~/projects/strativ-context-engine
Strativ AB · internal platform ("Open Brain"), also sold to clients
Multi-tenant AI knowledge base that lets Claude and other MCP clients search and reason over each project's docs, meeting notes and decisions. Built for every Strativ project and now also sold to clients.
Internally called Open Brain. Each tenant gets its own Supabase project with a pgvector store. Markdown docs pushed to a tenant's docs repo are chunked, enriched and embedded automatically, and an MCP server running as a Supabase Edge Function exposes search, browse, capture and other tools to AI clients such as Claude. A Next.js admin portal manages users, projects and access, and runs its own OAuth 2.1 flow so MCP clients get project-scoped tokens.
Every client project has its own Supabase database, auth users and AI provider key. There is no shared fallback key, so a missing key fails loudly instead of billing another tenant, and a pre-deploy check blocks releases with uncovered tenants.
Merging to main fans out one GitHub Actions job per tenant: run SQL migrations, deploy the MCP Edge Function and smoke-test tools/list. Code changes roll out to every tenant; registry-only changes deploy just the affected ones.
On every push, only changed markdown files are processed. Files are chunked by heading, enriched with category, tags and summary, embedded (1536-dim) and upserted atomically. Deleted files are purged, and pure renames move rows without re-embedding.
Search embeds the query, runs a combined pgvector and full-text query, then reranks with an LLM. Results are de-noised and neighbouring chunks are stitched back together so answers keep their context.
Each JSON-RPC call is rate-limited, JWT-verified and checked against the token's project binding and access level (read, write, admin) before one of nine tools runs, including search, capture and knowledge-gap tracking.
A custom OAuth 2.1 server in the admin portal issues project-scoped tokens to MCP clients. Assigning a user to a project provisions a real account in that tenant's database automatically.
Dashed edges are CI and provisioning. One merge deploys to every tenant in parallel.
Only files changed in the push are processed; renames are moved in the database without re-embedding.
The Next.js control plane. Project assignment provisions accounts in the tenant database; MCP clients authorise through OAuth.
Every tool call passes rate limiting, token verification and project-level authorisation before it runs.