Platform Architecture
2.1 Technology Stack
Section titled “2.1 Technology Stack”| Layer | Technology |
|---|---|
| Runtime | Node.js 22+ / Bun 1.3.14 |
| Language | TypeScript 5.6+ |
| CPU | x86_64 (primary) + ARM64 (AWS Graviton, Azure Cobalt) via multi-arch container images |
| Supported host OS | Ubuntu 22.04 / 24.04 LTS, Debian 11 / 12, RHEL 8+, Amazon Linux 2023 |
| Container runtime | Docker 20.10+, containerd 1.6+, or Kubernetes 1.24+ |
| HTTP Framework | Express.js with 510+ API endpoints |
| Local TLS Listener (endpoint agent) | Bun.serve (default, v1.0.75+) — HTTP/1.1 over TCP + HTTP/3 over QUIC/UDP on the same port; HTTP/2 ALPN structurally wired (pending Bun upstream). Opt-out: AGENTWATCH_PROXY_BUNSERVE=0 → https.createServer (HTTP/1.1 only) |
| ORM | Prisma 5.22 (PostgreSQL + SQLite, 44 tables) |
| KV Store | LevelDB (knowledge graph data) |
| Vector Store | LanceDB 0.13 (semantic search, session embeddings) |
| AST Parser | tree-sitter (native C bindings, 7+ languages) |
| Frontend | React 18, TanStack Query v5, Recharts v3, Tailwind CSS 3/4 |
| Graph Viz | XY Flow, Cytoscape, vis-network, Dagre, Mermaid |
| Real-time | WebSocket (ws), Server-Sent Events (SSE), NDJSON long-poll (egress tunnel) |
| Agent Protocol | Model Context Protocol (MCP) SDK 1.0+ |
| Security Scan | Semgrep (SAST), Trivy (SCA/secrets/misconfig) |
| NER/DLP | Presidio Analyzer/Anonymizer + spaCy (en_core_web_sm/md/lg) |
| Event Stream | Apache Kafka (Confluent 7.5) |
| Analytics DB | ClickHouse 24.1 |
| Observability | OpenTelemetry (OTLP/Jaeger/Zipkin), Langfuse, Prometheus |
| SAML | @node-saml/node-saml 5.x (native SP, no external IdP gateway required) |
| LDAP/AD | ldapts 8.x (LDAP+LDAPS, CA cert upload, skip-verify TLS) |
| Password Hashing | bcryptjs (pure-JS — Bun 1.3 + Node 24 ABI compatible) |
| Container | Docker (Ubuntu 24.04, multi-stage build, non-root UID 1001) |
| Load Balancer | HAProxy (sample config provided) |
| Build | Bun compiler (single binary, minified, no source exposure) |
| Client Agent | Node.js + node-forge, signed installers (mac/linux/windows), bundled curl-impersonate-chrome v1.5.6 |
2.2 Two-Server + One-Endpoint-Agent Architecture
Section titled “2.2 Two-Server + One-Endpoint-Agent Architecture”Main Server (Port 8787): LLM proxy engine, security layer (WAF, DLP, guardrails, rate limiting, IP allowlisting), MCP proxy for external servers, event pipeline (Kafka, ClickHouse, file archiver), agent fleet manager (enrollment, heartbeat, mTLS, PAC, identity policy + exemptions), egress tunnel listener for client agents, observability (OTel, Langfuse, Prometheus), primary database (PostgreSQL/SQLite, Prisma ORM, 44 tables).
Knowledge Extractor MCP Server (Port 4000): 22 MCP tools + dynamic resources, AST parsing (tree-sitter), knowledge graph (LevelDB), security scanning (Semgrep + Trivy), LLM enrichment (Anthropic/OpenAI/Ollama), vector store (LanceDB).
Client Agent (AgentWatch Connect — Endpoint, ports 443 + 19457): Local TLS-intercepting proxy on 127.0.0.1:443, control API on 127.0.0.1:19457, local CA management, hosts-file routing for managed domains, bundled curl-impersonate-chrome for upstream fingerprint matching, CRL Distribution Point endpoint, NSSM service on Windows / launchd on macOS / systemd on Linux.