How it works
Architecture, functionality and connected sources of the MeinGPT Outpost
The Outpost stores and processes your data within your own infrastructure; what leaves it for search and answer generation is only what the release level set per folder allows — the matching passages with their adjacent text by default, plus the original file if you enable that. This page describes the mechanism behind that — what an Outpost is and what you manage in MeinGPT is in the Outpost overview.
Connecting via the Bridge
Your Outpost connects to MeinGPT through the Bridge — an outbound, encrypted connection that the Outpost itself opens to MeinGPT. Because the connection is established from the inside out, you don't need to open any inbound firewall ports, provide a public IP address, or expose a reverse proxy. Your Outpost stays entirely inside your own network.
How an Outpost joins
There is no discovery. The only thing the Outpost is told is the address of your MeinGPT instance. Everything else the two sides negotiate between themselves.
| # | Who | What |
|---|---|---|
| 1 | Person at the machine | enters the MeinGPT address in the Outpost. https:// is allowed anywhere, http:// only on localhost |
| 2 | Device | generates an Ed25519 key pair locally. The private half goes into the operating system's key store and never leaves the machine |
| 3 | Device → platform | registers the public key along with installation ID, hostname, operating system and version. The platform creates a session bound to exactly that key and answers with two codes: one the device keeps, and an eight-character one for the screen |
| 4 | Device | polls every five seconds — and signs every poll. Until approval the answer is “not authorised yet” |
| 5 | Admin in MeinGPT | compares the fingerprint phrase shown against the one on the device's screen, gives it a name and approves the device. If two admins approve the same code at once, exactly one wins; the other is told |
| 6 | Device → platform | the next signed poll activates the key — in one transaction: every previously active key of this Outpost is revoked, the new one is created, the session is consumed. Back comes the configuration: organisation, Outpost ID, endpoint, platform public key, bridge address |
The code is a session handle, not proof — only the fingerprint phrase checks the device
The code only identifies the session; it would be just as valid for a different machine that happened to pair at the same moment. Only comparing the fingerprint phrase tells the admin they are really approving this device.
The key is still only activated by the signed poll in step 6, not by approval itself: a machine that cannot sign is not the machine that asked. Someone who reads the code off the screen but does not hold the private key gets the same answer as someone holding nothing.
From then on no reusable secret is on the wire: every call in both directions carries its own signature. Details in Security.
When an Outpost has to pair again
The most common case is not one: if the machine merely loses its connection — network gone, machine switched off — it keeps its key and comes back on its own. There is nothing to do.
If the key is gone — reinstall, new disk, factory reset — the same sequence runs again: new key pair, new code, approval for the same Outpost. Step 6 replaces the old key with the new one. In MeinGPT, choose Approve a new device in the menu of the Outpost card.
What pairing again keeps — and what it does not
The Outpost's entry in MeinGPT stays, and so do the data sources managed there, including their sharing. The old device is refused afterwards — without being told why.
Which folders and services are shared, on the other hand, exists only on the machine, in the Outpost's data folder. If that folder survives (for example a reinstall on the same disk), the same folders reappear after pairing and everything is as before. On a different machine, or after the data folder is lost, the Outpost starts empty: share the folders and services there again, adopt the folders in MeinGPT again, and share them again. The index is rebuilt in full.
Moving an Outpost to another machine
Write down what is shared
On the old machine, note which folders are shared with which release level and source access, and which services are connected. This exists only there. Service credentials never leave the machine — keep them at hand.
Pair the new machine
Install the Outpost on the new machine (see Set up the Outpost) and click Start the pairing. In MeinGPT, under Settings → Outposts, choose Approve a new device in the menu of the existing Outpost and compare the fingerprint phrase. As soon as the new machine activates its key, the old one loses its access.
Set folders and services up again
Share the folders on the new machine again (Shares → Share). Adopt them in MeinGPT under Settings → Outposts → Manage → Shares with Use as source and share them again via Access. To MeinGPT, a folder reported by the new machine is a new source: the sharing and links of the previous source do not apply to it, and the previous source shows its folder as No longer reported. Add services in the Outpost again (see Services). Certificates the Outpost must trust (see Your own root certificate) must be in the new machine's certificate store as well.
Clean up the old machine
The data folder and index stay on the old machine until you remove them — see Where the Outpost stores data. In MeinGPT, under Settings → Data sources, remove the old sources that show No longer reported if you no longer need them. The new machine rebuilds the index from the originals.
How it works
In short: the Outpost reads your sources, splits them into searchable sections, and stores them as embeddings in a local vector database (Architecture describes these components in detail). For a query, it searches locally for the matching sections and sends only those — within the release level set per folder — to the cloud AI for answer generation. Details on keys, signatures and release levels are in Security.
What an Outpost connects
The dialog in the Outpost knows exactly one source type: a folder path on this machine. A permanently mounted SMB share counts, because to the machine it is a path.
Through an Outpost
Folders on this machine, mounted SMB shares — and, with the services preview enabled, databases, local MCP servers and internal HTTP services
Directly in MeinGPT
SharePoint, OneDrive, Google Drive, Confluence, S3, WebDAV, web crawler — no Outpost needed for these
Which source belongs where and how a connection is made, in detail: Data sources.
Note
For questions and further support, please contact our technical team at support@meingpt.com