Installation

Each Logic Agent ships as a single, self-contained container image that serves both its REST API and its web UI. This guide covers pulling the images, the configuration contract, and running the agents for both evaluation (no auth, in-memory) and production (Entra ID + Redis).

Images

Agent	Docker Hub image
Logic Insights	`flowon/dataverse-logic-insight`
Logic Context	`flowon/dataverse-logic-context`
Logic Guard	`flowon/dataverse-logic-guard`
Logic Assurance	`flowon/dataverse-logic-assurance`

Each image:

Listens on 8080 (HTTP) and 8081 (HTTPS).
Exposes a health probe at /health (anonymous).
Serves its SPA and API from the same origin, so no separate frontend hosting is needed.
Runs as a non-root user on a hardened, distroless-style runtime.

docker pull flowon/dataverse-logic-insight
docker pull flowon/dataverse-logic-context
docker pull flowon/dataverse-logic-guard
docker pull flowon/dataverse-logic-assurance

Pin a version

Pin to a specific tag in production (e.g. flowon/dataverse-logic-guard:1.0.0) rather than latest. Check the Docker Hub page for available tags.

Prerequisites

Dependency	Needed for	Notes
Flowon MCP server	All agents	The URL the agents read your project artifacts from.
An LLM endpoint	All agents	Claude on Azure AI Foundry (default), Azure OpenAI, OpenAI, or Anthropic.
Redis	Production	Backs jobs, per-project config, and the SSE event bus. Required unless the agent runs in the `Development` environment.
Entra ID (or ADFS) app registration	Production	Incoming requests must be authenticated; the agent calls the MCP server on-behalf-of the user.

Configuration model

Configuration is read from environment variables (which override the built-in appsettings.json). Nested keys use a double underscore (Section__Key); flat keys are used as-is.

Two settings decide how much infrastructure an agent needs:

ASPNETCORE_ENVIRONMENT: set to Development to use in-memory jobs/config (no Redis). Any other value (default Production) requires Redis.
DANGEROUSLY_DISABLE_HTTP_INCOMING_AUTH: set to true to accept unauthenticated requests. Leave unset in production.

Quick start (evaluation)

Run one agent with authentication off and in-memory state. You only need an MCP URL and an LLM. This is for local trials, not production.

docker run --rm -p 8080:8080 \
  -e ASPNETCORE_ENVIRONMENT=Development \
  -e DANGEROUSLY_DISABLE_HTTP_INCOMING_AUTH=true \
  -e DANGEROUSLY_DISABLE_HTTPS_REDIRECTION=true \
  -e ALLOW_CORS=true \
  -e ASSIST_MCP_SERVER__URL="https://your-flowon-mcp.example.com" \
  -e LLM_PROVIDER=AzureFoundryAnthropic \
  -e AZURE_FOUDNRY_ENDPOINT="https://your-resource.services.ai.azure.com/anthropic" \
  -e AZURE_FOUDNRY_API_KEY="<key>" \
  -e AZURE_FOUDNRY_MODEL="claude-sonnet-4-6" \
  flowon/dataverse-logic-guard

Open http://localhost:8080 and verify http://localhost:8080/health returns healthy.

Production run

A production container adds authentication and Redis:

docker run -d --name logic-guard -p 8080:8080 \
  -e ASPNETCORE_ENVIRONMENT=Production \
  -e REDIS_CONNECTION_STRING="your-redis:6379,password=…,ssl=True" \
  -e ASSIST_MCP_SERVER__URL="https://your-flowon-mcp.example.com" \
  -e ASSIST_MCP_SERVER__SCOPES__0="api://<mcp-client-id>/Mcp.Access" \
  -e AzureAd__Instance="https://login.microsoftonline.com/" \
  -e AzureAd__TenantId="<tenant-guid>" \
  -e AzureAd__ClientId="<agent-app-client-id>" \
  -e AzureAd__Audience="api://<agent-app-client-id>" \
  -e AzureAd__ClientSecret="<secret>" \
  -e LLM_PROVIDER=AzureFoundryAnthropic \
  -e AZURE_FOUDNRY_ENDPOINT="https://your-resource.services.ai.azure.com/anthropic" \
  -e AZURE_FOUDNRY_API_KEY="<key>" \
  -e AZURE_FOUDNRY_MODEL="claude-sonnet-4-6" \
  flowon/dataverse-logic-guard

TLS termination

Run the container behind a reverse proxy / ingress (Nginx, Azure Container Apps, App Service, AKS) that terminates TLS and forwards X-Forwarded-Proto. The agent honors forwarded headers. If TLS is terminated upstream, set DANGEROUSLY_DISABLE_HTTPS_REDIRECTION=true so the container doesn't redirect internal HTTP calls.

Environment variable reference

Flowon MCP server (required)

Variable	Description
`ASSIST_MCP_SERVER__URL`	Base URL of the Flowon MCP server.
`ASSIST_MCP_SERVER__SCOPES__0`	Delegated scope requested for the on-behalf-of call (e.g. `api://<mcp-client-id>/Mcp.Access`).
`ASSIST_MCP_SERVER__AUTHENTICATION_STRATEGY`	How the agent authenticates to the MCP server (on-behalf-of by default).

