Technical overview · for IT, security and platform teams

Architecture, tool surface, security model

Architecture shape, tool surface, integration patterns, security model and deployment options. Companion to the plain-language business brief.

What it is.

Sitebridge is an AI cobrowsing agent: a model-driven runtime that operates the user's real browser session (cookies, SSO, bookmarks intact) rather than a headless cloud sandbox. The user watches every action; pre-action approval, pause/takeover, and full undo are first-class.

Reach beyond the page is provided by an MCP (Model Context Protocol) tool surface that can federate connected internal tool servers — so the agent is not limited to DOM automation alone.

Architecture — four layers.

1.Browser / client

User's real browser. Live cobrowse channel streams DOM + cursor. Human-in-the-loop controls (approve, pause, takeover, undo) sit here.

2.Agent runtime + MCP server

Task planner, tool router, and Sitebridge MCP server (MIT). Exposes browser actions and federated tool calls as a stable tool surface.

3.Model gateway

LiteLLM (MIT) multi-provider gateway. Routes by task complexity — cheap models for click/find, frontier models for hard reasoning. Failover across Anthropic / OpenAI / Gemini / xAI / open-weights.

4.Data + observability plane

PostgreSQL + pgvector for tenant overlays and the scrubbed pattern library. Langfuse (MIT) for traces: every model call and MCP tool call tagged. Audit log per tenant for action history and undo.

MCP tool surface.

Stable categories — the exact catalogue evolves, so treat this as the contract shape.

Navigation & DOM

goto, click, type, select, scroll, wait-for, screenshot, accessibility tree.

Session

Read cookies/storage only as needed for the live session; never exfiltrate credentials to the model.

Federation

Call connected MCP tool servers (internal APIs, ticket systems, docs) under the same policy envelope.

Safety

Pre-action policy checks, allow/deny lists, step-level audit, undo stack.

Security model.

EU data residency by default

Compute and storage on Hetzner Cloud (Helsinki / Nuremberg / Falkenstein). German operator. No US data plane for the control path we operate.

Credentials stay out of the model

The agent drives an already-authenticated browser. Passwords, vault refs and bearer tokens are stripped by a secret guard before anything is logged or pooled.

Cross-tenant learning wall

Two namespaces in pgvector: tenant overlay (private) and pattern library (cross-tenant). Patterns enter the library only after scrubbing (secret guard → selector normalizer → prompt fingerprinter) and k-anonymity ≥ 5. Form values, IDs and names never pool. Per-tenant audit of what crossed.

Human control

Pre-action approval for sensitive steps, live pause/takeover, and undoable action history. Designed so ops and security can answer “what did it do?” with a grep, not a guess.

Optional self-host / VPC

The same MCP interface can route inference to on-prem open-weights (Llama / Qwen / Mistral) so regulated workloads never leave the VPC.

Integration patterns.

Day-0 — no integration

User opens their browser, starts a Sitebridge session, describes the task. Works against any web UI the user can already reach.

SSO onboarding

Fleet users land via SSO — no per-user API-key dance across model vendors. One product subscription covers model access, agent runtime and the MCP layer.

MCP federation

Point Sitebridge at internal MCP tool servers for systems that should not be driven only through the UI, or that expose richer APIs. Policy and audit wrap federated calls the same way as browser actions.

Observability hook-up

Langfuse traces are exportable; LiteLLM virtual keys give per-team budgets, rate limits and spend attribution.

Deployment.

Managed EU SaaS is the default (Hetzner). Self-host / VPC deployment is supported for customers who need inference and storage fully inside their boundary. Every layer above the metal is open-source software your engineers can read: LiteLLM, Langfuse, pgvector, the Sitebridge MCP server — MIT / PostgreSQL license.

Procurement shape: one contract, one DPA/AVV, one invoice. Upstream multi-model vendor complexity stays on our side of the fence.

Where to go next.

Public landing — plain-language overview.
Stack deep-dive — diagrams and request flow.
Capability matrix — versus Claude-for-Chrome, Playwright MCP, Browser MCP.
Objections — security and ops pushback, answered.

Technical follow-up: hello@agiliton.eu