Skip to main content
Core is the platform the other six sections run on. Your account, the organization that owns your data, the workspaces that scope connections, the database that holds every receipt, the runtime that carries out background work, and the sync layer that keeps the browser current all live here. Come to this tab to set up an account or an organization, to understand how a run is actually executed, or to configure, deploy and operate Receipt yourself. New to Kentron? Start with What Kentron is.
Four Core surfaces look functional but are not wired up in this release. Plan entitlements gate nothing — every feature check resolves to allowed, on every plan; what genuinely differs is the seat count, the metered usage budget and the one-time signup credit. The organization Security page — Domains, Single Sign-On, Directory Provisioning — is a placeholder with disabled buttons and no implementation behind it. The organization Analytics & Insights page’s three extraction toggles are disabled and cannot be turned on. Two-factor authentication is verified at sign-in for an account that already has it enrolled, but no screen enrols one, and passkeys exist only as unused interface strings. Getting help keeps the Core list; the enforcement matrix on what Guard enforces covers the surfaces other tabs own.

How to read this tab

The groups follow the order you meet them: get an account and an organization, then the architecture behind a run, then the interfaces you can build against, then everything you need to configure, host and operate a deployment.

Accounts and organizations

Signing up and signing in, organizations and workspaces, members and roles, seats and billing.

Architecture

The five runtime roles and the service gateway, receipts and streams, jobs, and the Factory engine.

APIs and SDK

The runtime’s HTTP, SSE and WebSocket surface, the TypeScript SDK, and authoring an agent.

Configure

Every environment variable the platform reads, what it defaults to, and what breaks without it.

Run it yourself

Local development, self-hosting, migrations, the integration provider, deploying, health checks.

Getting help

What works today, what is not available yet, and where to report a problem.
Each card opens the first page of its group. The rest of the tab follows from there:

The shared services

Each row is one service Core provides and the parts of the product that depend on it. When something in another tab behaves in a way you did not expect, this table usually points at the Core page that explains it.

How it fits

Every surface enters Core somewhere. The web app resolves your session and organization before it does anything else. Slack and Teams resolve a Receipt user through an install claim link, then call the runtime’s channel-neutral routes, which are served on the private runtime network and carry the resolved user and organization in the request body rather than a bearer token. The CLI and other MCP clients hold nothing but a Connect token. Factory workers ask the gateway for what a call needs at the moment of the call: provider credentials stay in Nango, and MCP client configs and sandboxes never contain them. Everything those paths do lands back in one place. Chat turns, gateway actions, Factory runs, and policy, skill and Agent Registry changes all append receipts, and the sync layer carries the resulting projections back to your browser — which is why a task list, a run’s progress and a replay are views of one stream rather than separate records. One gap is worth knowing before you rely on that trail: calls made through the MCP bridge are not yet recorded. Receipts and audit accounts for what does and does not write one.
The runtime answers /healthz and /readyz; the web application answers /health. Readiness, not liveness, is the gate worth alerting on — see health and observability.
Next step: create your account and sign in.