# Kentron

> Documentation for the Kentron platform: Receipt AI Co-Worker, MCP Gateway, LLM Gateway, Kentron Catalog, Kentron Guard, Kentron Core, and the Receipt CLI.

- [What Kentron is](https://docs.kentron.ai/introduction.md): Kentron is the platform behind Receipt, an AI co-worker you give goals to, together with the gateways that govern its models and tools and the receipts that prove what it did.
- [What the AI Co-Worker does](https://docs.kentron.ai/co-worker/overview.md): How Receipt handles a goal you give it in plain language, from a direct answer to a background run whose every step is recorded as a receipt you can replay.
- [Your first chat](https://docs.kentron.ai/co-worker/your-first-chat.md): Learn the composer as it actually behaves, including the Skills chip, the + menu, and which controls do nothing on a turn.
- [Background runs](https://docs.kentron.ai/co-worker/background-runs.md): What happens when a turn becomes a durable background run, how to follow or stop it, and what a refused or blocked run looks like.
- [Replay a run](https://docs.kentron.ai/co-worker/replay.md): Open Agent replay to read what a run concluded, every command and app call it made, and the receipts behind each step.
- [Using skills in chat](https://docs.kentron.ai/co-worker/skills-in-chat.md): Pick an organization skill from the composer, or ask Receipt to draft and save a new one without leaving the conversation.
- [Editing, branching, and finding messages](https://docs.kentron.ai/co-worker/conversations.md): How Receipt's message tree, branch resolution, thread menu, and chat search actually behave.
- [Files and attachments](https://docs.kentron.ai/co-worker/files-and-attachments.md): What you can attach to a chat message, the exact limits, and how a file changes the answer to your next question.
- [Monitoring your runs](https://docs.kentron.ai/co-worker/monitoring.md): Where to watch what Receipt is working on, what its sandboxed computers are doing, and what your imported Claude Code sessions contain.
- [Receipt in Slack](https://docs.kentron.ai/co-worker/slack.md): Mention Receipt in a channel to get a direct answer or a background run that reports back in the thread, and learn exactly what the Slack app can and cannot do.
- [Receipt in Teams](https://docs.kentron.ai/co-worker/teams.md): Mention Receipt in Microsoft Teams to get a direct answer or a background run that posts one result message, and learn how the app is installed, claimed and configured.
- [How a turn is processed](https://docs.kentron.ai/co-worker/how-it-works.md): What happens between sending a message and reading the reply: the routing step, the three branches, the path a background run takes through a sandboxed computer, and where the gateways and Guard sit.
- [Objectives and tasks](https://docs.kentron.ai/co-worker/objectives-and-tasks.md): The vocabulary behind every background run, the statuses and display states you will see, the kind of objective the Tasks page starts, and what to do when a run needs attention.
- [Errors and limits](https://docs.kentron.ai/co-worker/errors-and-limits.md): Every user-visible chat error, quoted exactly as it appears, with what it means and what to do about it.
- [What the MCP Gateway does](https://docs.kentron.ai/mcp-gateway/overview.md): Connect your apps once, decide which operations agents may call, and let an MCP client use them without ever holding a provider credential.
- [Connect an app](https://docs.kentron.ai/mcp-gateway/connect-an-app.md): Connect a third-party account once for the whole organization, or inside one workspace for the CLI and MCP clients, and understand which surfaces read each.
- [Set up an MCP client](https://docs.kentron.ai/mcp-gateway/quickstart.md): Sign in with the Receipt CLI, install the Codex bridge, and confirm which workspace and which tools your MCP client will see.
- [Managing workspaces](https://docs.kentron.ai/mcp-gateway/workspaces.md): Create, share, rename and delete the authorization boundaries that hold your connections, action permissions, CLI sessions and MCP tools.
- [Where a connection lives](https://docs.kentron.ai/mcp-gateway/connection-scopes.md): Connections are stored per workspace, never per organization — which is why an app connected for chat is invisible to the CLI.
- [Receipt Connect connections](https://docs.kentron.ai/mcp-gateway/receipt-connect.md): What a connection is, what Receipt stores and does not store, how connections are addressed, and what each connector publishes as tools.
