\n\n\n \n \n\n\n# Ground Control (GCTRL)\n\n### The knowledge-infrastructure layer for enterprise AI.\n**Ground your data. Command your AI.**\n\n[](https://github.com/GCTRL-TECH/platform/actions/workflows/build-push.yml)\n[](./LICENSE)\n[](#-quick-start)\n[](#-access-control--compliance)\n[](#-quick-start)\n\n
\n\n---\n\nGCTRL turns your scattered documents, databases, and code into **one governed knowledge graph** — then grounds your LLMs and agents on it, with enterprise-grade access control, **entirely on your own infrastructure**.\n\nMost \"AI memory\" is a pile of vector chunks: fuzzy recall, no structure, no provenance, no permissions. GCTRL is **graph-native** — entities, typed relations, dossiers, and hybrid retrieval — and it runs **100% locally**, so nothing leaves your building.\n\n> **The pitch in one line:** point GCTRL at your data, get a governed knowledge graph, and let any agent (Claude Code, Cursor, Codex…) read and write it as durable, access-controlled memory.\n\n---\n\n## ✨ Why GCTRL\n\n- **🕸️ Graph-native, not a vector blob.** Entities, typed relations, entity *dossiers*, and hybrid retrieval (dense + keyword + graph traversal) — with provenance on every fact. Ask *\"how does X connect to Y?\"* and get a real answer, not a fuzzy guess.\n- **🔒 100% self-hosted, local inference.** Runs on your hardware with local Ollama. DSGVO/GDPR by design — RAG sessions live in browser memory, no conversation is stored server-side, no data leaves your network.\n- **🛡️ Access control built for the enterprise.** Per-element classification and clearance, scoped colleague tokens, airtight multi-project isolation, and a full audit trail. Designed ISO 27001-aware, with TISAX Level 3 as the north star.\n- **🤖 Drop into any agent.** One MCP config and Claude Code, Cursor, Codex, or any MCP client gets durable, governed, graph-native memory — plus a built-in **Pi** agent.\n- **⚙️ Self-maintaining memory.** Heat/decay/trust scoring, semantic dedup, community detection, and an auto-curated wiki keep the graph clean and useful over time.\n- **🎯 Near-SOTA entity resolution — unsupervised and on-device.** The fusion core resolves duplicates and contradictions across systems without labels and without the cloud.\n\n---\n\n## 🧩 The platform\n\nGCTRL is four modules over one graph, plus an agent layer:\n\n| Module | What it does |\n|---|---|\n| **KEX** — Knowledge Extraction | Point it at PDFs, docs, plain text, or a **code repo** → it extracts entities and typed relations into the graph. Local NER + local relation extraction, zero cloud. Code is parsed via AST into files/classes/functions/imports/calls. |\n| **FUSE** — Knowledge Fusion | Merge many sources and graphs into one **canonical** graph. Deterministic entity resolution and link discovery reconcile duplicates and contradictions across systems. |\n| **Manage KGs** | Organize knowledge into compilations, schedule incremental or full refreshes, and gate every node, edge, and chunk by clearance level. |\n| **Talk-to-Graph** | GDPR-compliant RAG over your graph. Local inference; sessions stay in browser memory — **no server-side conversation storage.** |\n| **Pi + MCP gateway** | A built-in agent, plus an MCP server so external agents get governed memory: `store`, `query`, `get_dossier`, `search_entities`, `get_neighbors`, `shortest_path`, `ingest_repo`, and more. |\n\n---\n\n## 🚀 Quick start\n\nOne command brings up the whole stack:\n\n```bash\ncurl -fsSL https://gctrl.tech/install | bash\n```\n\nWhen it finishes, open the dashboard at **`http://localhost:3001`** and create your admin account. The installer detects what you already run (graph store, vector store, local LLM), deploys only what's missing, and pulls a local model so you can start immediately.\n\nFull walkthrough — install → connect a model → activate a license → connect an agent → ingest your first PDF: **[gctrl.tech/docs/quickstart](https://gctrl.tech/docs/quickstart)**.\n\nUninstall (keep data) / full reset:\n\n```bash\ncurl -fsSL https://gctrl.tech/uninstall | bash # keep your data\ncurl -fsSL https://gctrl.tech/uninstall | bash -s -- --purge # wipe everything\n```\n\n---\n\n## 🔌 Connect your agent (MCP)\n\nGive any MCP-capable agent durable, access-controlled memory over your graph. Generate a scoped token in **Settings → Agent**, then drop this into Claude Code, Cursor, Codex, or Claude Desktop:\n\n```jsonc\n{\n \"mcpServers\": {\n \"gctrl\": {\n \"type\": \"http\",\n \"url\": \"http://localhost:4000/api/agent/mcp\",\n \"headers\": { \"Authorization\": \"ApiKey YOUR_TOKEN\" }\n }\n }\n}\n```\n\nYour agent now reads and writes a real knowledge graph — scoped to exactly what its token is cleared for. See **[Agents & MCP](https://gctrl.tech/docs/agents-mcp)**.