Install

1. Get access

1. Sign up at platform.cotracer.ai. Pilot accounts are enabled by the Cotracer team after your onboarding call.
2. Downloads → Generate token. This is your registry password, shown once. Your registry username is on the same page (partner-org_…).
3. Licenses → Generate fetch token (clt_…). The backend uses it to fetch and renew its license daily.

Put the registry token in your shell for the commands below:

export COTRACER_REGISTRY_USER=partner-org_...     # from the Downloads page
export COTRACER_REGISTRY_TOKEN=...                # from Generate token
echo "$COTRACER_REGISTRY_TOKEN" | docker login cotracer.jfrog.io \
  -u "$COTRACER_REGISTRY_USER" --password-stdin

The Downloads page shows the current version and every command below with your username filled in.

2a. Docker Compose

In an empty directory, create three files.

docker-compose.yaml

services:
  cotracer-backend:
    image: cotracer.jfrog.io/cotracer-docker/cotracer-backend:${COTRACER_VERSION:?set COTRACER_VERSION in .env}
    ports:
      - "8420:8420"
    volumes:
      - ./cotracer.yaml:/app/cotracer.yaml:ro
      # repo snapshots + last fetched license survive restarts
      - cotracer-cache:/root/.cache/cotracer
    env_file:
      - .env
    restart: unless-stopped

volumes:
  cotracer-cache:

Run exactly one instance — the backend keeps sessions in memory and does not scale horizontally.

cotracer.yaml — your integrations. Start from the example in Configure.

.env — the pinned version and your secrets:

COTRACER_VERSION=<version>              # current version: Downloads page
COTRACER_API_KEY=<random string>        # clients send this; openssl rand -hex 32
COTRACER_LICENSE_TOKEN=clt_...          # Licenses page
ANTHROPIC_API_KEY=...                   # your LLM key — name set by llm.api_key_env
GITHUB_APP_ID=...                       # see Connect GitHub
GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n"

Then:

docker compose up -d
docker compose logs -f cotracer-backend     # wait for "Application startup complete"

2b. Kubernetes (Helm)

kubectl create secret docker-registry cotracer-registry \
  --docker-server=cotracer.jfrog.io \
  --docker-username="$COTRACER_REGISTRY_USER" \
  --docker-password="$COTRACER_REGISTRY_TOKEN"

kubectl create secret generic cotracer-secrets \
  --from-literal=COTRACER_API_KEY="$(openssl rand -hex 32)" \
  --from-literal=COTRACER_LICENSE_TOKEN=clt_... \
  --from-literal=ANTHROPIC_API_KEY=... \
  --from-literal=GITHUB_APP_ID=... \
  --from-file=GITHUB_APP_PRIVATE_KEY=app.pem

echo "$COTRACER_REGISTRY_TOKEN" | helm registry login cotracer.jfrog.io \
  -u "$COTRACER_REGISTRY_USER" --password-stdin
helm install cotracer oci://cotracer.jfrog.io/cotracer-docker/cotracer \
  --version <version> -f values.yaml

Minimal values.yaml — your cotracer.yaml goes under config:

config: |
  llm:
    provider: anthropic
    model: claude-opus-4-8
    api_key_env: ANTHROPIC_API_KEY
  tracing:
    provider: jaeger
    url: http://jaeger-query.observability:16686
  logs:
    provider: opensearch
    url: http://opensearch.observability:9200
  vcs:
    provider: github
    org: your-org

Every key in cotracer-secrets becomes an environment variable of the backend. The chart always runs one replica, keeps the repo cache on a 25 Gi volume, and exposes a ClusterIP service on port 8420. Useful values: ingress.*, persistence.*, resources, extraEnv (e.g. HTTPS_PROXY). For SSE through an ingress, disable proxy buffering (ingress-nginx: nginx.ingress.kubernetes.io/proxy-buffering: "off").

3. Verify

curl -s http://localhost:8420/healthz

{"status": "ok", "model": "anthropic:claude-opus-4-8",
 "license": {"state": "valid", "org": "...", "plan": "pilot", "days_left": 88}}

license.state must be valid (or expiring) — otherwise analyses are refused with HTTP 402. See Troubleshooting.

4. Install the CLI

On CI runners and developer machines (Python 3.12+):

curl -fsSLO -u "$COTRACER_REGISTRY_USER:$COTRACER_REGISTRY_TOKEN" \
  https://cotracer.jfrog.io/artifactory/cotracer-pypi/cotracer-cli/<version>/cotracer_cli-<version>-py3-none-any.whl
uv tool install ./cotracer_cli-<version>-py3-none-any.whl     # or: pip install ./cotracer_cli-…whl

Install from the wheel file — don’t add the registry as a package index.

Air-gapped installs

No outbound access at all? Download the license file from the Licenses page and mount it at /app/cotracer-license.jwt instead of setting COTRACER_LICENSE_TOKEN (Compose: add - ./cotracer-license.jwt:/app/cotracer-license.jwt:ro; Helm: put it in a Secret under key cotracer-license.jwt and set license.existingSecret). Replace it before it expires. Mirror the image and wheel into your internal registry.

Upgrading

Set the new COTRACER_VERSION in .env, then docker compose pull && docker compose up -d (Helm: helm upgrade … --version <version>). Registry tokens last 180 days; you get an email two weeks before expiry. Rotating on the Downloads page keeps the old token valid for 7 days — update CI secrets and the cotracer-registry pull secret in that window.