Self-hosting Patent Connector on Linux (systemd)

Run your own Patent Connector server as a systemd service, reachable from other machines on your network. This works on any Linux distribution that uses systemd - Fedora, Ubuntu, Debian, RHEL / Rocky / AlmaLinux, openSUSE, Arch, and others. The same patent binary is both the CLI and the server; here we run it in server mode.

This matches a typical on-prem setup: one host runs the server, and your team's AI tools (Claude, ChatGPT, etc.) and the patent CLI connect to it over the LAN.

Running your own server requires a license that includes self-hosting. If you do not have one yet, get in touch at info@patent.dev.

Throughout this guide, replace 192.168.1.55:8081 with your server's own LAN address and port (it is just the example used here).

1. Install the CLI

The installer downloads a single self-contained binary to /usr/local/bin:

curl -fsSL https://get.patent.dev/install.sh | sh
patent --help        # verify

2. Activate your license

Run this as the same user the service will run as (below we use youruser  - replace it with your own Linux account), so the server finds the activated license automatically.

patent register --email you@firm.com    # emails a one-time activation code
patent activate <code>                  # redeem it; the license is cached and auto-renews
patent account status                   # should show tier: paid, features: full_access

The activation code is single-use. If you ever see "activation code was already used," just run patent register again for a fresh one.

3. Generate an encryption key

This key encrypts the provider API credentials you store later. Generate it once and keep a backup - losing it means re-entering every provider key.

openssl rand -hex 16

4. Configure the service environment

Keep secrets out of the unit file (which is world-readable). Put them in an environment file owned by your user, readable only by it:

sudo install -m 600 -o youruser -g youruser /dev/null /etc/patent-connector.env
sudoedit /etc/patent-connector.env

Contents (use your host's LAN IP and the key from step 3):

PORT=8081
# BASE_URL must be the exact address you open in the browser. Use your LAN IP so
# the dashboard login works from other machines (over plain HTTP the login cookie
# is only kept on the address named here / on localhost).
BASE_URL=http://192.168.1.55:8081
ENCRYPTION_KEY=replace-with-openssl-rand-hex-16
# Optional: pin the SQLite database to an explicit path (default is the user's data dir)
# DATABASE_URL=sqlite:/home/youruser/.local/share/patent/patent.db
# Optional: show a Production/Sandbox dropdown for offices that have a test system (e.g. EUIPO)
# PROVIDER_ENV_SELECTOR=true

The full list of environment variables is on the Docker Hub page: https://hub.docker.com/r/patentdev/patent-connector#environment-variables

5. Create the systemd service

/etc/systemd/system/patent-connector.service:

[Unit]
Description=Patent Connector (self-hosted MCP + REST server)
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/patent server
User=youruser
Restart=on-failure
RestartSec=10
EnvironmentFile=/etc/patent-connector.env

# Light hardening
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target

6. Open the firewall

Most distributions block inbound ports by default, so other machines cannot reach :8081 until you allow it. Use whichever firewall your distro ships:

# firewalld (Fedora, RHEL, Rocky, AlmaLinux, openSUSE):
sudo firewall-cmd --add-port=8081/tcp --permanent && sudo firewall-cmd --reload

# ufw (Ubuntu, Debian):
sudo ufw allow 8081/tcp

7. Start and enable

sudo systemctl daemon-reload
sudo systemctl enable --now patent-connector.service
systemctl status patent-connector.service
journalctl -u patent-connector.service -f   # follow logs; Ctrl-C to stop

Healthy startup logs end with web server starting ... port 8081. Quick check:

curl -s http://localhost:8081/health | jq .status   # -> "ok"

8. First login and provider keys

Open http://192.168.1.55:8081 in a browser, create your account, and add your
provider API credentials (EPO OPS, USPTO ODP, DPMA, EUIPO, ...) using the provider cards on the dashboard. They are stored encrypted with your ENCRYPTION_KEY.

9. Connect an AI client

In the dashboard, open Connect Your Chatbot, create an Access Code, and copy the pmc_... value - that is the Bearer token every client uses.

Which URL you use depends on the client:

Plain HTTP over the LAN works with the patent CLI and with OpenAPI-based tool servers such as Open WebUI (via mcpo):

  • endpoint http://192.168.1.55:8081/mcp/sse
  • header Authorization: Bearer pmc_...

Claude and ChatGPT require HTTPS. It will not connect to a plain-HTTP or non-standard-port URL - claude.ai's connector in particular only talks to port 443 and fails silently on anything else (no request even reaches your server). For those clients you need a public HTTPS endpoint: put the server behind a TLS-terminating reverse proxy on 443 (Caddy, nginx), set BASE_URL to the https:// address, and use that URL, for example https://patents.yourfirm.example/mcp/sse with the same Bearer token.

A minimal Caddy reverse proxy (Caddy fetches a certificate automatically):

patents.yourfirm.example {
    reverse_proxy 127.0.0.1:8081
}

10. Use the patent CLI against your server

patent config set-server http://192.168.1.55:8081
patent login --token pmc_...
patent search-patents --query "fuel cell" --limit 5

Notes and troubleshooting

  • HTTP vs HTTPS. Plain HTTP on a LAN is fine for an internal server. For anything internet-facing - or to connect via claude.ai's remote connector - put a
    TLS-terminating reverse proxy (Caddy, nginx) in front on port 443 and set BASE_URL to the https:// address.
  • Service will not start / cannot bind the port. Check journalctl -u patent-connector.service. On SELinux distros (Fedora, RHEL) inspect denials with sudo ausearch -m avc -ts recent; on AppArmor distros (Ubuntu, Debian) check sudo dmesg | grep -i apparmor. The simplest fix is to run on a standard port behind a proxy, or to label/allow the port for the service.
  • Can reach it locally but not from other machines. That is the firewall - redo step 6 with your distro's tool, and confirm nothing else (router/VPN) blocks the LAN.
  • "Activation code was already used." Codes are one-time; run patent register again for a new one. You stay on your existing licensed account.
  • Back up your ENCRYPTION_KEY and the SQLite database file. The key decrypts your stored provider credentials.
  • Updating. Re-run curl -fsSL https://get.patent.dev/install.sh | sh, then sudo systemctl restart patent-connector.service.

Questions: info@patent.dev