Sold by: AppXen
Deployed on AWS
The AppXen suite (MCP Gateway Pro, RAG Engine, Agent Orchestrator, console) deployed as one appliance in your own AWS account, on your own Amazon Bedrock.
Overview
AppXen Platform deploys the full AppXen suite as a single appliance inside your own AWS account: MCP Gateway Pro, RAG Engine, Agent Orchestrator and the AppXen Console. MCP Gateway Pro fronts every Model Context Protocol server your team uses (built-in RAG, media and web search tools, plus official and self-hosted MCP servers) behind one endpoint that Claude Code, Claude Desktop, Cursor and other MCP clients reach with an API key, over Streamable HTTP or the older SSE transport. RAG Engine indexes your documents into a Postgres/pgvector store for retrieval-augmented search. Agent Orchestrator compiles markdown workflows into multi-step agent executions, with approval gates and scheduled runs. The console ties it all together with a single sign-in, health dashboard and user management.
Everything runs on one instance, in your account, on your own Amazon Bedrock access, and there is no AppXen-hosted service in the loop. Your data stays inside your AWS account: every product talks to AWS (DynamoDB, S3, SQS, Bedrock, Textract) using the instance's own IAM role, never long-lived access keys, and secrets are generated locally on first boot and stored only on the instance. By itself the appliance calls those AWS services and AWS Systems Manager, Let's Encrypt once you give it a domain, and what its Ubuntu operating system calls on its own, such as Ubuntu's package servers and the Docker and Caddy package repositories for updates, the Snap Store for the Systems Manager agent, and time synchronisation; Ubuntu's news and telemetry timers are turned off. Beyond those it connects to what you set up or ask for, such as the MCP servers and REST APIs you register (including an API description you point it at) and, once you set a Brave Search API key (sudo appxenctl set-brave-key), Brave Search for the web_search tool and the pages the web_extract tool is asked to fetch. The appliance starts with a self-signed certificate, which browsers let you click through but MCP clients reject: give it a domain of your own (at launch, or later with sudo appxenctl set-domain) before connecting clients.
Pricing and costs: the AppXen software fee is charged by AWS Marketplace, from $0.149 per instance-hour on the large instance sizes and $0.199 on the xlarge sizes, or $949 and $1,299 for one instance for a year. You also pay AWS directly, at AWS's own prices, for the infrastructure the stack creates (the EC2 instance, its EBS volume and Elastic IP, DynamoDB, S3 and SQS) and for the Amazon Bedrock models you call. The usage instructions give an estimate for the default configuration.
Before launching, in your target Region, submit Anthropic's one-time use-case form in the Bedrock console and invoke each of Claude Sonnet 4.5, Claude Opus 4.6 and Claude Haiku 4.5 once, which creates your account's Marketplace subscription for them; Amazon Nova Lite, Nova Pro and Amazon Titan Text Embeddings V2 need no such step. The appliance defaults to a t3.large (2 vCPU / 8 GiB), with the t3a.large/m6a.large AMD equivalents available as a cheaper option where your Region and Availability Zone offer them; this comfortably runs the full stack (five product services plus Postgres and Redis) for small-to-medium teams. Larger workloads should size up.
Highlights
- One appliance in your own AWS account: MCP Gateway Pro, RAG Engine, Agent Orchestrator and the AppXen Console deploy together from a single CloudFormation stack, with no AppXen-hosted service in the loop.
- Runs on your own Amazon Bedrock access: Claude, Amazon Nova and Titan models are called with the instance's IAM role, never long-lived access keys, and everything the appliance stores stays in your AWS account.
- One MCP endpoint for your team: Claude Code, Claude Desktop, Cursor and other MCP clients connect with an API key to built-in retrieval, media and optional web search tools and to the MCP servers you register, with approval-gated workflows and scheduled runs.
