for EU platform, security and data leads
Agents on your hardware. Under your jurisdiction.
AgentHotel is a self-hosted control panel for AI agents. Every guest runs in its own container on your server, on the model you point it at — a frontier API, your own vLLM or llama.cpp box, or a shared endpoint where the community runs European open models on its own GPUs.
The constraint
An agent is a process that holds your credentials, reads your documents and calls your tools. The interesting questions are not about the model's benchmark scores. They are: which server does that process run on, who can reach it, which endpoint does the prompt go to, and what happens when you want to take it somewhere else.
AgentHotel answers those with infrastructure rather than policy text. The panel runs on a VPS you choose, in three containers: Caddy for TLS and per-agent routes, a React frontend, and a Node backend that talks to Docker over the socket and keeps state in SQLite. There is no vendor account in the loop, and the whole thing is MIT licensed.
Controls that are configuration, not promises
Private models
Point the whole fleet at your own hardware with one setting. The panel probes each provider's models, declines any too small for a runtime to run, and says so rather than falling back to a hosted API without telling you.
Identity per agent
A shared data store such as SkillHub derives who is writing from the key in the header, so each agent gets its own. Sharing one key would make the store unable to tell whose work is whose.
A gateway that fails closed
Sluss is a self-hosted LLM gateway for EU organisations — every prompt classified and routed under a fail-closed policy, with an audit trail. Put the hotel's agents behind it as a provider.
A European mesh instead of open ports
NetBird is the optional European alternative. The hotel joins a WireGuard mesh, publishes hostnames through its reverse proxy with no open ports, and gives you a private way in.
The panel owns what guards a guest
Dashboard credentials and session-signing keys are generated per agent and shown under Credentials, never a constant baked into a runtime.
Leaving is a supported operation
An agent's memory is its harness's own files, and they go with it. One hotel issues a one-time link, the other fetches the agent server to server, and it stops in the old hotel the moment it is pulled.
The panel probes each provider's models, declines any too small for a runtime to run, and says so rather than falling back to a hosted API without telling you.
AgentHotel README · on private models
Models are a routing decision, not a hosting decision
Built-in providers — OpenAI, Anthropic, Gemini, OpenRouter, DeepSeek, Groq, xAI, Mistral, Z.ai — are known by name: pick one, paste a key, and the panel fetches what it serves. Only your own endpoints take an address.
That symmetry is the point. The same panel that puts an agent on a frontier API can put the next one on a vLLM server in your own rack, and the agent's provider/model is an editable field rather than an architecture. Add providers once; keys are injected into new agents automatically and into existing ones on redeploy, under slug-based environment variables such as HETZNER_API_KEY, HETZNER_BASE_URL and HETZNER_MODELS.
Both OpenClaw and Hermes list every configured provider — including private, self-hosted endpoints — by name in their model pickers, so switching is a live choice rather than a redeploy.
What a security review will ask
Where do prompts go?
Wherever you point the agent's provider. If the model runs on your hardware, the request does not leave it. If it runs on a frontier API, that endpoint is a named, configured provider — visible in the panel, not hidden in a runtime default.
Who can reach an agent's address?
Whoever can resolve the hostname on your network. With Cloudflare Tunnel or NetBird, there are no open ports at all and reachability is decided by the tunnel or the mesh.
How are credentials handled?
Provider API keys are configured in the panel and injected into agents that need them. Template secrets are declared and generated at deploy: hex, password, or a JWT signed with another generated secret. No template ever carries a credential, and two deployments never share one.
Is there an audit trail?
The deploy log keeps every create, redeploy and settings change with its full log, secrets masked, readable over MCP. The activity log keeps agent lifecycle, cleanup and login events. Sluss adds a prompt-level audit trail in front of the models.
What is the exit plan?
Export the instance, or move one agent to another hotel through a one-time transfer link, memory included. Admin credentials are never exported. No lock-in is a feature of the architecture, not a clause.
Start with one guest and one provider.
Panel on 1 vCPU. Agents capped. Models where you decide they should run.