\n\n---\n\n## 🛡️ Access control & compliance\n\nGCTRL is built for regulated, multi-tenant environments:\n\n- **Per-element classification.** Every node, edge, chunk, and wiki page carries its own clearance level — enforced at query time, not by a folder rule someone can forget.\n- **Airtight project isolation.** Scope a colleague's (or agent's) token to specific knowledge bases. An agent on Client A's project literally cannot retrieve, cite, or leak Client B's data — not even by accident.\n- **GDPR by design.** Local inference, browser-memory chat sessions, opt-in and erasable personalization.\n- **Audit trail.** Token, action, resource, outcome — every grant and every denial is logged.\n\nDesigned ISO 27001-aware, aimed at TISAX Level 3 readiness. See **[Access Control](https://gctrl.tech/docs/access-control)** and **[Compliance & Sovereignty](https://gctrl.tech/docs/compliance)**.\n\n---\n\n## 📊 Benchmarks\n\nThe fusion core (entity resolution / link discovery) is competitive with **supervised** state-of-the-art — while running **unsupervised and fully on-device**:\n\n| Task | GCTRL (unsupervised, local) | Supervised SOTA |\n|---|--:|--:|\n| Clean structured records (DBLP-ACM) | **F1 0.967 – 0.976** | ~0.989 |\n| Dirty textual records (Abt-Buy) | **F1 0.866** | ~0.891 |\n\nNo labels, no cloud, your data never leaves the machine. More in **[Benchmarks](https://gctrl.tech/docs/benchmarks)**.\n\n---\n\n## 🏗️ Architecture\n\n```mermaid\nflowchart LR\n subgraph SRC[Your sources]\n P[PDFs / Docs]\n R[Code repos]\n C[Drive · SharePoint · Obsidian · APIs]\n end\n\n P & R & C --> KEX[KEX · extraction]\n KEX --> NEO[(Neo4j · graph)]\n KEX --> QD[(Qdrant · vectors)]\n FUSE[FUSE · fusion + entity resolution] --> NEO\n\n NEO --> RAG[Talk-to-Graph · local RAG]\n NEO --> WIKI[Auto-curated wiki]\n\n MCP[MCP gateway] --> AG[Claude Code · Cursor · Codex · Pi]\n RAG --> AG\n NEO -. per-element clearance .-> RAG\n NEO -. per-element clearance .-> MCP\n```\n\nA Rust control plane orchestrates Python extraction/fusion workers, a React UI, and local inference — all over Docker Compose.\n\n---\n\n## 🧪 Tech stack\n\n- **Control plane:** Rust (Axum) API + agent sidecar\n- **Workers:** Python (KEX extraction, FUSE fusion)\n- **Frontend:** React + Vite (dashboard + license portal)\n- **Stores:** Neo4j (graph) · Qdrant (vectors) · PostgreSQL · Redis\n- **Inference:** local Ollama by default; switchable to llama.cpp, vLLM, MLX / oMLX (Apple Silicon) or any OpenAI-compatible `/v1` endpoint\n- **Packaging:** Docker Compose, one-line installer\n\n---\n\n## 📚 Documentation\n\nFull docs at **[gctrl.tech/docs](https://gctrl.tech/docs)**:\n\n- [Quick Start](https://gctrl.tech/docs/quickstart) · [Installation](https://gctrl.tech/docs/installation)\n- [Architecture](https://gctrl.tech/docs/architecture) · [The Four Modules](https://gctrl.tech/docs/modules) · [Memory Layers](https://gctrl.tech/docs/memory-layers)\n- [Agents & MCP](https://gctrl.tech/docs/agents-mcp) · [Access Control](https://gctrl.tech/docs/access-control) · [Compliance](https://gctrl.tech/docs/compliance)\n- [Benchmarks](https://gctrl.tech/docs/benchmarks) · [FAQ & Troubleshooting](https://gctrl.tech/docs/faq)\n\n---\n\n## ⚠️ Before production — change the default secrets\n\nThe bundled compose files ship with **well-known placeholder secrets** (`POSTGRES_PASSWORD`, `NEO4J_PASSWORD`, `JWT_SECRET`, …) so GCTRL runs out of the box on localhost. **Set your own real values** (via a local `.env`, never committed) before exposing GCTRL to a network. A predictable `JWT_SECRET` lets anyone forge admin tokens; default DB passwords are public knowledge.\n\n---\n\n## 📄 License\n\nGCTRL is **dual-licensed**:\n\n- **Open source — GNU AGPL-3.0** ([`LICENSE`](./LICENSE)): free to use, modify, and self-host, as long as your own stack stays open under the AGPL.\n- **Commercial license**: for proprietary / closed-source or hosted use **without** AGPL copyleft obligations.\n\nSee **[`LICENSING.md`](./LICENSING.md)** for what each option allows and how to obtain a commercial license.\n\n---\n\n## 🙏 Built with\n\nGCTRL stands on excellent open-source work. Full third-party notices and licenses: **[`docs/LICENSES.md`](./docs/LICENSES.md)**.\n\nNeo4j · Qdrant · Ollama · GLiNER · Qwen · PostgreSQL · Redis · React · Rust / Axum · FastAPI · LIMES.\n\n---\n\n
![\"GCTRL\"](\".github/assets/logo-horizontal-dark.svg\"){kind=logo}
\n