Architecture

Klent is a control layer. It does not replace your agent runtime, your LLM provider, or your tools. It sits between them.

The data flow

 ┌──────────┐    evaluate     ┌───────────────┐   allow    ┌────────┐
 │  Agent   │ ───────────────▶│  Klent API    │ ─────────▶ │  Tool  │
 │ (your    │                 │               │            │  /API  │
 │  code)   │ ◀─────────────── │ policy engine │ ◀───────── │        │
 └──────────┘   deny / modify │ event sink    │  result    └────────┘
       │                      │ alerts        │
       │                      └──────┬────────┘
       │                             │
       │     log events              ▼
       └────────────────────▶  Postgres

The path has three distinct call shapes:

Synchronous evaluation (POST /v1/actions/evaluate). The agent asks Klent whether a tool call is allowed. Klent evaluates against the project's enabled policies and returns allow, deny, or modify in a few ms. This call is in the hot path and must stay fast.
Non-blocking event logging (POST /v1/events). After the tool runs (or fails), the agent reports what happened. The SDK buffers these and flushes them asynchronously. The API responds 202 Accepted.
Out-of-band dispatch (alerts, retention, dashboards). On event insert, Klent checks if any alert rules match the event type. Matching rules fan out to email (Resend) or webhooks (HMAC-signed). The request path never waits for dispatch to finish.

Components

API (`apps/api`)

Stateless Hono server. Postgres is the only persistent dependency. Handles all /v1/* endpoints. Deploys behind any load balancer.

Dashboard (`apps/dashboard`)

Next.js 15 app for humans — viewing executions, writing policies, managing alerts and invitations. Reads from the same Postgres as the API.

SDK (`@klent/sdk`, `klent-sdk`)

Thin HTTP clients with client-side batching for logEvent. Available for TypeScript and Python. Same API surface on both.

Postgres

Stores projects, API keys, users, memberships, executions, events, policies, alert rules, and invitations. Multi-tenant via project_id on every row.

What Klent does not touch

Your agent loop. Klent gives you one evaluateAction and one logEvent to call. How you wire them into an OpenAI tool-use loop, a LangGraph node, or a bespoke orchestrator is up to you.
Your tools. Klent does not execute tools. You do. Klent only decides whether the call should happen and records the outcome.
Your LLM choice. Klent is completely decoupled from Anthropic, OpenAI, or any inference provider.

Deployment topology

Klent ships as a hosted product. The full stack lives behind klent.dev:

api.klent.dev — the Hono API (apps/api).
app.klent.dev — the Next.js dashboard (apps/dashboard).
klent.dev — the marketing landing + this documentation (apps/landing + apps/docs, the latter served under /docs/*).
Postgres — Supabase pooled instance, multi-tenant via project_id.

VPC / on-prem deployment is planned as a paid Enterprise tier after alpha; the architecture is intentionally cloud-portable so that path stays open. There is no public self-hosted distribution today.

Architecture

On this page