Dify

What it is

Dify is an open-source platform for building LLM apps, made by LangGenius. On one visual canvas you join model calls, knowledge retrieval, code and branching into a Workflow or a Chatflow. The same workspace holds model management, RAG pipelines, agents that work in a sandbox of their own, and logs for watching an app in production. Every app comes with an API. This listing is Mindket’s setup notes. They cover running Dify yourself and letting a coding agent build and run your apps through Dify’s command-line tool.

1. You add a model provider
2. You build a Workflow, a Chatflow or an Agent
3. You publish it as a web app, an API or an MCP server
4. Logs record what each run did

Who it suits

Developers and small teams who want to build agent and RAG apps on a visual canvas instead of wiring each piece by hand. So do teams that need to host the platform on their own servers, since the docs say Dify runs anywhere Docker runs.

Skip it if you plan to run it as a shared service for several customers. The license bars a multi-tenant setup unless LangGenius authorizes it in writing.

Where to use it

Dify is a web app, so you build in a browser, on LangGenius’s hosted Cloud or on a server you run. Coding agents reach your apps through a command-line tool called difyctl.

• Dify Cloud: hosted by LangGenius, nothing to install, with a free Sandbox plan
• Community Edition: self-hosted with Docker Compose, or run from source
• Dify Enterprise: for organizations that need self-hosting, SSO, RBAC and support SLAs, through LangGenius’s sales form
• Claude Code: the difyctl skill, in ~/.claude/skills
• Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and most other agents: the same skill, in ~/.agents/skills
• Claude Desktop and Cursor: a Dify app published as an MCP server

How to set it up

Get it saves a zip of Mindket’s setup notes in your downloads folder, with each route’s steps from LangGenius’s README and docs. The main self-hosted route is Docker Compose.

1. Clone the repository at its latest release.
2. Copy .env.example to .env in dify/docker.
3. Put a new token in .env. Make it with openssl and set it as DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN. Keep the default COMPOSE_PROFILES.
4. Start the services and check them.
5. Make the admin account in the browser. It is at http://localhost/install. Then add a model provider with its key in Integrations.

git clone --branch "$(curl -s https://api.github.com/repos/langgenius/dify/releases/latest | jq -r .tag_name)" https://github.com/langgenius/dify.git
cd dify/docker
cp .env.example .env
openssl rand -hex 32

docker compose up -d
docker compose ps --all

The one-time init_permissions service exits with code 0. That is expected. To let a coding agent work with your apps, install difyctl and sign in, then give your agent the skill. A self-hosted server must run Dify 1.18.0 or later, with OPENAPI_ENABLED and ENABLE_OAUTH_BEARER both set to true. The installer below is for macOS and Linux, on x64 and arm64. It checks the download’s checksum and installs to ~/.local/bin/difyctl.

curl -fsSL https://raw.githubusercontent.com/langgenius/dify/main/cli/scripts/install-cli.sh | sh
difyctl login --server https://dify.example.com
difyctl install skills ~/.claude/skills

On Windows, x64 only, the installer is a PowerShell line.

irm https://raw.githubusercontent.com/langgenius/dify/main/cli/scripts/install.ps1 | iex

For Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and most other agents, the skill goes in ~/.agents/skills. For any other agent, look up its skills folder in its documentation.

difyctl install skills ~/.agents/skills

How to use it

In the console you build a Workflow, a Chatflow or an Agent. A Workflow and a Chatflow share one canvas where you connect nodes that each do a step, such as calling a model, retrieving knowledge, running code or branching on a condition.

An Agent works another way. You set it up once and use it two ways: on its own as a chat app, or as a step inside a workflow. It works in a sandbox of its own, where it runs commands and reads and writes files. The Agent is in beta, and it is on by default on Docker Compose.

From a terminal, list your apps, or describe a job to help and it names the matching commands. Only apps with Service API access turned on are listed.

difyctl get console_app
difyctl help publish app

Example

You self-host Dify on your laptop and want Claude Code to see your apps. You sign in against your server. Pass the address you open Dify at in your browser. For a local server on http://, add --insecure. It applies to every later command until you sign in again without it, so keep it to local development. The server needs OPENAPI_ENABLED and ENABLE_OAUTH_BEARER set to true first.

difyctl login --server https://dify.example.com
difyctl get console_app

The terminal prints a code. On the Authorize difyctl page, you enter the code and click Continue within 15 minutes, then check the account and the workspace and click Authorize. The list that follows holds the apps whose Service API access is on. Once the skill is installed, you can ask the agent to build, run or update them.

For newcomers and experts

If you are new. A model provider is the company or server whose AI model your app calls. Every Dify app needs at least one model provider. On a self-hosted server you add the provider’s key, which bills your account with that provider. On Dify Cloud, the docs say you can use your AI credits or connect your own provider accounts and keys. Most of the canvas work is drag, connect and configure, with code only where your logic needs it. If you would rather not run Docker, Dify Cloud skips the install.

For experts. COMPOSE_PROFILES picks the bundled database, vector store and WebSocket API. The default is weaviate,postgresql,collaboration. DB_TYPE or VECTOR_STORE with a matching profile swaps them, and a new database does not migrate existing data.

Root .env beats a service .env, which beats the tracked defaults. Run docker compose up -d after an edit, because docker compose restart does not reload environment variables. Editing the plugin keys only in a service file can cause HTTP 401 responses. Behind Cloudflare or another proxy, everyone can share one rate limit until nginx is told which proxy to trust. From source, the API needs uv and runs on port 5001, and the web service needs Node.js 24.22.1 or later and PNPM 12.

Good to know

On a self-hosted install, these paths reach outside your server.

• License: the Dify Open Source License, which GitHub lists as Other. It is Apache 2.0 with added conditions. A multi-tenant service needs LangGenius’s written authorization, and the logo and copyright in the frontend must stay. Contributed code may be used commercially, its cloud business included, and the rest follows Apache 2.0. Read the LICENSE file before you run it for customers
• Model providers: a key grants workspace-wide model access and bills the provider account behind it. Only the workspace owner and admins can manage providers
• Outbound calls: the console checks updates.dify.ai for new versions, and an empty CHECK_UPDATE_URL turns that off. Plugins come from marketplace.dify.ai, which is checked for plugin upgrades every 15 minutes by default, and unsigned packages are refused by default. Compose leaves Next.js telemetry on until NEXT_TELEMETRY_DISABLED is 1, and Weaviate telemetry stays on until WEAVIATE_DISABLE_TELEMETRY is true
• Agent security: the new Agent is in beta, and Dify says its runtime is not a hardened boundary between users who do not trust each other. For production, replace DIFY_AGENT_SERVER_SECRET_KEY and DIFY_AGENT_API_TOKEN with your own random values
• Production: the Docker guide says to replace the bundled credentials and set up HTTPS and trusted proxies first
• difyctl: it acts as the account you approve and runs each command without asking, so keep your agent’s own approval for shell commands on. A sign-in lasts 14 days. Add model keys in Dify yourself, since anything typed to the agent passes through its model
• MCP server URL: it holds credentials, so treat it like an API key and regenerate it if it leaks
• Not run: Mindket read the docs and did not run the commands. The pages give no uninstall steps