Install Patendra and configure your first matter

Source access is included with every license. You need Python 3.11 or newer. Unpack the source archive, install dependencies, and start the server:

cd patendra
pip install -r requirements.txt
python server.py

The web UI is now at http://127.0.0.1:8080 and the dashboard at http://127.0.0.1:8080/app. Prefer a native window instead of a browser tab? Run the desktop entry point:

python desktop.py

Both entry points share the same data directory and configuration. Patent figures are generated by a built-in renderer with no external dependency. Optional: install Graphviz (the dot binary) for higher-resolution raster figures.

Default locations:

• macOS: ~/Library/Application Support/Patendra
• Windows: %APPDATA%\Patendra
• Any platform: set PATENDRA_HOME to relocate it to an encrypted volume, a backup-managed folder, or a Docker volume mount.

Inside it you'll find your .env (API keys and settings), a folder per run containing every artifact the workflow produced (hypotheses, prior-art search logs, examination memos, claim sets, the drafted specification, figures, and the PDF package), the learning data accumulated from your Strong/Moderate/Weak/Rejected assessments, and the ChromaDB vector store used for local semantic prior-art search. Deleting the directory resets Patendra completely; backing it up preserves everything, including scoring calibration.

Expose the server with a token

The server refuses to bind a non-loopback address without PATENDRA_API_TOKEN: it fails closed rather than starting open. Set a strong token and the host together:

export PATENDRA_API_TOKEN="$(openssl rand -hex 32)"
export PATENDRA_HOST=0.0.0.0
python server.py

With a token set, every /api endpoint requires it, via the X-API-Token header or an Authorization: Bearer header. Comparison is constant-time, and requests are further bounded by the body-size cap and per-client rate limiting.

Dashboard login (cookie auth)

Browsers shouldn't keep a raw token in JavaScript. Instead, the dashboard exchanges the token once at POST /api/auth/session for an HttpOnly, SameSite=Strict session cookie. After that, team members use the dashboard normally without the token ever being readable by page scripts. If the dashboard is served from a non-localhost origin, add it to PATENDRA_CORS_ORIGINS.

Docker

A Dockerfile ships in the repository. The container requires PATENDRA_API_TOKEN when exposed; mount a volume at the data directory so runs and learning data survive restarts:

docker build -t patendra .
docker run -p 8080:8080 \
  -e PATENDRA_API_TOKEN=change-me \
  -v patendra-data:/data -e PATENDRA_HOME=/data \
  patendra

Terminating TLS at a trusted reverse proxy? PATENDRA_ALLOW_INSECURE=1 skips the token requirement for the bind check. Use it only when the proxy itself authenticates every request. The full hardening list is on the security page.