Details
Sold by
Categories
Delivery method
Delivery option
AppXen Platform single-instance stack
Latest version
Operating system
Ubuntu 24.04 LTS
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large | $0.149 |
t3.xlarge | $0.199 |
t3a.large | $0.149 |
t3a.xlarge | $0.199 |
m6i.large | $0.149 |
m6i.xlarge | $0.199 |
m6a.large | $0.149 |
m6a.xlarge | $0.199 |
Vendor refund policy
Refunds are available on a case-by-case basis. To request a refund, email support@appxen.ai within 30 days of the charge; we typically respond within 1 business day. Annual subscriptions are refundable pro rata on request to support@appxen.ai within 30 days of purchase.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
AppXen Platform single-instance stack
Creates, in your AWS account and Region, a VPC with one public subnet and an Internet gateway, a security group (HTTP and HTTPS from anywhere, SSH only from the CIDR you give), one EC2 instance with an Elastic IP, an encrypted gp3 root volume and IMDSv2 required, one least-privilege IAM instance role, five DynamoDB tables, three S3 buckets and an SQS queue with a dead-letter queue. The data resources are kept if you delete the stack. You pay the AppXen software fee through AWS Marketplace, and AWS directly for these resources and for your Amazon Bedrock usage. Before launching, enable the Anthropic Claude models in Amazon Bedrock in the stack's Region, as the usage instructions describe.
CloudFormation Template (CFT)
AWS CloudFormation templates are JSON or YAML-formatted text files that simplify provisioning and management on AWS. The templates describe the service or application architecture you want to deploy, and AWS CloudFormation uses those templates to provision and configure the required services (such as Amazon EC2 instances or Amazon RDS DB instances). The deployed application and associated resources are called a "stack."
Version release notes
AppXen Platform 0.2.0
First version published on AWS Marketplace. The changes below are relative to the internal 0.1.0 build, which was never released.
Security
- Registered MCP servers and REST APIs can no longer be pointed at the instance metadata service or at the appliance's own internal services. The gateway now checks every connection it makes to an address a user supplied, including each redirect. Link-local and metadata addresses are always refused. Loopback, the appliance's internal networks and single-label host names are refused unless you allow them on the instance with "sudo appxenctl allow-upstream".
- The web_extract tool and the "test URL" and "discover API description" actions fetch public addresses only.
- Sign-in links are never written to logs, and the email sign-in routes are off while email is off, which is the default.
- MCP clients that probe for an OAuth sign-in now get a plain "not found" answer instead of the console page. The appliance uses API keys, not OAuth.
- Ubuntu's news and telemetry timers are turned off on the image. Automatic security updates stay on.
- The five product images are built with Debian's pending security updates applied, and the Redis image with Alpine's.
New
- Console: a "Connect an MCP client" panel on the API Keys page, with the appliance's MCP address and ready-to-paste settings for Claude Code, Claude Desktop and Cursor.
- "sudo appxenctl set-brave-key" turns the web search tools on with your own Brave Search API key, and "--clear" turns them off again.
- "sudo appxenctl allow-upstream NAME", with "--list" and "--remove", manages which internal hosts registered servers may reach.
- Console: the Storage page opens a file in place (text and PDF as text, images shown).
- Workflows: the console shows which step is waiting for approval, and an execution waiting for approval no longer takes up a run slot.
Fixed
- A workflow step that names web-search on an appliance without a Brave Search API key now fails with the command that sets one ("sudo appxenctl set-brave-key"), instead of running without search.
- A workflow step waits for an extension that is still starting and for a gateway that is restarting, instead of failing at once.
- The AWS CloudWatch extension starts again.
- Workflows can use the media tools again.
- Deleting a knowledge source also deletes its uploaded file.
- "Refresh spec" for a registered REST API works from the console.
- A disabled server answers a clear error on every MCP endpoint.
- Stopping or deleting an execution that is waiting for approval, or already finished, leaves no half-written record.
- Tables in the console scroll sideways on a phone.
Upgrading
- There is no in-place upgrade: a new version is a new stack. The usage guide, under "Changing settings later", says what moves from one stack to the next.
Additional details
Usage instructions
AppXen Platform: launch and operate
BEFORE YOU LAUNCH (Amazon Bedrock). In the stack's Region, an account administrator submits Anthropic's one-time use-case form in the Bedrock console and invokes Claude Sonnet 4.5, Claude Opus 4.6 and Claude Haiku 4.5 once each; this creates the account's Marketplace subscription for them (the instance role lacks aws-marketplace:Subscribe). Amazon Nova and Titan need nothing. If skipped, the stack still launches and the health panel reports the Claude model as denied.
