Compatibility
This page summarizes what WingGate components run on and what they interoperate with. It intentionally states only what is verified today; anything not listed here should be treated as not provided, not as implicitly supported.
Component matrix
| Component | Compatibility today | Authoritative source |
|---|---|---|
| WingGate | Self-hosted on Linux with the baremetal/systemd reference deployment; single-node reference form. | connector deployment article |
| wing-connector | Runs on Linux hosts with outbound HTTPS access to WingGate; no inbound ports required. | connector deployment article |
| Runner | x86_64-unknown-linux-musl static build; SHA-256 digest signed with an offline Ed25519 release key, verified on the asset. | This page |
| SSH | Targets need a reachable SSH service; WingGate's SSH endpoint authenticates your client by public key. | SSH client access article |
| File backends | SMB 3 shares (mandatory encryption, NTLMv2 only; signing follows the negotiated requirement), WebDAV sites over https with a confirmed SPKI fingerprint, and S3-compatible object storage over standard public PKI with per-request SigV4; the target must be reachable from wing-connector. | Working with Files article |
| MCP clients | Any client implementing MCP Streamable HTTP, connected to the connector MCP ingress. | MCP setup guide |
| Web Console | A modern browser with WebCrypto and WebSocket support; no version matrix is claimed. | This page |
| Browser extension | Chrome / Chromium-based browsers (the extension manifest requires Chrome 119 or newer); install from the Chrome Web Store first, or load the unpacked package your deployment serves when the store is unreachable. | Bind a Browser article |
WingGate
WingGate is the service you operate yourself or use hosted. The reference deployment is a self-managed baremetal or systemd setup on Linux, fronted by HTTPS with a valid certificate.
Exact installation steps, configuration keys and operational constraints are covered by the connector deployment article. Where this page and that article differ, that article wins.
wing-connector
The wing-connector runs on Linux hosts that can reach WingGate over outbound HTTPS. It uses the same pure-outbound model for every deployment: no inbound listener, no public IP on your side.
The supported installation surface is the one shipped by the reference deployment: the connector deployment article is the authoritative description of supported environments. Environments not covered there are not claimed to work.
connector topology and deployment
Runner
The Runner is the asset-side tool runner that powers Runner-only capabilities such as typed file search (file.find and file.grep). It ships as a statically linked x86_64-unknown-linux-musl binary, so it carries no glibc version requirement against the target distribution.
Release artifacts are digested with SHA-256 and the digest is signed with an offline Ed25519 release key; the signature is verified as part of installation. Installation runs under the connection profile user's cache directory and does not use sudo. Architectures other than x86_64 Linux are not provided today.
Runner authorization, installation and tool availability are separate states: an authorization is a persistent deployment permit scoped to (Asset, Connection Profile) inside a Project, the first Runner-only operation triggers an install job, and install status does not double as a heartbeat for tool availability.
SSH
On the target side, hosts need an SSH service reachable from the wing-connector; the wing-connector is the only component that speaks SSH to your machines, and host keys are probed and pinned before first use.
On the client side, you can connect your own SSH client to WingGate's SSH endpoint. Authentication is by the public key you register on your account; WingGate never holds your private key.
MCP clients
Any MCP client that implements the Streamable HTTP transport can use WingGate. Clients do not connect to WingGate for tool traffic: they connect to the wing-connector's MCP ingress and discover the authorized endpoints per asset through the WingGate API.
Access is scoped by a Project MCP credential presented as a bearer token; the credential value is shown only once at creation. The MCP surface is the one-shot, non-PTY shell and file tool groups, plus the browser and notify tool groups on browser assets; typed search (file.find, file.grep) requires the Runner. Interactive terminal sessions are not part of the MCP surface.
Browser
The Web Console requires a modern browser with WebCrypto and WebSocket support, which covers current versions of the major browsers. We do not publish a version matrix: there is no tested basis for one, and claiming one without that basis would be fiction. The extension that binds a browser asset is covered by the Bind a Browser article.
How this page is maintained
This page is maintained by the project maintainers and updated together with the connector deployment article and the docs. When support changes, the change lands in those documents first and is summarized here.
For anything ambiguous, treat the changelog and the docs as the source of truth: Changelog