Host an AI agent on a VPS: setup and security

To host an AI agent on a VPS, install its runtime on a maintained server, keep its administration interface private, and test recovery before assigning real work. You can still access the model through an API: hosting the agent does not mean hosting the model. Your budget needs to cover the server, model calls, supporting services, and maintenance time.

Prerequisites and recommended architecture

This guide uses OpenClaw for the practical walkthrough. The principles behind server selection, permission boundaries, and recovery also apply to tools in our AI agent directory, although their installation commands differ.

Before you begin, have the following ready:

a fresh VPS running a maintained Linux distribution;
an administrator account accessible with an SSH key;
access to the hosting provider’s recovery console;
a dedicated system account for the agent;
an API key reserved for this deployment;
a backup destination outside the VPS;
someone responsible for stopping the service and revoking its access.

The proposed architecture is straightforward: your computer connects to the VPS over SSH, the agent’s interface listens on the loopback address, and the agent calls the model and its authorized tools. Its dashboard does not need public access.

A VPS keeps the service available when your computer is off. It also adds a machine you have to administer, including patches, disk space, monitoring, renewals, and recovery after a failure. If no one can handle those responsibilities, compare managed hosting options before moving any data.

Start by defining a limited task, such as analyzing documents placed in a dedicated directory and producing a draft. Sending messages, deleting files, and changing accounts should come only after you have validated that initial setup.

Choose the server around the work it will run

Separate the agent’s resource use from that of its tools. A loop waiting for an API response, an automated browser, and a compilation job place different demands on a server. OpenClaw’s Linux hosting documentation is the starting point for product-specific requirements.

Criterion	Agent with a remote model	Agent with a browser or compute tasks	Agent with a local model
Processor	Orchestration and response processing	Pages, scripts, and concurrent processing	Inference alongside tools
Memory	State and application services	Browser and child processes	Model weights and context
Storage	Conversations, files, and logs	Additional caches and artifacts	Models and application data
Network	Dependence on the API	APIs and websites visited	Downloads and external services
Sizing	Measure a representative task	Measure peaks in concurrent activity	Evaluate the model before buying

Do not treat any VPS size as a universal minimum. Measure resource use with the tools you will actually run, then leave room for spikes and maintenance. Acceptable average memory use can hide a failure during a more demanding task.

Also compare disk expansion options, traffic limits, private networking, and data recovery arrangements. Check that dependencies support the processor architecture, especially native extensions and browsers.

The server’s location does not describe the full path your information takes. Record the destinations used by the model, tools, backups, and monitoring separately. Placing a server in your chosen country does not automatically require other services to process data there.

1. Prepare Linux and preserve recovery access

Update the operating system before installing the application. Then create a user reserved for the service, without granting it permanent administrator privileges. The account used to maintain the server and the account used to run tasks should have separate responsibilities.

Test your SSH key connection in a second session before changing SSH authentication. Keep the first session open and confirm that the recovery console works. Disabling an access method too early can turn routine maintenance into a server recovery job.

On Ubuntu, the following commands come from the official firewall documentation, consulted on October 24, 2026:

sudo ufw allow 22
sudo ufw enable
sudo ufw status verbose

These commands assume SSH uses the port shown. If your configuration differs, adjust the rule before enabling the firewall. Also check the hosting provider’s network rules, which form a separate layer.

Open only the access you need. An agent that queries an API or checks a task queue does not need to accept public application connections for that reason alone. Check IPv6 exposure as well.

Finally, record the preparation steps in a deployment document: distribution, users, permitted access, data locations, and recovery procedure. This document should let you rebuild the server without relying on terminal history.

2. Install the agent using the official procedure

For this walkthrough, use the native installation under the dedicated account. The OpenClaw installation documentation, checked on October 24, 2026, provides this command:

curl -fsSL https://openclaw.ai/install.sh | bash

It downloads and executes a remote script. Review the script before using it on a server that already contains sensitive data. Avoid adding administrator privileges out of habit: any request for elevated access should correspond to a specific system operation.

The setup wizard configures access to the provider. Use a key reserved for this server, with whatever restrictions the provider offers. Do not copy your entire personal environment: its connections and authentication files probably give broader access than the agent needs.