- [Tools and permissions](https://docs.kentron.ai/mcp-gateway/tools-and-permissions.md): Control exactly which operations a connection exposes to agents, and understand the fail-closed rules that govern writes.
- [The aggregate MCP server](https://docs.kentron.ai/mcp-gateway/aggregate-server.md): One endpoint publishes every eligible connection in your workspace as an opaque tool alias, with fixed publication rules, error shapes and route scopes.
- [Gateway activity](https://docs.kentron.ai/mcp-gateway/gateway-activity.md): Read one workspace's tool traffic on its Gateway activity dashboard, and know which calls reach it and which never will.
- [Gateway security model](https://docs.kentron.ai/mcp-gateway/security-model.md): Which token can reach which surface, what a stolen CLI session or server environment gives away, and where provider credentials actually live.
- [Troubleshooting the MCP Gateway](https://docs.kentron.ai/mcp-gateway/troubleshooting.md): The gateway, connection and CLI errors you are most likely to meet, what each one means, and what to change.
- [What the LLM Gateway does](https://docs.kentron.ai/llm-gateway/overview.md): One server-side checkpoint applies your organization's model policy and picks the credential before Receipt contacts any provider.
- [Models and providers](https://docs.kentron.ai/llm-gateway/models-and-providers.md): Connect a provider account, choose which models a workspace may use, and read the gallery for what actually runs.
- [Bring your own key](https://docs.kentron.ai/llm-gateway/bring-your-own-key.md): Store your organization's own provider API key, save it in the scope Receipt actually reads, and know which credential pays for each request.
- [Model policy](https://docs.kentron.ai/llm-gateway/model-policy.md): Turn manufacturers and individual models on or off for your organization, set the three compliance flags, and read what each control actually enforces.
- [Usage and spend](https://docs.kentron.ai/llm-gateway/usage-and-spend.md): What the Usage page counts, how Receipt reserves and settles the cost of every model call, and which limits actually stop a request.
- [Gateway configuration](https://docs.kentron.ai/llm-gateway/configuration.md): The environment variables on Receipt's model path, the exact failure each one produces, and what a refused model call returns.
- [Kentron Catalog](https://docs.kentron.ai/catalog/overview.md): The four inventories Receipt keeps for an organization — cloud agents, connectable apps, skills and usage — and the things none of them do.
- [Agent Registry](https://docs.kentron.ai/catalog/agent-registry.md): Discover the AI agents and agent-like workloads running in your connected AWS, Azure and Google Cloud accounts, and review their autonomy, ownership and risk.
- [Connector catalog](https://docs.kentron.ai/catalog/connectors.md): Every app Receipt can connect to, what each connection publishes as tools, and how to find them on the Integrations page.
- [Organization skills](https://docs.kentron.ai/catalog/skills.md): Upload versioned SKILL.md instructions once, enable the ones your organization wants agents to follow, and see exactly how they reach a run.
- [Writing a skill](https://docs.kentron.ai/catalog/writing-a-skill.md): The SKILL.md contract an organization skill has to satisfy, how its name becomes its identity, and what makes a skill an agent will actually open.
- [Org Brain and knowledge](https://docs.kentron.ai/catalog/org-brain.md): The organization-wide activity dashboard — runs, spend and which applications your objectives used — and the URL-only document store that chat can retrieve from.
- [What Guard enforces](https://docs.kentron.ai/guard/overview.md): The controls that sit between an agent and your systems, which of them act on every request today, and which only record your intent.
- [Guardrail groups](https://docs.kentron.ai/guard/guardrails.md): Author, version and test guardrail groups that inspect prompts, responses and tool traffic — and understand why nothing enforces them yet.
- [Organization policies](https://docs.kentron.ai/guard/policies.md): The five policy modules — rate limiting, budgets, logging, guardrails and tool approval — what each rule holds, and why nothing reads them yet.
- [Access control](https://docs.kentron.ai/guard/access-control.md): Who can change what in an organization: the three roles, the settings access rule and its one exception, workspace authority, and the two surfaces here that are not enforced.
