Molti: Managed Agent Deployment

What is Molti?

Molti is Checkpoint's managed agent deployment system. It deploys KYA-OS agents to Fly.io infrastructure, handles lifecycle management (start, stop, restart), and provides a heartbeat-based health monitoring system.

Molti is one of three ways to run a KYA-OS server — see the deployment models overview. Unlike Dashboard Deploy (which scaffolds a GitHub repo and deploys a Cloudflare Worker you own) and Self-Host (BYOK) (your own server, your own infrastructure), Molti hosts and runs the agent process for you on Fly.io — no GitHub repo, no Cloudflare account, no server to manage.

When to Use Molti

Prerequisites

• A Checkpoint account with an organization
• A KYA-OS server configuration to deploy — the deployment wizard walks you through creating one, or reuse a configuration created via Dashboard Deploy

Deploying via the Dashboard

1. Navigate to your organization in the Checkpoint dashboard
2. Go to Deploy > Molti
3. Follow the deployment wizard:
   • Select your KYA-OS server configuration
   • Choose deployment settings
   • Confirm and deploy

The deployment process streams progress updates in real time via SSE (Server-Sent Events), showing each step as it completes.

Lifecycle Management

Once deployed, you can manage your agent's lifecycle through the dashboard or via API.

Heartbeat Monitoring

Deployed agents send periodic heartbeats to Checkpoint. The heartbeat system:

• Reports agent status and health
• Returns pending commands (e.g., restart, config update)
• Tracks software versions (openclawVersion, computeVersion)

Heartbeats are authenticated per-deployment using a unique X-Heartbeat-Token header.

Restart

Restart a running agent:

curl -X POST https://kya.vouched.id/api/v1/molti/agents/{agentDid}/restart \
  -H "Authorization: Bearer <session_token>"

Stop

Stop a running agent:

curl -X POST https://kya.vouched.id/api/v1/molti/agents/{agentDid}/stop \
  -H "Authorization: Bearer <session_token>"

API Reference

Deploy

POST /api/v1/molti/deploy/managed/fly

Deploys a managed agent on Fly.io. Returns an SSE stream with deployment progress.

• Auth: Session-based
• Body: ManagedDeployRequest
• Response: SSE stream with step-by-step progress

Heartbeat

POST /api/v1/molti/agents/{agentDid}/heartbeat

Receives heartbeat from a deployed agent process. Updates agent status and returns pending commands.

• Auth: X-Heartbeat-Token header (per-deployment token)
• Body: HeartbeatRequest
• Response: Pending commands (restart, config update, etc.)

Restart

POST /api/v1/molti/agents/{agentDid}/restart

Restarts a managed agent's Fly machine.

• Auth: Session-based (user must own the deployment via org membership)

Stop

POST /api/v1/molti/agents/{agentDid}/stop

Stops a managed agent's Fly machine.

• Auth: Session-based (user must own the deployment via org membership)

Config Bundle

GET /api/v1/molti/deployments/{agentDid}/config-bundle

Downloads the configuration bundle for a deployment. Supports dual authentication:

• X-API-Key: For BYOK (bring-your-own-key) deployments (version 1 bundle)
• X-Heartbeat-Token: For managed deployments (version 2 bundle with AI provider config, gateway token, etc.)

The config bundle includes a content hash for deduplication — agents can skip re-applying config if the hash hasn't changed.

Next Steps

• Deploying a KYA-OS Server — Dashboard Deploy and Self-Host (BYOK), the other two ways to run a server
• KYA-OS Enforcement — How enforcement works with deployed agents
• Tool Protection — Configure tool-level access control