DocumentationLicense
Control Plane

One control plane. Many gateways.

The CP is where you operate fleets — register instances, mint enrollment tokens, issue licenses, bind plugin sets, watch live status, drill into per-call audit, and ship metrics to Prometheus / OpenTelemetry.

Tenancy hierarchy
3 levels
Org → Workspace → Environment
Storage backends
2
SQLite for single-node, or Postgres with row-level security for HA
HA
multi-instance
Leader-leased janitors, BEGIN IMMEDIATE chains, shared CA

Run it

bash
# Single binary — SQLite, embedded UI
mcpg cp serve --dev

# HA — Postgres + multi-instance
helm install mcpg-cp ./helm/charts/mcpg-cp \
  --set replicaCount=3 \
  --set postgres.enabled=true
What's in the CP

The operational surface.

Instance management

  • Enrollment tokens — single-use, time-limited bootstrap
  • Live registry of connected agents per replica
  • Cross-replica ConfigUpdate fan-out via pubsub
  • Quarantine + revive operator actions

Configuration delivery

  • Plugin sets — versioned, named, content-hashed
  • Bind plugin set to instance; updates pushed via gRPC channel
  • PullConfig + Heartbeat dirty-bit + push narrowing for converging replicas
  • ConfigAck records prove delivery

Observability

  • Per-call tool invocation samples (BLAKE3 error hashing, no plaintext)
  • Hourly + daily rollups for fleet-level metrics
  • StatusReport ingest — CPU, memory, plugin status, warnings
  • Prometheus exposition at /v1/orgs/{org}/metrics

Security

  • Tamper-evident audit ledger with per-org chain serialization
  • Configurable retention windows for raw tool logs and rollups
  • Per-tenant envelope-encrypted payload capture
  • OIDC SSO + workspace-scoped RBAC
The UI

One dashboard for the fleet.

Embedded React + shadcn/ui, served by the CP itself. No separate deploy, no separate auth. Drill into any instance, any tool call, any audit event.

Observability deep-dive
cp-ui · embedded dashboard