Integrations overview

Every system MAQPNA connects to, from identity providers and SPIRE to OpenTelemetry, SIEMs, secret vaults, chat notifications, sandboxes, model providers, policy engines and clouds, and where each one plugs in.

MAQPNA governs agents at one point, the MAQPNA gateway, and keeps its own identity broker, operator and audit ledger. Everything else is something you already run: your identity provider, your observability stack, your SIEM, your key manager, your model providers and your clouds. This page lists every integration that exists in the code today, grouped by what it does, and links to the page that sets it up.

All outbound connections from the gateway (identity provider discovery, SIEM, collector, notifier, model and cloud calls) go through its residency-checked dialer. With a sovereignty policy, each endpoint must be allowed there.

Where integrations plug in#

flowchart LR
    subgraph People
      IDP["Identity provider<br/>Keycloak, Entra ID, Okta"]
      CHAT["Slack, Teams,<br/>Matrix, webhook"]
    end
    subgraph Cluster["Your cluster"]
      OP["MAQPNA operator"]
      BR["Identity broker"]
      GW["MAQPNA gateway"]
      SB["Sandbox<br/>gVisor, Kata, CoCo, kosa8"]
      SP["SPIRE"]
    end
    subgraph Upstreams
      MCP["MCP servers"]
      LLM["Model providers<br/>Bedrock, Vertex, Azure, llamay"]
    end
    subgraph Evidence
      OTEL["OTel Collector"]
      SIEM["SIEM<br/>Splunk, Sentinel, SecOps, CloudWatch"]
      WORM[("WORM storage")]
      REKOR["Rekor"]
    end
    KMS["KMS, Vault Transit,<br/>secret managers"]
    IDP -->|"OIDC, CIBA"| GW
    GW -->|"approvals, alerts"| CHAT
    OP --> SB
    SP -->|"X.509-SVID"| SB
    BR -->|"session token"| SB
    SB -->|"governed calls"| GW
    GW --> MCP
    GW --> LLM
    GW -->|"OTLP"| OTEL
    GW -->|"audit sinks"| SIEM
    GW --> WORM
    GW -->|"anchors"| REKOR
    KMS -->|"keys, secrets"| GW
    KMS --> BR

Identity and sign-in#

Workload identity#

Telemetry#

SIEM and audit evidence#

Secrets and keys#

Notifications#

Sandboxes#

Models and agent frameworks#

Policy engines#

Clouds and configuration delivery#

Next steps#

• Keycloak and OIDC single sign-on
• OpenTelemetry traces and metrics
• SIEM and audit forwarding
• Solution architecture