LAUNCH. Subscribe, choose the CloudFormation option and set the parameters:
- ImageId: filled in by Marketplace; leave it.
- InstanceType: t3.large by default; also t3.xlarge, t3a.large, t3a.xlarge, m6i.large, m6i.xlarge, m6a.large, m6a.xlarge.
- AvailabilityZone: a zone in the Region that offers your instance type.
- KeyName: an existing EC2 key pair, for SSH.
- AdminCidr: your own IP as a CIDR, for example 203.0.113.42/32; never 0.0.0.0/0. Only SSH uses it.
- AdminEmail: the sign-in name of the first admin.
- DomainName: optional host name for a trusted certificate; blank means a self-signed one.
- RootVolumeSize: GiB, minimum 30, default 50.
FIRST SIGN-IN. A few minutes after CREATE_COMPLETE, open the ConsoleUrl output. Without a domain the certificate is self-signed: accept the browser warning (MCP clients reject it; point a domain's DNS A record at the ElasticIp output, then run sudo appxenctl set-domain NAME). Sign in as AdminEmail with the InstanceId output as the temporary password; you must change it at once.
DATA. Five DynamoDB tables, three S3 buckets (media, RAG documents, backups) and an SQS queue with a dead-letter queue hold your data in your account. They are RETAINED when the stack is deleted: delete them yourself when done. DynamoDB point-in-time recovery is on. Postgres (the RAG index) lives on the instance under /opt/appliance/data/postgres and goes with it.
SECRETS. Generated on the instance at first boot, never a parameter or output: /opt/appliance/.env and /opt/appliance/.appxen-secrets (root only, mode 600); the self-signed key is /opt/appliance/tls/key.pem. Passwords and API keys are stored hashed.
ENCRYPTION. Served over HTTPS. At rest: encrypted root volume, S3 SSE-S3, DynamoDB and SQS default encryption. The stack creates no KMS keys, ACM certificates or access keys. Rotation: Let's Encrypt certificates renew by themselves, the self-signed one lasts 10 years, the session-signing secret is replaced by hand.
IAM. One least-privilege instance role: the platform uses its own tables, buckets, queue, Bedrock models and Textract, and Systems Manager Session Manager gives SSH-free access.
NETWORK. Own VPC, one public subnet, one security group: ports 80 and 443 from anywhere, 22 only from AdminCidr. Five services, Postgres and Redis run as containers behind Caddy; IMDSv2 is required. The stack adds one VPC, one internet gateway and one Elastic IP to your per-Region quotas (5 each by default).
BACKUPS. A nightly Postgres dump goes to the backups bucket (postgres/, kept 30 days). On the instance: sudo appxenctl backup now, backup list, restore KEY.
HEALTH. Watch the EC2 status checks (CloudWatch StatusCheckFailed; the stack creates no alarms), the console health panel and sudo appxenctl status.
UPGRADES. No in-place upgrade: a new version is a new stack. Only the Postgres RAG index moves (backup now, then restore); DynamoDB and S3 data stay in the old stack's retained resources.
COSTS. AWS Marketplace bills the software fee: $0.149 an hour or $949 a year on the large types, $0.199 an hour or $1,299 a year on the xlarge types. You pay AWS directly for the EC2 instance, EBS volume, Elastic IP, DynamoDB, S3, SQS and Amazon Bedrock usage. Default t3.large in us-east-1: about $178.88 a month hourly or $149.19 annual, before Bedrock (priced 2026-09-29).
SUPPORT. Email support@appxen.ai for help. Full deployment and operations guide: https://appxen.ai/docs/platform
Resources
Vendor resources
Support
Vendor support
Email support@appxen.ai for setup help and troubleshooting. Best-effort email support during business hours. Product information and support:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Self-hosted low-code platform to build internal tools, admin panels, and dashboards over your own databases and APIs, production-hardened with auto-TLS.
Self-hosted, multi-user AI chat powered by Amazon Bedrock, running in your own AWS account with auto-TLS and a hardened base.
Self-hosted visual AI builder for chatbots, RAG, and agent workflows, powered by Amazon Bedrock and running in your own AWS account.
By AppXen
Self-hosted Git service with repositories, issues, pull requests, and CI, production-hardened with auto-TLS, backups, and updates.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.