The official getting-started guide then explains how to install the service and check its status. If the gateway is running in the foreground, stop that instance with Ctrl+C before installing the service:

openclaw gateway install
openclaw gateway status

On Linux, this procedure installs a user service. Verify that it keeps running after you log out and after the VPS restarts. A successful response during the installation session does not establish either behavior.

Record the installed version and your configuration choices. The installer can change over time: rebuilding later requires a compatible state, rather than simply running the same command and assuming an identical result. The OpenClaw reference guide covers additional application settings.

3. Access the interface without exposing it publicly

Keep the gateway bound to the loopback address and open a tunnel from your computer. The remote access documentation provides this command:

ssh -N -L 18789:127.0.0.1:18789 user@gateway-host

Replace user@gateway-host with your username and server. The ports match the official example consulted on October 24, 2026; adjust them if you have changed the configuration.

Leave the tunnel open, then visit this local address in your browser:

http://127.0.0.1:18789/

Complete the authentication required by the gateway. The tunnel carries the connection; it does not justify removing application access controls.

Next, verify the result from outside the server: the VPS’s public address must not provide access to the dashboard. Check the listening configuration and network rules instead of assuming the interface is protected because the tunnel works.

If you later switch to a container, repeat this check. The Docker documentation for Ubuntu explains that published ports can bypass UFW rules. Running an interface in a container does not automatically make it private.

Shared access over HTTPS requires additional design work: authentication, reverse proxy configuration, and user access controls. Do not publish the dashboard simply to make the first connection easier.

4. Restrict tools, secrets, and users

A dedicated system account limits potential damage, but it is not sufficient on its own. An agent that can read every document belonging to that account and contact the internet can still leak data. Apply least privilege to files as well as external accounts.

List the actions the agent needs to perform. For each action, specify the accessible data, the permitted destination, and whether approval is required. A document organization task does not require unrestricted access to the terminal, email, and backups.

Sandboxing concerns tool execution. Installing the gateway in a container does not establish that every command it launches has appropriate isolation. Review mounted directories, write permissions, and network access.

Keep secrets out of instructions and documents sent to the model. Use separate keys for each environment, protect authentication files, and plan how to revoke them. Treat logs and diagnostic exports as potentially sensitive too.

The OpenClaw security documentation provides an audit command:

openclaw security audit

Review its findings before adding integrations. This audit does not replace an assessment of the permissions required for your work. The guide to securing an AI agent helps you document those decisions.

Finally, treat pages, messages, and documents the agent reads as untrusted data. A prompt injection can try to redirect a tool even when it has been installed correctly. Technical restrictions must remain effective when the model receives a misleading instruction.

5. Back up outside the VPS and test recovery

First define what you need to recover: configuration, task state, working files, connections, and external dependencies. A system image and an application export serve different purposes; plan for both when your recovery requirements call for them.

The OpenClaw backup documentation provides this command:

openclaw backup create --verify

The local archive may contain secrets, and compression does not make it encrypted. Protect it and transfer an encrypted copy outside the VPS. Check the requirements for a consistent backup of your storage; the documentation specifically requires stopping the gateway for certain backups that use PostgreSQL.

For a local archive, the official restore procedure uses a staging directory:

openclaw backup restore <archive.tar.gz> --target <fresh-directory>

Replace the parameters shown in angle brackets. The target directory must be empty or must not exist. Extracting the archive does not automatically reactivate the service: activation is a separate operation.

Your recovery exercise needs to go beyond extraction. In an isolated environment, check documents, paths, permissions, and a task with no external effects. Keep production connections disabled so the restored copy does not process the same requests as the active server.

Choose a backup frequency based on how much work you can afford to lose, and measure how long it takes to restore service. Store the means to decrypt your backups somewhere other than the VPS. A backup accessible only with credentials lost during the failure does not provide a usable recovery option.

6. Monitor and update while maintaining control

A running process does not prove that the agent is doing its job. Monitor the machine, the gateway, and task results separately. A service can remain active while receiving nothing but authentication errors or producing unusable output.

