| Zitadel ↗ | Identity provider — Zitadel v3 for sign-in + OIDC. Also powers the Synapse homeserver OIDC login. | Apache 2.0 |
| Synapse ↗ | Matrix homeserver at matrix.ownify.ai. Every tenant has a per-agent bot @ownify-<slug>:ownify.ai reachable over end-to-end encrypted Matrix DMs. SSO via Zitadel. | AGPL v3 |
| Element Web ↗ | Self-hosted Matrix client at element.ownify.ai. Homeserver pre-configured to ownify.ai so users never see a homeserver picker. | AGPL v3 |
| matrix-rust-sdk ↗ | Rust Matrix client library used inside MicroClaw’s channel-matrix feature. Handles E2EE olm/megolm, cross-signing, typing notices, encrypted media. | Apache 2.0 |
| LiteLLM ↗ | Multi-provider LLM proxy. Enforces per-tenant budgets + virtual keys; ownify control plane reads spend + token counts directly from its SpendLogs table. | MIT |
| klaw-web gateway ↗ | The single web-egress choke point for tenant agents. Wraps Firecrawl + SearxNG under one auth + rate-limit + SSRF-guard + audit layer. Source in this repo under services/klaw-web/. | Platform component (ownify) |
| klaw-a2a-gateway ↗ | Public ingress for agent-to-agent traffic. Runs the inbound firewall stack — AAE verify, MolTrust gate, content sanitiser, rate limit, recursion depth guard, per-tool ACL — before forwarding to the tenant’s MicroClaw pod. Source under services/klaw-a2a-gateway/. | Platform component (ownify) |
| klaw-egress-scanner ↗ | Outbound DLP scanner. Every text the agent tries to send on any channel is scanned for tokens, JWTs, PEM keys, internal paths and YAML secret signatures. Redacts or refuses before delivery. Source under services/klaw-egress-scanner/. | Platform component (ownify) |
| klaw-router ↗ | Task-category LLM router. MicroClaw pods call it with model="klaw-auto"; a small classifier picks the right model per request from the open-weights catalog. Source under services/klaw-router/. | Platform component (ownify) |
| klaw-memgate ↗ | Per-tenant memory access boundary. Bearer + ACL + AAE envelope verification on every memory_query / memory_upsert / list_drawers / search call. Source under memgate/. | Platform component (ownify) |
| Firecrawl ↗ | Self-hosted HTML-to-markdown scraper with JS rendering. Backs klaw-web’s /v1/fetch and /v1/extract. | AGPL v3 |
| SearxNG ↗ | Self-hosted metasearch aggregator. Backs klaw-web’s /v1/search. | AGPL v3 |
| Langfuse ↗ | LLM observability (traces, token counts). One project per platform today. | MIT (community edition) |
| CloudNativePG ↗ | Postgres operator — runs Postgres for control plane, Zitadel, LiteLLM, Langfuse. | Apache 2.0 |
| PostgreSQL ↗ | Primary relational database for every ownify service. | PostgreSQL License |
| MinIO ↗ | S3-compatible object storage for documents, backups, Langfuse assets. | AGPL v3 |
| cert-manager ↗ | Per-tenant TLS certificate issuance + renewal via Let’s Encrypt. | Apache 2.0 |
| ingress-nginx ↗ | HTTP reverse-proxy in front of every public ownify subdomain. | Apache 2.0 |
| Kubernetes ↗ | Workload orchestrator — every ownify service, every tenant pod. | Apache 2.0 |