Your Identity, Our Infrastructure, Zero Secrets
One architecture that deploys identically on Azure, AWS, GCP, or on-prem. The application code never changes — only the platform bindings underneath.
Runtime brain — dashboard, AI agent, MCP engine
Infrastructure — Terraform, Helm, K8s, monitoring
Plugins, connectors, RAG, scope cascade
Identity and infrastructure are completely separated. Nothing crosses the boundary except a signed JWT.
Users authenticate here. This tenant owns nothing except identity.
Every workload, every database, every secret lives here.
These two pods are always the same regardless of which cloud you deploy to.
Flask application • Port 5080
FastMCP server • Dashboard :5000 • MCP :5001
Six swappable backend categories. Application code stays THE SAME — only config changes.
config.yaml — zero code modifications required.
Multiple customers share the same infrastructure while having complete data and resource isolation.
acme.brainzbytes.comacmeacme-kvacme-dbacme-searchacme-mimega.brainzbytes.commegacorpmega-kvmega-dbmega-searchmega-mistartup.brainzbytes.comstartupxyzstartup-kvstartup-dbstartup-searchstartup-miK8s NetworkPolicy: Customer A pods can ONLY talk to Customer A services. Istio AuthorizationPolicy enforces pod-to-pod auth.
Each customer has own Managed Identity (acme-mi). acme-mi can ONLY access acme-kv, acme-db, acme-search. Cannot touch mega-kv.
Separate Key Vault (credentials never mix). Separate Database (plugins, state, connectors). Separate Search indexes (RAG data never crosses).
Istio mTLS encrypts all pod-to-pod traffic. No cross-namespace traffic allowed. App Gateway routes by hostname to correct namespace.
🛡️ You never see other customers. They never see you.
Customer signs up at brainzbytes.com
Control Plane creates isolated namespace + resources (~5 min)
Connect identity provider (Entra / Okta / Cognito)
Choose plugins from the Connector Marketplace
Configure credentials via My Credentials vault
Team logs in and starts using AI immediately
These apply to ALL cloud deployments — non-negotiable.
Azure Workload Identity / AWS IRSA / GCP Workload Identity Federation — zero secrets in pods. Pods authenticate via platform-native identity, never API keys.
Istio / service mesh encrypts all pod-to-pod traffic with mutual TLS. No unencrypted internal communication.
App Gateway / ALB / Cloud Load Balancer with WAF. All external traffic is TLS-terminated with managed certificates.
Connector credentials are never in environment variables. They're resolved at runtime from the vault with per-request authentication.
Vault cascade: user → group → org. Each user's credentials are isolated. No lateral access.
Customer login via Entra Conditional Access MFA. Provider admin access requires MFA. Runtime uses Managed Identity (X.509 certs) — stronger than password+MFA.
Card data never touches the platform. Stripe Checkout handles PCI compliance — we only store Stripe tokens.
An interactive SVG canvas for designing, configuring, and deploying MCP engine topologies — entirely no-code
app.js (~2,000 lines)_vdEngines[] — array of engine objects with plugins, connectors, sources/api/visual-designer/save — persist blueprint to Cosmos DB/api/visual-designer/load — retrieve saved blueprints/api/visual-designer/deploy — deploy topology as live MCP engines/api/visual-designer/ingest — trigger chunk → embed → index pipeline/api/visual-designer/cleanup — remove deployed resourcescerebro-visual-designs container for blueprints/dash/{slug}/ reverse proxy routes to MCP engine dashboardsSee the concrete implementation for each cloud provider
Deploy the entire platform from scratch in ~20 minutes with Terraform
Kubernetes, database, LLM, search, vault, registry, identity, networking, and DNS — each module provisions the correct cloud-native resource based on a single cloud variable.
Fully tested Azure environment: AKS, Cosmos DB, Azure OpenAI, AI Search, Key Vault, ACR, and DNS. AWS and GCP modules are ready — swap by changing one directory.
Two Helm charts (cerebro-app rev 5 and mcp-engine rev 3) deploy Kubernetes workloads. Day-2 operations via helm upgrade / helm rollback. Infrastructure endpoints are injected automatically by Terraform.
One-time bootstrap.sh creates remote state storage and a service principal. Then terraform apply handles everything else — infrastructure + workloads in a single command.
Production-grade monitoring with Prometheus + Grafana + Loki — embedded directly in the platform
Full metrics stack deployed alongside the application. Prometheus scrapes all services; Grafana provides real-time visualization via the Monitoring tab — no context-switching to external tools.
Loki 3.x + Promtail for centralized log aggregation. Search logs via LogQL in Grafana Explore. Log volume histogram colored by detected_level. 7-day retention.
Overview, MCP Engine, RAG, Security, Users, Alerts, and Logs — embedded via iframe with a dashboard switcher in the Monitoring tab.
Alertmanager rules cover API latency, error rates, MCP tool failures, RAG indexing delays, auth failures, pod restarts, and resource saturation — with severity-based routing.
All user identifiers are sha256-hashed before emission. No raw emails, names, or IPs in Prometheus or Loki — compliant with GDPR, SOC2, and HIPAA audit requirements.
Horizontal card layout showing all namespaces (default, mcp1, ingress-nginx, monitoring). Expandable pod details with images, digests, resources, and Helm metadata.
Both workloads managed via Helm charts (cerebro-app rev 5, mcp1 rev 3). Day-2 operations via helm upgrade and helm rollback.
deploy-monitoring.sh. Logs aggregated via Loki 3 + Promtail with 7-day retention.