---
title: "Technical documentation — CENNTIR"
url: https://cenntir.com/en/documentation/
lang: en
---

# What to know before installing.

For IT teams and integrators: architecture, network, systems, security and limits, with the status of each element.

- [Architecture](https://cenntir.com/en/documentation/#architecture)
- [Network flows](https://cenntir.com/en/documentation/#network)
- [Supported systems](https://cenntir.com/en/documentation/#systems)
- [Installation and updates](https://cenntir.com/en/documentation/#installation)
- [Permissions, approvals and log](https://cenntir.com/en/documentation/#permissions)
- [Equipment control](https://cenntir.com/en/documentation/#equipment)
- [AI assistants](https://cenntir.com/en/documentation/#ai)
- [Network audit](https://cenntir.com/en/documentation/#audit)
- [Hosting and data](https://cenntir.com/en/documentation/#data)
- [Known limits](https://cenntir.com/en/documentation/#limits)

## Architecture

Four building blocks, the same in every sector.

Console, CLI or AI assistant HTTPS → Hub ← WSS Agent → Machine or equipment

- **Agent.** Installed on each controlled machine, it runs what the hub assigns and decides nothing. It opens a single outbound connection to the hub.
- **Hub.** Identities, permissions, approvals, audit log, web console and distribution of signed updates. Postgres database, isolated organisations.
- **Console.** Machines, calls, access keys, permissions, approvals, schedules and logs. Named accounts, optional second factor.
- **Assistants and scripts.** An AI assistant connects through a local MCP bridge; a command-line tool offers the same operations for scripts.

## Network flows

- Each agent opens an **outbound** encrypted WebSocket connection (WSS) to the hub on port 443. No inbound port is required on site.
- Corporate HTTP proxies (CONNECT method) are not supported: direct outbound access to the hub on 443 must be allowed.
- Console, command line and assistants reach the hub over HTTPS. TLS 1.2 and 1.3, terminated by the reverse proxy in front of the hub.
- The hub is the control point: it sees the traffic to enforce permissions, approvals and the log. There is no end-to-end encryption between the operator and the agent.
- Encryption between the agent and a device depends on that device’s protocol.

## Supported systems

| System | Installation | Capabilities | Limits | Status |
|---|---|---|---|---|
| macOS (Apple Silicon) | User agent or system service | Commands, files, transfers, screen (capture and input), Office, connectors | macOS permissions to grant once, on site | Available |
| Windows 10, 11 and Server | Two agents: system service and user session | Commands, files, transfers, screen, Office, connectors | Only the session agent sees the desktop; locked workstation, input refused | Available |
| Windows 7 SP1 and Server 2008 R2 | Dedicated binary | Core Windows capabilities | .NET 4.6.2, PowerShell 5.1 and TLS 1.2 required | Available |
| Linux x86-64 and ARM64 | systemd service | Commands, files, transfers, connectors | No on-screen actions, no Office | Available |
| Android 10 and later: phones, tablets, TV | App, with a short code on TV | Commands, files, connectors, local interfaces | No remote screen control; updated through the app | Available |
| KVM-over-IP boxes | Agent installed on the box | Keyboard, screen and mouse of the connected computer | Running on GL.iNet Comet; JetKVM partially validated; PiKVM to be qualified; input injection disabled by default | Available |
| ESP32-S3 boards | Dedicated firmware: USB, then updates over Wi-Fi | Pins, readings, screens, network discovery | No system commands or files; signed images only | Available |
| iPhone and iPad | App distributed outside the App Store | Connectors, room interfaces | No system commands (iOS sandbox) | Trial |
| OpenWrt routers (MIPS) | Dedicated binary | Core Linux capabilities | Router tests in progress | In progress |

## Installation and updates

- An administrator creates an **enrolment code** in the console (“Add a machine”). It is single-use and valid from 10 minutes to 24 hours.
- The installer exchanges this code for the machine’s identity and a token of its own. This token only connects the agent and grants no control power.
- On Android TV, the app shows a short code to approve in the console.
- Updates follow a signed manifest (Ed25519) with downgrade protection, one machine at a time, starting with a canary machine. On Android they go through the app; they are not automatic on KVM boxes.

## Permissions, approvals and log

An access key starts with no permission; each action is enabled machine by machine. Some equipment write operations require approval in the console, with a one-time code depending on the policy. Every call leaves a line in the hub’s audit log. Details are on the [Security and traceability](https://cenntir.com/en/security/) page.

## Equipment control

- A connector engine on the agent controls the site’s equipment from **device profiles**: a profile describes the operations of a model, without recompiling the agent.
- Available transports: text over TCP, JSON-RPC, HTTP and HTTPS, SSH, UDP, Wake-on-LAN, and persistent TCP, TLS or UDP sessions.
- Local policy per environment (lab, staging, production), impact levels, one-time code for sensitive writes, local log written before each effect. Operations that declare it read the state back after writing.
- Some profiles are proven on emulator, others are still under study. Building and IoT protocols (BACnet, Modbus, KNX, MQTT, serial links) go through a bridge developed and qualified per project.

## AI assistants

- The AI client (Claude Code, Codex or any MCP client) launches a local MCP bridge that talks to the hub over HTTPS.
- The assistant only has the machines and tools enabled for its key. Assistant keys expire after 90 days at most and are never more powerful than the account that creates them.
- You choose the AI model; its own data-use terms apply.

## Network audit

- Bounded TCP inventory: explicit addresses and ports, limited concurrency and timeouts.
- Local network neighbours (ARP cache on Linux) and the machine’s network information.
- Four SNMPv2c system reads, and testing of one HTTP credential pair supplied by the operator.
- It is an inventory tool, not a vulnerability scanner.

## Hosting and data

- Hub hosted and operated by us. Installation on your own server is possible as a project; it is not yet delivered as a turnkey package.
- Command results stay on the hub for at most six hours. The full command log, if enabled, keeps masked arguments and outputs for 90 days by default.
- Equipment secrets are resolved on the agent; an encrypted vault in the hub can also hold some, with logged reads.

## Known limits

- No single sign-on (SSO) or hardware keys (WebAuthn) for the console yet.
- No turnkey high availability for the hub.
- Windows code signing (Authenticode) and macOS notarisation not yet in place.
- Corporate HTTP proxies not supported for the link to the hub.

## A technical review with your team?

We walk through the architecture, the flows and the log on a demo instance.

[Book a technical review](https://cenntir.com/en/contact/)