Specifications

The technical sheet, read from the product.

Protocols, codecs, limits and what the server needs. Rows marked “catalogue” are read from the running product each time this page loads. Rows marked “docs” are taken from its documentation.

At a glance#

Hosting: Self-hosted. Everything runs in Docker on one Ubuntu server that you control.; Source: docs
Channels: Phone · Web chat · API · MCP gateway · A2A; Source: catalogue
Kinds of step: 16 kinds; Source: catalogue
Providers: 28 in all: 20 for language models, 8 for speech. 4 verified here, 4 that run locally.; Source: catalogue
Ways to connect a PBX: 3 ways; Source: catalogue
Gateway for other agents: Model Context Protocol (Streamable HTTP), 4 protocol versions. Agent2Agent 1.0 as well.; Source: catalogue
Roles: Owner · Admin · Builder · Supervisor · Analyst; Source: catalogue

Channels#

The ways an agent can be reached today.

Phonephone: Through your PBX, over SIP.; Source: catalogue
Web chatweb-chat: Source: catalogue
APIapi: Conversations over the REST API.; Source: catalogue
MCP gatewaymcp: Other agents, through the gateway.; Source: catalogue
A2Aa2a: Other agents, over the Agent2Agent protocol.; Source: catalogue

Flows#

An agent is a flow: steps, and the ways out of each.

Kinds of step

startagentsaycollectmenuroutertoolsub-agentconditionsetwaittime-conditiongotohandoverapprovalend

catalogue

Templates

7 templates ship with the product.

Blank agent · Front desk · Bookings with a manager’s say · Support triage · Lead qualifier · Phone menu · Out-of-hours messages

catalogue

Ways out of a stage

A rule, evaluated without a model. Or a description that a model judges.

docs

Versions

A draft is validated before it is published. A published version never changes. Roll back to an earlier one.

docs

Conversations

Every step is recorded and can be replayed. A conversation survives the process that was running it.

docs

Trying a flow

In the builder’s test console, and over the API.

docs

Sensitive details

What is said while a step collects details marked sensitive is kept out of the transcript and the trace.

docs

A review of every conversation

Once a conversation is over, a model reads it and writes a summary, how the caller seemed, whether they got what they came for, a score for how well the agent did, what the call was about, and what somebody should do next. It is one model call per conversation, with the workspace’s own model, and a workspace can switch it off. What a caller said is read, never obeyed.

docs

Numbers

Volumes, outcomes, speed, cost, tool use, what the reviews add up to, and the paths conversations take through a flow are counted for every workspace.

docs

Telephony#

The platform’s own SIP gateway, between your PBX and your agents.

Ways to connect a PBX: Sign in as an extensionregisterThe gateway signs in to your PBX the way a desk phone does, as one of its extensions.
By addressipYour PBX sends its calls to the gateway, which knows it by the addresses those calls come from.
With credentialsdigestYour PBX signs in to the gateway with a user name and password that the platform issues.; Source: catalogue
SIP transports: UDPTCPTLS; Source: catalogue
Codecs: G.722 (wideband)G.711 µ-law (PCMU)G.711 A-law (PCMA); Source: catalogue
Key presses (DTMF): RFC 4733; Source: catalogue
Call audio encryption: SRTP, with keys exchanged by SDES; Source: catalogue
SIP ports: 5060 UDP and TCP. 5061 TCP for SIP over TLS.; Source: docs
Call audio ports: 40000–41999 UDP. Each call uses two.; Source: docs
SIP over TLS: The gateway serves SIP over TLS with a certificate for the sip name of your domain, obtained and renewed automatically.; Source: docs
One address, one trunk: One PBX address belongs to one trunk on the whole platform.; Source: docs
Trunk status: Each trunk shows whether it is signed in and whether its PBX answers.; Source: docs

How telephony connects

Speech#

How a call is heard and spoken.

Voice worker: Hears, takes turns and speaks. It lets the caller interrupt, and reports exactly what the caller heard.; Source: docs
Local speech: Speech recognition and voices ship with the platform and run on your own hardware. Verified on real calls.; Source: docs
Cloud speech services: Wired to each provider’s published interface. Each stays marked unverified until a key has been used on a call.; Source: docs
One measurement: On a development machine, with the local speech that ships with the platform: a caller hears the answer about three seconds after they stop speaking, on a laptop’s CPU. A measurement, not a benchmark.; Source: docs

Handing a call to a person#

What a flow’s Handover step can do.