- [Receipts and audit](https://docs.kentron.ai/guard/receipts-and-audit.md): What a receipt records, which surfaces write one, which leave no trace, and how the SHA-256 hash chain is checked on every append and every replay.
- [Data handling and security](https://docs.kentron.ai/guard/data-handling-and-security.md): Where your credentials live, what the browser and an agent are allowed to see, exactly what telemetry leaves the deployment, and how to report a vulnerability.
- [What Kentron Core provides](https://docs.kentron.ai/core/overview.md): The shared services every other section runs on — identity, organizations and workspaces, the receipt store, the runtime and its job queue, browser sync, keys and tokens.
- [Create and manage your account](https://docs.kentron.ai/core/your-account.md): Sign up for Receipt, verify your email, sign back in, and manage your profile, password and sessions afterwards.
- [Organizations and workspaces](https://docs.kentron.ai/core/organizations-and-workspaces.md): Receipt keeps your work in two containers and the interface calls both of them a workspace — here is which is which, and what each one holds.
- [Members and roles](https://docs.kentron.ai/core/members-and-roles.md): The three organization roles and what each can do, how invitations and seats work, and where a pending workspace share appears.
- [Billing and plans](https://docs.kentron.ai/core/billing-and-plans.md): Choose a plan, allocate seats, and see the three things a plan actually changes — feature gating is not one of them.
- [Processes, roles, and routing](https://docs.kentron.ai/core/architecture.md): The Receipt runtime topology: one image run in five roles, what listens, and how a request reaches it.
- [Receipts, chains, and streams](https://docs.kentron.ai/core/receipts-and-streams.md): The receipt shape, what the hash covers, how the runtime folds a chain, how forking a stream works, and why every table is rebuildable.
- [Jobs, lanes, and durable execution](https://docs.kentron.ai/core/jobs-and-durable-execution.md): The four job lanes, the job lifecycle receipts, singleton and idempotency rules, the lease and recovery defaults, and how a job survives a worker dying.
- [Inside the Factory engine](https://docs.kentron.ai/core/factory-engine.md): How a background objective becomes a task graph, runs inside a disposable computer with the Codex CLI, and settles back into receipts.
- [Runtime HTTP and live-event API](https://docs.kentron.ai/core/runtime-api.md): The Receipt runtime's job, memory, chat, callback and health routes, the web app's own API surface, and the live-event contract — with bodies, statuses and exact error strings.
- [The TypeScript SDK and actions](https://docs.kentron.ai/core/typescript-sdk.md): Write a receipt-native agent with the eight SDK exports, and pick the side-effect class that decides how the runtime is allowed to retry each action.
- [Authoring an agent](https://docs.kentron.ai/core/authoring-agents.md): Write a receipt-native agent, run it inline from a checkout, and read the control-receipt trail back — starting with the scaffold defect you hit first.
- [Configuration, secrets, and keys](https://docs.kentron.ai/core/configuration.md): The variables Receipt actually reads, what breaks without each one, and the key rotation that cannot be undone.
- [Local development](https://docs.kentron.ai/core/local-development.md): Run the whole Receipt stack on your own machine: what to install first, the three run modes, the full port map, and how to stop it cleanly.
- [Local development troubleshooting](https://docs.kentron.ai/core/local-development-troubleshooting.md): Why your change did not take effect, why chat has no model credential, how to develop offline against a mock model, and a symptom-to-fix table for the failures that actually happen.
- [What self-hosted mode actually is](https://docs.kentron.ai/core/self-hosting.md): Self-hosted mode is a build-time decision baked into the browser bundle, and it changes identity, billing and telemetry — read this before you configure anything else.
- [Postgres, migrations, and the sync publication](https://docs.kentron.ai/core/database-and-migrations.md): Postgres is Receipt's only store, and a table reaches the browser only when it belongs to the zero_data replication publication — so get the version, the migration order and the publication membership right.
- [Running the integration provider](https://docs.kentron.ai/core/integrations-provider.md): Stand up the service Receipt Connect cannot work without: three variables, a registered OAuth callback on your own domain, and a signed webhook — plus the secret key that does not exist until after your first deploy.
