---
title: "Deploy Executor | Open Source MCP Gateway"
description: "Self-hosted MCP gateway: connect any AI agent to your APIs and tools"
category: "AI/ML"
url: https://railway.com/deploy/executor-selfhost
---

# Deploy Executor | Open Source MCP Gateway

Self-hosted MCP gateway: connect any AI agent to your APIs and tools

**[Deploy Executor | Open Source MCP Gateway on Railway](https://railway.com/template/executor-selfhost)**

- **Creator:** katsuba.dev
- **Category:** AI/ML
- **Total deploys:** 1

## Template content

### Executor https://executor.sh/favicon-192.png

- **Image:** ghcr.io/usefulsoftwareco/executor-selfhost:1.5.40
- **Public domain:** Yes

## Documentation

# Deploy and Host Executor on Railway

Executor is the open-source integration layer for AI agents: configure a tool once — an
OpenAPI spec, an MCP server, a GraphQL endpoint or a custom JS function — with its auth and
per-tool policy, then call it over MCP from any agent you use. This template runs the official
single-container self-hosted build with a persistent volume, a pre-created owner account, and
generated secrets, so it is usable the moment it finishes deploying.

## About Hosting Executor

Executor ships as one container that keeps everything — its libSQL/SQLite database and the
generated encryption keys — under `/data`, so there is no separate database to run. This
template mounts a Railway volume there so your catalogue, credentials and policies survive
restarts and upgrades, sets the public URL from your Railway domain automatically, and
generates the session secret and the master encryption key for you.

It also closes a gap the other self-host templates leave open. Executor's first-run setup makes
the **first visitor** the owner; on a public URL that is a race a stranger can win. This
template instead pre-creates the owner from `EXECUTOR_BOOTSTRAP_ADMIN_EMAIL` and a generated
`EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD`, so the account exists before anyone can claim it. Sign in
with that email and the generated password (both visible in the service variables), then change
them from the Admin page.

## Common Use Cases

- **One tool catalogue for every agent** — register an API once and call it from Claude,
  Cursor, or any MCP-compatible client without re-wiring credentials each time.
- **Governed access to internal APIs** — put OpenAPI/GraphQL endpoints behind per-tool policies
  so agents get exactly the operations you allow, with auth held server-side.
- **A private MCP gateway** — expose curated MCP servers to your team from one self-hosted place
  instead of scattering keys across client configs.

## Dependencies for Executor Hosting

### Deployment Dependencies

- The official upstream image `ghcr.io/rhyssullivan/executor-selfhost`, pinned to a specific
  version rather than `latest` so an auth/crypto service never upgrades itself underneath a
  running instance.
- A single Railway volume mounted at `/data` for the database and keys.
- No external database, cache or message broker — this is a genuine single-service deploy.

### Implementation Details

- The app listens on port `4788`; the domain and healthcheck are wired to it.
- `BETTER_AUTH_SECRET` and `EXECUTOR_SECRET_KEY` are generated once on deploy. **Do not change
  `EXECUTOR_SECRET_KEY` afterwards** — it is the key that decrypts every stored integration
  credential, so rotating it makes existing credentials unreadable.
- `EXECUTOR_WEB_BASE_URL` is pre-filled from your Railway domain; if you attach a custom domain,
  update it to match.

## Why Deploy Executor on Railway?

Executor is lightweight — this deploy idles around **150–200 MB of RAM**, so it typically costs
**a few dollars a month**. Railway gives it a persistent volume, an HTTPS domain and one-click
redeploys, and this template arrives already configured: secrets generated, owner account
created, port and domain wired correctly, and every variable pre-filled — there is nothing you
are forced to set before it runs.


## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [stella](https://railway.com/deploy/stella) — Self-host stella with web, API, Postgres, Redis, and object storage.
- [Hermes Agent | OpenClaw Alternative with Dashboard](https://railway.com/deploy/hermes-agent-or-openclaw-alternative-wit) — Self-Hosted Hermes AI Agent for Telegram, Discord & Slack

Open this page in a browser: https://railway.com/deploy/executor-selfhost