# Architecture

> The services PentAGI runs, how they talk to each other, and what is optional.

PentAGI is a set of Docker services. The core stack is enough to run [flows](https://pentagi.com/docs/glossary/#flow); the [knowledge graph](https://pentagi.com/docs/glossary/#knowledge-graph) and the observability stacks are optional add-ons.

## [System context](https://pentagi.com/docs/concepts/architecture/#system-context)

```mermaid
flowchart LR
  accTitle: System context of PentAGI with its users, targets, LLM providers, search engines, monitoring and the update server
  user["Security engineer"] -->|HTTPS| pentagi["PentAGI"]
  user -->|monitors| langfuse["Langfuse"]
  user -->|monitors| grafana["Grafana"]
  pentagi -->|tests| target["Target systems"]
  pentagi -->|queries| llm["LLM providers"]
  pentagi -->|searches| search["Search engines"]
  pentagi -->|reports| langfuse
  pentagi -->|reports| grafana
  pentagi -->|checks for updates| update["update.pentagi.com"]
```

Within two minutes of starting and then every three hours, PentAGI also checks `update.pentagi.com` for a newer build and sends a summary of the installation with the request; [Update check](https://pentagi.com/docs/configuration/security/#update-check) lists what it contains and how to turn it off.

## [Services](https://pentagi.com/docs/concepts/architecture/#services)

| Group                | Services                                                                                                                                                       | Compose file                       |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
| Core                 | `pentagi` (Go backend with REST and GraphQL, React UI), `pgvector` (PostgreSQL with pgvector), `pgexporter` (PostgreSQL metrics), `scraper` (isolated browser) | `docker-compose.yml`               |
| Knowledge graph      | `graphiti`, `neo4j`                                                                                                                                            | `docker-compose-graphiti.yml`      |
| LLM observability    | `langfuse-web`, `langfuse-worker`, `clickhouse`, `redis`, `minio`, `postgres`                                                                                  | `docker-compose-langfuse.yml`      |
| System observability | `grafana`, `otel`, `victoriametrics`, `jaeger`, `clickstore`, `loki`, `node-exporter`, `cadvisor`                                                              | `docker-compose-observability.yml` |

[Tools](https://pentagi.com/docs/glossary/#tool) never run inside the `pentagi` container itself: every flow gets its own [sandbox](https://pentagi.com/docs/glossary/#sandbox) container, built from an image picked for the flow's goal, such as Kali Linux.

## [Containers](https://pentagi.com/docs/concepts/architecture/#containers)

```mermaid
graph TB
  accTitle: Containers of the core stack and the optional knowledge graph
  subgraph Core
    UI[Web UI] -->|HTTP/WS| API[Backend API]
    API --> DB[(PostgreSQL + pgvector)]
    API --> Agents[Agents]
    Agents --> Sandbox[Sandboxed tools]
    Agents --> Scraper[Isolated browser]
  end
  subgraph Knowledge graph
    Graphiti --> Neo4j[(Neo4j)]
  end
  Agents --> Graphiti
  API -->|telemetry| OTEL[OpenTelemetry]
  API -->|LLM traces| Langfuse
```

* **Backend API** — Go, with REST and GraphQL and Bearer-token access for automation.
* **Vector store** — PostgreSQL with pgvector keeps every command, output and embedding.
* **Agents** — the multi-agent system that plans and executes the work; see [Agents](https://pentagi.com/docs/concepts/agents/).
* **Sandbox** — tool containers isolated from the host; in production they can live on a separate [worker node](https://pentagi.com/docs/deployment/worker-node/).