Architecture¶

System Overview¶

AgentCube is an AI middleware platform that enables AI assistants to securely interact with enterprise data in real-time. It implements the Model Context Protocol (MCP) — an open standard for connecting AI platforms to enterprise data sources.

graph LR
    subgraph "AI Platform"
        AI["AI Assistant<br/>(Claude, ChatGPT, Copilot,<br/>Gemini, Grok, etc.)"]
    end

    subgraph "AgentCube Middleware"
        direction TB
        E["Essbase<br/>Adapter"]
        P["Planning<br/>Adapter"]
    end

    subgraph "Data Sources"
        OE["Oracle<br/>Essbase 21c"]
        OP["Oracle EPM<br/>Planning Cloud"]
    end

    AI -- "MCP (HTTPS)" --> E
    AI -- "MCP (HTTPS)" --> P
    E -- "REST API (HTTPS)" --> OE
    P -- "REST API (HTTPS)" --> OP

How it works:

1. A user asks a question in their AI platform (e.g., "What was Q4 revenue for North America?")
2. The AI assistant determines which AgentCube tools to call and with what parameters
3. AgentCube securely connects to the target data source and executes the request
4. The data source returns results, applying its native security and entitlements
5. The AI assistant receives the data and presents it to the user

AgentCube bridges the gap between AI assistants and enterprise data, providing secure, governed access while respecting the entitlement model of each data source.

Model Context Protocol (MCP)¶

MCP is an open protocol that standardizes how AI assistants connect to external data sources. AgentCube implements the MCP server specification, which means any MCP-compatible AI platform can connect to it without custom integration.

sequenceDiagram
    participant User
    participant AI as AI Assistant
    participant AC as AgentCube
    participant DS as Data Source

    User->>AI: "Show revenue by product for Q4"
    AI->>AC: list_applications()
    AC->>DS: GET /applications
    DS-->>AC: [AppA, AppB, ...]
    AC-->>AI: Application list
    AI->>AC: query_data_grid(app, accounts, periods, ...)
    AC->>DS: POST /exportdataslice
    DS-->>AC: Grid data (security-filtered)
    AC-->>AI: Data response
    AI-->>User: "Here's the Q4 revenue breakdown..."

Because MCP is an open standard, you are not locked into a specific AI platform. The same AgentCube deployment works with Claude, ChatGPT, Microsoft Copilot, Gemini, and any other client that supports MCP.

Adapters¶

AgentCube currently provides separate adapters for each target data source. Each adapter is a standalone, independently deployed service.

Each adapter exposes a set of tools that the AI assistant can call. Tools range from metadata discovery (listing applications, exploring dimensions) to data retrieval (querying financial data, running MDX).

Deployment Architecture¶

AgentCube adapters are packaged as Linux containers and can run on any container hosting platform.

graph TB
    subgraph "Your Network / Cloud"
        subgraph "Container Platform"
            E["Essbase Adapter"]
            P["Planning Adapter"]
        end
        subgraph "Data Sources"
            OE["Essbase 21c"]
            OP["Planning Cloud"]
        end
        E -- "REST API" --> OE
        P -- "REST API" --> OP
    end

    subgraph "External"
        AI["AI Platform"]
        IdP["Identity Provider"]
    end

    AI -- "MCP over HTTPS" --> E
    AI -- "MCP over HTTPS" --> P
    AI -. "SSO Auth" .-> IdP
    E -. "Token Validation" .-> IdP

Key deployment characteristics:

• Containerized — Standard Linux containers (Docker, Kubernetes, Azure Container Apps, AWS ECS, etc.)
• Lightweight — Minimal resource requirements (0.25 vCPU, 0.5 GiB memory per connector)
• Stateless — No persistent storage required. No local database. Connectors can be restarted or scaled without data loss.
• TLS termination — Connectors serve HTTP on port 8080. TLS is handled by your hosting platform's ingress layer (load balancer, reverse proxy, etc.)
• Independent — Each connector is deployed and versioned separately. You can run Essbase without Planning, or vice versa.

Security Architecture¶

AgentCube is designed around the principle that data access entitlements are enforced at the source. AgentCube manages identity and secure connectivity — the underlying data source governs what each user can see.

Authentication Modes¶

graph LR
    subgraph "Basic Auth Mode"
        direction LR
        AI1["AI Platform"] -->|"MCP"| AC1["AgentCube"]
        AC1 -->|"Service Account<br/>Credentials"| O1["Data Source"]
    end

graph LR
    subgraph "SSO Mode"
        direction LR
        AI2["AI Platform"] -->|"User authenticates<br/>via OIDC"| AC2["AgentCube"]
        AC2 -->|"Per-user<br/>token"| O2["Data Source"]
    end

SSO Data Flow¶

In SSO mode, each user authenticates with their corporate identity. AgentCube passes that identity through to the data source, ensuring its native row-level and application-level security is enforced.

sequenceDiagram
    participant User
    participant AI as AI Platform
    participant IdP as Identity Provider
    participant AC as AgentCube
    participant DS as Data Source

    User->>AI: Connect to AgentCube
    AI->>IdP: Redirect to SSO login
    IdP-->>AI: Identity token ([email protected])
    AI->>AC: MCP request + identity token
    AC->>AC: Exchange identity for data source token
    AC->>DS: API call + authenticated token
    DS-->>AC: Data (filtered by user entitlements)
    AC-->>AI: Response
    AI-->>User: Results (only data user is entitled to)

Security Principles¶

• Sensitive data is not stored — AgentCube does not store, cache, or persist your financial or business data. Metadata may be cached to improve performance, but sensitive transactional data flows directly from the data source to the AI session.
• Source-native authorization — AgentCube does not implement its own authorization rules. If a user cannot see data in the underlying data source, they cannot see it through AgentCube.
• Encrypted in transit — All communication uses HTTPS (TLS). MCP traffic between AI platforms and AgentCube, and API traffic between AgentCube and data sources, are encrypted end-to-end.
• No AI training — Data retrieved through AgentCube is not used to train AI models. It flows from the data source to the AI session and nowhere else.

Supported Platforms¶

Data Sources Currently Supported¶

AI Platforms¶

Any platform that supports the Model Context Protocol (MCP), including:

• Anthropic Claude (claude.ai, Claude Code)
• OpenAI ChatGPT
• Microsoft Copilot Studio
• Google Gemini
• Other MCP-compatible clients

Container Platforms¶

Any platform that runs Linux containers:

• Azure Container Apps
• AWS ECS / Fargate
• Google Cloud Run
• Kubernetes (AKS, EKS, GKE, self-hosted)
• Docker (local or server)

Identity Providers (SSO Mode)¶

Any OIDC-compliant identity provider:

• Microsoft Entra ID (Azure AD)
• Okta
• Auth0
• Keycloak
• Ping Identity
• Any provider supporting OAuth 2.0 / OpenID Connect