A ledger per site, a monthly cap, and the subscription's usage under the message box.
Auto-repair. When a site goes down, an agent reads its logs and fixes it before you wake up, within the attempts and spend you allow.

Claude Code
OpenAI Codex
Google Antigravity
OpenCode
DeepSeek
Z.AI GLM
Kimi
Qwen
Mistral Vibe
xAI Grok

The house agent created and published a landing page from one message — The house agent works on the installation itself: ask it for a site and it creates, writes and publishes it.

Spec-driven development

The agent writes down what it will change, before it changes it

Turn on the OpenSpec module and every change starts as a proposal you read in the site's Specs tab. Approve it, follow its tasks as they are built, and once it ships it becomes the project's specs. New sites start with OpenSpec set up.

A site's Specs tab: two changes in progress with their task progress, and the project's specifications

From idea to production

One button to publish. Zero requests dropped to deploy.

New site from a template (static, Node, Go, Docker, or a project with no domain) or straight from a GitHub repository.
Publish. With Cloudflare, the DNS record and the tunnel route are written for you. With ports 80/443 open, the certificate comes from Let's Encrypt through a built-in ACME client.
Zero-downtime deploys. The new version starts on a fresh port, is health-checked, takes the traffic, and the old one drains. One dropped request fails the test suite.
Deploy on push from GitHub with a signed webhook, or from the conversation. Roll back by pointing at the previous build.

A site's overview: its picture, its state, Publish, its workers and its domains

Run everything a site needs

A site is a folder. Its `site.json` is all the state it has.

Processes, containers, static

Static folders, any process, Docker containers or an upstream you run elsewhere, all described by one manifest.

Workers and databases

A queue consumer, an internal API, a PostgreSQL in a container with its own volume, next to the site.

Scheduled tasks

Backups, reports, cache warm-ups, run in the site's folder with its environment. Each site manages its own.

Logs and vitals

Logs, traffic, CPU and memory per site and per worker, a response cache, a file browser and a manifest editor.

An AI gateway for your apps

A site's own code can ask an AI through the house, with the models, tools, budget and limits you set.

Sites outlive the supervisor

Restarting or upgrading The Middleware leaves them running; they are adopted again when it comes back.

The sites list: each site's state, and a chat button that says whose turn it is

A site's Tasks tab: its scheduled work in plain words, with its next and last run

A network of your own machines

A VPS here, another there, a server at home. One panel.

Machines link into a federated network. Each one is a full Middleware that keeps serving on its own; together they are managed as one.

The dashboard of a network of three machines: what needs your attention first, then each node's processor, memory, disk and sites

Link a machine in two minutes

Make an invitation in the panel, run middleware setup --join <code> on the new machine, and it is in.

No master

An encrypted WireGuard mesh where every node is a peer. If one goes down the rest carry on; a node behind NAT works by calling out.

Move a site with one button

Copied while it serves, installed for the target (even x86 to ARM), seconds of stop, databases brought along, names repointed. Undone if anything fails.

One VPN for the network

A device on any node's VPN reaches every node. One switch closes every panel to the internet.

Membership you can trust

An expelled node stays out: it cannot vote itself back, take another node's address or rewrite the others' entries.

Every node, every screen

Pick a node in the top bar and every screen, conversation, build and agent works on that machine.

The sites list with every machine's sites, this node's first

A site moving to another machine: each step with its state and how long it took

Security that does not get in the way

Least privilege by design

A firewall in front of every site

Rate limits, automatic bans in the kernel, body and country limits, and an “under attack” switch that challenges every visitor.

A guard on every process

A site that reaches into another site's folder is switched off, with the incident on record.

Per-site access control

Passwords, allow lists and per-route rules, a field each.

A panel only you reach

Passkeys, its own WireGuard VPN, push notifications, and it works from your phone.

Never root

The supervisor runs unprivileged. Anything that needs root goes through a helper with a closed list of operations.

Updates that undo themselves

Credentials are encrypted at rest, and an update rolls itself back if the new version does not come up.

Everywhere you are

Built for your phone, too

The panel installs on your phone: dark mode, push notifications when an agent finishes its turn or someone tries to break in, in English and Spanish. Everything it does is also a versioned JSON API, a live event stream and a CLI.

The panel on a phone: the sites list, a site's conversation and the house agent

Get started

From a bare VPS to a site in production