> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberun.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> The Cyberun platform from the outside in — the surfaces clients and agents reach, and how they fit together.

This page describes the platform at the surface clients can reach.
For end-user product flows, see the [Cloud](/cloud/overview) tab.
For the full HTTP surface, see
the [API reference](/api-reference/introduction).

## Components clients see

```mermaid theme={null}
flowchart TD
    Browser["Browser<br/>(Cyberun Cloud dashboard)"]
    Scripts["Scripts and CI<br/>(integration credential)"]
    AI["AI clients<br/>(Claude Code, Cursor, etc.)"]

    API["HTTPS API<br/>core.cyberun.cloud"]
    Gateway["Agent gateway<br/>(WebSocket)"]
    MCP["MCP endpoint<br/>(streamable HTTP)"]
    Identity["OIDC issuer"]
    License["License service"]

    Agents["Cyberun agents<br/>(your GPUs)"]

    Browser --> API
    Scripts --> API
    AI --> MCP

    API --> Identity
    API --> License
    API --> Gateway
    Gateway --> Agents
```

Five public surfaces matter to operators:

* **HTTPS API.** REST endpoints under `https://core.cyberun.cloud/api/v1`
  (or your deployment's equivalent). Every product talks to this:
  Cloud, scripts, partner integrations. Authenticated with
  user JWTs, integration credentials (`sk-`), or device
  credentials (`dk-`).
* **Agent gateway.** A WebSocket surface that connected agents hold
  open. Tasks are dispatched to agents over this connection. Agents
  authenticate with an agent credential (`ak-`) issued from Cloud.
* **MCP endpoint.** A streamable-HTTP Model Context Protocol
  endpoint that wraps runtime operations as MCP tools. Used by AI
  clients with an `sk-` credential.
* **OIDC issuer.** A self-hosted identity provider that signs the
  tokens used across the platform. See [Identity](/platform/identity).
* **License service.** Validates that the deployment is licensed
  and gates the features the license includes. See
  [License administration](/platform/license).

## Components agents see

Agents are placed wherever the GPUs are — workstations, data-center
racks, edge nodes. They reach the gateway over an outbound HTTPS
connection that is upgraded to a WebSocket. Once connected, they
hold the connection open and accept tasks from it. There is no need
to expose an inbound listener on the agent host.

When a task asks an agent to expose a service — for example, a
ComfyUI UI a user wants to reach from a browser — the gateway
proxies the request through the same outbound connection. The
operator does not need to publish a separate port for the agent.
See [Gateway and tunnels](/platform/gateway-and-tunnels) for how
that proxying behaves.

## Where data lives

The platform owns the persistent records for teams, agents,
workflows, tasks, credentials, and license state. Artifacts that
tasks produce — images, models, generated assets — are uploaded to
an object store and served back to clients through short-lived
URLs. The exact storage backend is a deployment decision; the API
contract does not change.

## Same surface, different environments

A Cyberun deployment can run as a managed service on Cyberun
Cloud, in a sovereign datacenter, in a partner VPC, in an
air-gapped lab, or stretched across several of those. The
surfaces shown above are the same in every case — only the URLs
and the operator change. Cloud, scripts, and AI clients
configured against one deployment are configured against any
other by changing the base URL.

For how the platform stays consistent across sites, see
[Deployment patterns](/platform/deployment-patterns).