LLM (required)

Variable	Description	Default
`LLM_PROVIDER`	`AzureFoundryAnthropic`, `AzureFoundry`, `AzureOpenAI`, `OpenAI`, or `Anthropic`.	`AzureFoundryAnthropic`
`LLM_MAX_CONCURRENCY`	Max concurrent LLM calls (throttle gate).	`4`

Provider-specific keys:

Provider	Keys
`AzureFoundryAnthropic` / `AzureFoundry`	`AZURE_FOUDNRY_ENDPOINT`, `AZURE_FOUDNRY_API_KEY`, `AZURE_FOUDNRY_MODEL`
`AzureOpenAI`	`AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_API_KEY`, `AZURE_OPENAI_MODEL`
`OpenAI` / `Anthropic`	`LLM_API_KEY`, `LLM_MODEL`

Optional tuning: AZURE_FOUDNRY_TIMEOUT_MINUTES (10), AZURE_FOUDNRY_MAX_OUTPUT_TOKENS (16384), AZURE_FOUDNRY_ANTHROPIC_VERSION (2023-06-01).

Spelling of the Azure Foundry keys

The Azure Foundry variables are spelled AZURE_FOUDNRY_* (note the transposed letters: FOUDNRY, not FOUNDRY). Use them exactly as shown or the container will fail to find your endpoint/key/model.

Authentication (required in production)

Configure either Entra ID or ADFS.

Entra ID (Azure AD):

Variable	Description
`AzureAd__Instance`	`https://login.microsoftonline.com/`
`AzureAd__TenantId`	Directory (tenant) GUID
`AzureAd__ClientId`	The agent app registration's client ID
`AzureAd__Audience`	`api://<agent-app-client-id>`
`AzureAd__ClientSecret`	Client secret (or use a managed identity)

ADFS (alternative): ADFS__ISSUER, ADFS__AUDIENCE, ADFS__AUTHORIZATION_ENDPOINT, ADFS__TOKEN_ENDPOINT.

To disable auth (evaluation only): DANGEROUSLY_DISABLE_HTTP_INCOMING_AUTH=true.

State & storage

Variable	Description
`REDIS_CONNECTION_STRING`	Redis connection string. Required unless `ASPNETCORE_ENVIRONMENT=Development`.
`AZURE_BLOB_STORAGE__CONNECTION_STRING`	Optional blob storage connection string (where applicable).

Networking & operations

Variable	Description	Default
`ASPNETCORE_ENVIRONMENT`	`Production` (Redis + auth) or `Development` (in-memory).	`Production`
`ALLOW_CORS`	Enable CORS.	`false`
`ALLOWED_CORS_ORIGINS`	Comma-separated allowed origins (empty means any origin when CORS is on).	(none)
`DANGEROUSLY_DISABLE_HTTPS_REDIRECTION`	Skip HTTP→HTTPS redirect (use behind a TLS-terminating proxy).	`false`
`COLLECT_TELEMETRY`	Enable telemetry export.	`false`
`APPLICATIONINSIGHTS_CONNECTION_STRING`	Application Insights connection string.	(none)

Running all four with Docker Compose

# docker-compose.yml. Secrets come from a gitignored .env file alongside this file
x-agent-env: &agent-env
  ASPNETCORE_ENVIRONMENT: Production
  REDIS_CONNECTION_STRING: ${REDIS_CONNECTION_STRING}
  ASSIST_MCP_SERVER__URL: ${MCP_URL}
  ASSIST_MCP_SERVER__SCOPES__0: ${MCP_SCOPE}
  AzureAd__Instance: https://login.microsoftonline.com/
  AzureAd__TenantId: ${TENANT_ID}
  AzureAd__ClientId: ${AGENT_CLIENT_ID}
  AzureAd__Audience: api://${AGENT_CLIENT_ID}
  AzureAd__ClientSecret: ${AGENT_CLIENT_SECRET}
  LLM_PROVIDER: AzureFoundryAnthropic
  AZURE_FOUDNRY_ENDPOINT: ${LLM_ENDPOINT}
  AZURE_FOUDNRY_API_KEY: ${LLM_API_KEY}
  AZURE_FOUDNRY_MODEL: ${LLM_MODEL:-claude-sonnet-4-6}
  DANGEROUSLY_DISABLE_HTTPS_REDIRECTION: "true"  # TLS terminated by your proxy

services:
  logic-insight:
    image: flowon/dataverse-logic-insight
    environment: *agent-env
    ports: ["8081:8080"]

  logic-context:
    image: flowon/dataverse-logic-context
    environment: *agent-env
    ports: ["8082:8080"]

  logic-guard:
    image: flowon/dataverse-logic-guard
    environment: *agent-env
    ports: ["8083:8080"]

  logic-assurance:
    image: flowon/dataverse-logic-assurance
    environment: *agent-env
    ports: ["8084:8080"]

docker compose up -d          # all four
docker compose up logic-guard # a single agent

Verifying the install

Health: curl http://<host>:<port>/health → Healthy.
Auth config: GET /api/auth/config reports whether authentication is enabled and, if so, the Entra ID / ADFS parameters the UI needs.
Projects: open the UI, sign in, and confirm your Flowon projects list loads, which proves the MCP connection and on-behalf-of token flow are working end to end.

On-behalf-of flow

The agent never holds a standing service credential for your data. Each request carries the user's token; the agent exchanges it (on-behalf-of) for a token to call the Flowon MCP server, which in turn reaches Dataverse. Users only ever see the projects and data they are entitled to.

Images​

Prerequisites​

Configuration model​

Quick start (evaluation)​

Production run​

Environment variable reference​

Flowon MCP server (required)​

LLM (required)​

Authentication (required in production)​

State & storage​

Networking & operations​

Running all four with Docker Compose​

Verifying the install​