Choose signals that lead to a clear response:

memory pressure and available disk space;
provider errors and timeouts;
stalled, repeated, or abandoned tasks;
API usage per task;
the date of the last successful backup transfer.

Assign each alert an action and a recipient. Favor messages that help someone decide whether to stop, investigate, or recover the service over a stream of notifications with no priorities.

Before updating, read the changes, create a backup, and prepare a rollback. Pay particular attention to data migrations: reverting to the previous program version may not be enough after a storage change. Afterward, test a representative task and the access restrictions.

Also prepare an incident procedure that can be accessed without the agent. It should explain how to suspend triggers, stop the service, preserve diagnostic evidence, and revoke secrets from an uncompromised device.

When retiring the deployment permanently, export useful data, revoke keys, and remove related access. Canceling the VPS does not necessarily close associated API accounts, external storage, or integrations.

Budget for the server and actual usage

Compare hosting plans using a dated quote that includes renewals, applicable taxes, storage, traffic, and backups. A promotional rate does not describe the ongoing cost. Add the time spent on updates, incidents, and recovery.

Item	What drives the cost	Control to put in place
VPS	Time and reserved capacity	Review server sizing
Remote model	Billable inputs, outputs, and options	Measure per task and set caps
External tools	Searches, browsing, or processing	Quotas for each integration
Backups	Volume, retention, and recovery	Retention policy
Operations	Maintenance and incidents	Named owner and procedure

To illustrate the calculation, Claude Sonnet 5.5 is listed at $2 per million input tokens and $10 per million output tokens, according to the site’s October 2026 pricing record. Assuming usage of one million input tokens and one million output tokens, that comes to $12 before the other costs.

This assumption is not an estimate of average usage. An agent can make multiple calls, feed tool results back into the model, and retry an action after a failure. Measure the cost of a completed task, including its unsuccessful attempts.

The LLM pricing calculator helps compare usage assumptions. Also set a maximum runtime, a concurrency limit, and stopping conditions: a spending alert alone will not necessarily interrupt a loop.

The article How much does an AI agent really cost per month? provides further budgeting context. When deciding on server capacity, always compare spending with acceptable results, rather than considering only the number of tasks started.

Common problems

The interface will not open. Check the gateway’s status first, then the tunnel and its local port. Look for a conflict with a service already running on your computer. Opening the VPS’s public port is not a diagnostic step.

The service stops after logout. Check the installed user service and the service manager’s rules for keeping it running after logout. Reproduce the issue by ending a session, then test again with a planned restart.

The model responds, but tools fail. Review the service account’s permissions, file paths, and the secrets available in its environment. An interactive SSH session may have permissions that the service does not.

The server slows down. Identify the constrained resource before upgrading the plan. Network delays, too many concurrent browser processes, and a full disk require different fixes.

The bill rises without additional results. Look for automatic retries, duplicate requests, and repeated calls. Before restarting an interrupted action, check whether it has already produced an external effect.

The restore looks complete, but nothing works. Check paths, dependencies, and whether the restored state has been activated. Having an archive does not guarantee that external services and their permissions are still available.

Checklist before the first real tasks

Frequently asked questions

Can you host an AI agent without a GPU?

Yes, if you access the model through a remote API: the server runs the agent and its tools. A GPU is mainly relevant to local inference, whose requirements need a separate assessment.

Does a VPS keep conversations confidential?

A VPS gives you control over the runtime environment, but the model provider receives any content sent to its API. You also need to review the hosting provider's access, backups, and connected services.

Do you need a domain name to access your agent?

An SSH tunnel lets you access a private interface without a domain. A domain becomes useful when you need shared HTTPS access or want to receive certain external events.

Can you install several agents on the same VPS?

Yes, provided you separate their accounts, secrets, and data. For users who do not trust one another, use separate environments rather than relying on separate conversations.

Can you move an agent to another hosting provider?

Prepare an export of the application state and keep the installation procedure. Migration must also account for external secrets, file paths, and connections to third-party services; copying the disk is not always enough.

Hosting an AI agent on a VPS: server selection, installation, security, backups, and costs