Ground Control (GCTRL)

The knowledge-infrastructure layer for enterprise AI.

Ground your data. Command your AI.

GCTRL turns your scattered documents, databases, and code into one governed knowledge graph — then grounds your LLMs and agents on it, with enterprise-grade access control, entirely on your own infrastructure.

Most "AI memory" is a pile of vector chunks: fuzzy recall, no structure, no provenance, no permissions. GCTRL is graph-native — entities, typed relations, dossiers, and hybrid retrieval — and it runs 100% locally, so nothing leaves your building.

The pitch in one line: point GCTRL at your data, get a governed knowledge graph, and let any agent (Claude Code, Cursor, Codex…) read and write it as durable, access-controlled memory.

✨ Why GCTRL

• 🕸️ Graph-native, not a vector blob. Entities, typed relations, entity dossiers, and hybrid retrieval (dense + keyword + graph traversal) — with provenance on every fact. Ask "how does X connect to Y?" and get a real answer, not a fuzzy guess.
• 🔒 100% self-hosted, local inference. Runs on your hardware with local Ollama. DSGVO/GDPR by design — RAG sessions live in browser memory, no conversation is stored server-side, no data leaves your network.
• 🛡️ Access control built for the enterprise. Per-element classification and clearance, scoped colleague tokens, airtight multi-project isolation, and a full audit trail. Designed ISO 27001-aware, with TISAX Level 3 as the north star.
• 🤖 Drop into any agent. One MCP config and Claude Code, Cursor, Codex, or any MCP client gets durable, governed, graph-native memory — plus a built-in Pi agent.
• ⚙️ Self-maintaining memory. Heat/decay/trust scoring, semantic dedup, community detection, and an auto-curated wiki keep the graph clean and useful over time.
• 🎯 Near-SOTA entity resolution — unsupervised and on-device. The fusion core resolves duplicates and contradictions across systems without labels and without the cloud.

🧩 The platform

GCTRL is four modules over one graph, plus an agent layer:

🚀 Quick start

One command brings up the whole stack:

curl -fsSL https://gctrl.tech/install | bash

When it finishes, open the dashboard at http://localhost:3001 and create your admin account. The installer detects what you already run (graph store, vector store, local LLM), deploys only what's missing, and pulls a local model so you can start immediately.

Full walkthrough — install → connect a model → activate a license → connect an agent → ingest your first PDF: gctrl.tech/docs/quickstart.

Uninstall (keep data) / full reset:

curl -fsSL https://gctrl.tech/uninstall | bash               # keep your data
curl -fsSL https://gctrl.tech/uninstall | bash -s -- --purge  # wipe everything

🔌 Connect your agent (MCP)

Give any MCP-capable agent durable, access-controlled memory over your graph. Generate a scoped token in Settings → Agent, then drop this into Claude Code, Cursor, Codex, or Claude Desktop:

{
  "mcpServers": {
    "gctrl": {
      "type": "http",
      "url": "http://localhost:4000/api/agent/mcp",
      "headers": { "Authorization": "ApiKey YOUR_TOKEN" }
    }
  }
}

Your agent now reads and writes a real knowledge graph — scoped to exactly what its token is cleared for. See Agents & MCP.

🛡️ Access control & compliance

GCTRL is built for regulated, multi-tenant environments:

• Per-element classification. Every node, edge, chunk, and wiki page carries its own clearance level — enforced at query time, not by a folder rule someone can forget.
• Airtight project isolation. Scope a colleague's (or agent's) token to specific knowledge bases. An agent on Client A's project literally cannot retrieve, cite, or leak Client B's data — not even by accident.
• GDPR by design. Local inference, browser-memory chat sessions, opt-in and erasable personalization.
• Audit trail. Token, action, resource, outcome — every grant and every denial is logged.

Designed ISO 27001-aware, aimed at TISAX Level 3 readiness. See Access Control and Compliance & Sovereignty.

📊 Benchmarks

The fusion core (entity resolution / link discovery) is competitive with supervised state-of-the-art — while running unsupervised and fully on-device:

No labels, no cloud, your data never leaves the machine. More in Benchmarks.

🏗️ Architecture

flowchart LR
  subgraph SRC[Your sources]
    P[PDFs / Docs]
    R[Code repos]
    C[Drive · SharePoint · Obsidian · APIs]
  end

  P & R & C --> KEX[KEX · extraction]
  KEX --> NEO[(Neo4j · graph)]
  KEX --> QD[(Qdrant · vectors)]
  FUSE[FUSE · fusion + entity resolution] --> NEO

  NEO --> RAG[Talk-to-Graph · local RAG]
  NEO --> WIKI[Auto-curated wiki]

  MCP[MCP gateway] --> AG[Claude Code · Cursor · Codex · Pi]
  RAG --> AG
  NEO -. per-element clearance .-> RAG
  NEO -. per-element clearance .-> MCP

A Rust control plane orchestrates Python extraction/fusion workers, a React UI, and local inference — all over Docker Compose.

🧪 Tech stack

• Control plane: Rust (Axum) API + agent sidecar
• Workers: Python (KEX extraction, FUSE fusion)
• Frontend: React + Vite (dashboard + license portal)
• Stores: Neo4j (graph) · Qdrant (vectors) · PostgreSQL · Redis
• Inference: local Ollama by default; switchable to llama.cpp, vLLM, MLX / oMLX (Apple Silicon) or any OpenAI-compatible /v1 endpoint
• Packaging: Docker Compose, one-line installer

📚 Documentation

Full docs at gctrl.tech/docs:

• Quick Start · Installation
• Architecture · The Four Modules · Memory Layers
• Agents & MCP · Access Control · Compliance
• Benchmarks · FAQ & Troubleshooting

⚠️ Before production — change the default secrets

The bundled compose files ship with well-known placeholder secrets (POSTGRES_PASSWORD, NEO4J_PASSWORD, JWT_SECRET, …) so GCTRL runs out of the box on localhost. Set your own real values (via a local .env, never committed) before exposing GCTRL to a network. A predictable JWT_SECRET lets anyone forge admin tokens; default DB passwords are public knowledge.

📄 License

GCTRL is dual-licensed:

• Open source — GNU AGPL-3.0 (LICENSE): free to use, modify, and self-host, as long as your own stack stays open under the AGPL.
• Commercial license: for proprietary / closed-source or hosted use without AGPL copyleft obligations.

See LICENSING.md for what each option allows and how to obtain a commercial license.

🙏 Built with

GCTRL stands on excellent open-source work. Full third-party notices and licenses: docs/LICENSES.md.

Neo4j · Qdrant · Ollama · GLiNER · Qwen · PostgreSQL · Redis · React · Rust / Axum · FastAPI · LIMES.