Self-hosted architecture

Agent / MCP client
        │
        ▼
MCP gateway ──────► Executor API ──────► Adapter ──────► Provider
     │                   │   │               ▲
     ▼                   ▼   ▼               │
 SessionStore    Execution store/queue   CredentialProvider
                         AgentStore

Dashboard ─────────────► Executor API
Mocks replace only the provider side of the adapter boundary.

Boundary	Trust
Gateway	Authenticates project, resolves end-user identity, maps MCP calls
Executor	Validates schemas, enforces catalog/allowlists, records executions
Credential provider	Selects a credential by project, user, toolkit, connection
Adapter	Translates canonical JSON to provider HTTP and normalizes results

The default executor and gateway compositions are in memory. With EYEBALL_DATABASE_URL, the stock executor selects the provided Postgres execution/file/webhook/trigger/usage/agent stores, including voice_agent_session_observers for lease-fenced cursor/phase/retry state and voice_webhook_sources for complete reconstructable voice envelopes; the stock gateway selects its Postgres session/task store. The two applications own independent committed migration histories, while root pnpm db:migrate applies both. Custom deployments may replace any exported storage seam, but must preserve terminal immutability, idempotency, immutable agent revisions, exact revision pinning, source-before-cursor ordering, lease fencing, one-way session credential binding, and atomic session updates.

Expose the gateway and dashboard through your own TLS, authentication, and rate limiting layer. The executor provides redacted structured logs and optional OpenTelemetry signals; collectors, retention, dashboards, alerts, and access control remain deployment responsibilities.