- [Deploying Receipt](https://docs.kentron.ai/core/deploying.md): The two deployment shapes, the guards that stop a bad release, the secrets a deploy needs, and why a rollback re-promotes a build rather than rebuilding one.
- [Health and observability](https://docs.kentron.ai/core/health-and-observability.md): Probe whether a deployment is serving, read what each process writes to its logs, and send those logs and traces to your own collector.
- [Getting help](https://docs.kentron.ai/core/getting-help.md): Where to go when something in Receipt is wrong, which interface surfaces are not wired up yet, and how to report a security issue.
- [The receipt CLI](https://docs.kentron.ai/cli/overview.md): What the released receipt binary can do, how it differs from the in-repo developer CLI, and the parsing behaviour that trips people up.
- [Install the CLI](https://docs.kentron.ai/cli/install.md): Install the released receipt binary, confirm it can reach the hosted Kentron gateway, and know what an upgrade changes.
- [CLI quickstart](https://docs.kentron.ai/cli/quickstart.md): Go from an empty terminal to your organization's connections in the shell and in Codex, in about five minutes.
- [Sign in: setup, login, and logout](https://docs.kentron.ai/cli/setup.md): Sign the released CLI in with one command and a browser approval, and understand the session file and 12-hour token it leaves behind.
- [Diagnosing your setup with receipt doctor](https://docs.kentron.ai/cli/doctor.md): How receipt doctor checks your endpoint, gateway, sign-in health, and saved session without ever signing in — and the symptoms it surfaces, with the fix for each.
- [Switching workspaces](https://docs.kentron.ai/cli/workspaces.md): Move a CLI session between workspaces with receipt workspace, and understand why that changes everything else the CLI can see.
- [Connecting providers from the CLI](https://docs.kentron.ai/cli/connect.md): Authorize a provider from the terminal with receipt connect, inspect and remove connections, and use the automation surface that reuses your saved session or an environment token.
- [Calling tools and wiring MCP clients](https://docs.kentron.ai/cli/tools-and-mcp.md): Use receipt tools to list, inspect and call gateway tools, and receipt mcp to generate or install a client configuration.
- [Observing and importing Claude Code activity](https://docs.kentron.ai/cli/observe-claude-code.md): Capture Claude Code sessions into Receipt with import and observe, and know exactly what gets captured and where it goes.
- [Command reference](https://docs.kentron.ai/cli/command-reference.md): Every verb the released receipt binary accepts, with its flags, defaults, output shape and exit code.
- [Environment and exit codes](https://docs.kentron.ai/cli/environment-and-exit-codes.md): Every environment variable the released CLI reads, how it decides which Receipt to talk to, where it keeps your session, and what its exit codes and JSON envelopes mean.
- [Troubleshooting the CLI](https://docs.kentron.ai/cli/troubleshooting.md): Find the exact message the receipt binary printed, learn what caused it, and run the one command that fixes it.
- [The in-repo developer CLI](https://docs.kentron.ai/cli/from-source/overview.md): The second program named receipt: how the wrapper starts it, the order it loads environment files, the parsing traps, and what receipt doctor does and does not tell you.
- [Reading receipts and driving jobs](https://docs.kentron.ai/cli/from-source/receipts-and-jobs.md): Resolve a run to a stream, read and fork its receipt chain, audit every chain for integrity, and operate the job queue, memory and session search from a checkout.
- [Factory concepts and configuration](https://docs.kentron.ai/cli/from-source/factory-overview.md): The objective, task, candidate, job and check vocabulary, the promotion gate, the single execution path, and every key the Factory config loader actually reads.
- [Factory command reference](https://docs.kentron.ai/cli/from-source/factory-reference.md): Every receipt factory command with its syntax, flags, exit codes and exact error strings, plus the agent envelope, the computer lane and the board TUI.
- [Testing, simulation, and stack validation](https://docs.kentron.ai/cli/from-source/testing-and-simulation.md): What each check command really covers, what the fast check leaves out, and how to turn a non-deterministic failure into a permanent regression case.

## Optional

- [Open Receipt](https://app.kentron.ai)
- [GitHub](https://github.com/kentronai)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.