Skip to main content
Execution, runtime data, credentials and model keys run in your VPC. Agent definitions, identity and the skills catalog stay on xpander cloud. The Agent Controller is the only link, outbound only. Images are amd64 only. Install with one command from Platform > Agents > Runtime, then an interactive wizard:
Self-hosted locations are enabled per account: contact our team if the option isn’t available on yours.
Comparing deployments? See Deployment options. The network boundary and exactly what leaves your VPC are on Hybrid Architecture.

​
Architecture

Hybrid separates a control plane from a data plane, the same model as AWS EKS or Datadog: The data plane connects outbound only, on port 443. The control plane never connects into your cluster. MCP calls, external-system calls and agent workspaces all run in your cluster.

​
What gets deployed

Resource names in the Hybrid guides assume the release name xpander, as in every command there. With another release name, they start with <release>-xpander- instead, or with <release>- when the release name already contains xpander.

​
How it works

Clients (Slack, the web UI, MCP clients, the API) connect to your cluster directly. On chat.xpander.ai, the cloud UI signs you in and points the client at your cluster. Inside, the Agent Controller schedules tasks and agent-worker runs them: model calls, messages in PostgreSQL, and skill calls through the Agent Controller’s skill relay. The only connection to xpander Cloud is the deployment manager sync: the Agent Controller authenticates with organization_id + environment_id + api_key, sends heartbeats (schema not published), and pulls agent and skill configuration, MCP included. See Data that leaves the on-prem installation.

​
What talks to what

Inbound from xpander cloud: none. Outbound only: Outbound connectivity options to the control plane:

​
Data residency

Data at rest stays in PostgreSQL and Redis in your VPC, and credentials are Kubernetes secrets. The sync carries metadata and heartbeats only, never user payloads.

​
Requirements

Footprint, calculator and executor fleet: Sizing and requirements. The installer checks the same minimums (requirements.json).
xpander container images are amd64 only. Do not use ARM/Graviton instances (t4g, m7g, c7g, etc.).
The release namespace must admit PodSecurity baseline. Unlabelled is fine, and restricted is refused. The nodes that run the executor fleet need Landlock or fleet.landlock.enabled: false. See Node prerequisites. Need a cluster? Follow the EKS Cluster Setup guide. Bedrock needs your own credentials. Agents on a Hybrid install never use xpander’s keys (AI Gateway). To run Claude Code on Bedrock here, add a Bedrock key or role under Platform > AI governance > Models, or give the cluster an AWS identity for Bedrock. See AI vendors.

​
Next steps

Install Hybrid

The one-liner, the wizard and verification

Review the Hybrid network boundary

Network boundary, PrivateLink, and what leaves your VPC

Run fully air-gapped instead

Every component in your environment, no connection to xpander cloud at run time

Set up identity and access

Identity by deployment, SSO, API keys, audit logs