Modes: Cold handovercoldThe agent rings a person and puts the caller through.
Warm handoverwarmThe agent briefs the person privately first, while the caller hears music. The person accepts or declines.
ConferenceconferenceThe agent brings the person into the call and stays: speaking when asked, or silent until called on.; Source: catalogue
What the AI does once a person has joined: LeavesleaveOnce the person has the call, the agent is gone from it.
Stays and takes partactiveThe agent stays in the call and speaks when asked.
Stays silentcopilotThe agent stays in the call and says nothing until it is called on.; Source: catalogue
Hand back: The person can hand the call back to the agent.; Source: docs
When nobody takes it: Nobody answering, a busy line and a declined call each continue the flow.; Source: docs
Stepping in: Somebody watching a live call can have a person brought into it in any of these modes, whatever its flow was doing, or hang it up. If the person does not answer, the agent tells the caller and carries on. Who stepped in is on the audit log.; Source: docs
What may be rung: Only destinations a workspace set up by name, under per-trunk rules on where and how often.; Source: docs

Gateway for other agents#

Where other agents talk to yours: one MCP endpoint, and an Agent2Agent address for each agent you offer.

Endpoint: https://<your site>/mcpOne address on your own site.; Source: docs
Protocol: Model Context Protocol (Streamable HTTP); Source: catalogue
Protocol versions: 2026-07-282025-11-252025-06-182025-03-26; Source: catalogue
Ways in: Gateway key
OAuth 2.1 with PKCE and Client ID Metadata Documents; Source: catalogue
Scopes: agents:readSee which agents are offered.
agents:converseTalk to them.; Source: catalogue
Tools a client sees: list_agentsThe agents the client may talk to: the name of each, what it is for, and the inputs it accepts.
ask_<agent>One for each agent. Sends a message and returns the reply. Pass conversation_id from a reply to carry on the same conversation; pass inputs when starting one.
start_conversationStarts a conversation without saying anything, and returns what the agent says first.
send_messageSays something in a conversation.
get_conversationWhere a conversation stands, and what was said.
end_conversationEnds a conversation.
Agent2Agent protocol: Agent2Agent (JSON-RPC over HTTP) 1.0; Source: catalogue
Agent2Agent methods: SendMessageSendStreamingMessageGetTaskListTasksCancelTask; Source: catalogue
Agent2Agent ways in: Gateway key
Gateway key: sk_mcp_…Shown once. It can be replaced, given an expiry, or removed with its client. It opens the gateway and nothing else: the REST API refuses it.; Source: docs
Sign-in token: Good for the gateway only, for ten minutes at a time. It names the person, the application and the workspace.; Source: docs
Signing in needs HTTPS: Over plain HTTP, anywhere but on the machine itself, the gateway takes keys only.; Source: docs
Limits on a client: Which agents. Requests a minute. Open conversations. Turns in a conversation. Tokens a day and spend a day. Whether it may read conversations back. The web origins it may call from.; Source: docs
Past a limit: Requests are refused with 429 and a time to wait. Daily allowances are counted from midnight UTC.; Source: docs
States of a reply: awaiting_userendedpending_approvalhanded_overworking; Source: docs
Record: Every request, allowed or refused, is written to a record that cannot be altered afterwards.; Source: docs
What a client says: It reaches an agent as what its caller said. It is never treated as instructions.; Source: docs

The gateway, step by step

Models and speech services#

What the product can connect to. The full list, with what each is for, is on the integrations page.

Language model providers

catalogue

Providers with embeddings

catalogue

Speech to text

catalogue

Text to speech

catalogue

Run locally

Ollama · OpenAI-compatible endpoint · MENTOR Knowledge Studio · Local speech (Speaches)

catalogue

Verified here

Ollama · OpenAI-compatible endpoint · MENTOR Knowledge Studio · Local speech (Speaches)

Every other provider is built to its published API, and stays marked unverified in the app until a key has been tested.

catalogue

Every integration

Tools#

What an agent can use.

Kinds of tool: HTTP requestshttpRequests to a web API, written the way you describe them.
Tools on MCP serversmcpThe tools an external MCP server offers. A tool whose description changes is held back until somebody has looked at it.
OpenAPI importopenapiOperations imported from an OpenAPI description.
Another agentagentOne of your own agents, used the way a tool is.
Built-in toolsbuiltinTools that come with the platform.; Source: catalogue
MCP server transports: Streamable HTTPSSE; Source: catalogue
Changed tools: A tool from an MCP server whose description changes is held back until somebody has looked at it.; Source: docs
Approval: A tool can wait for a person’s approval before it runs.; Source: docs
Requests an agent makes: They cannot be pointed at private addresses, and a stored key is only ever sent to the host it was entered for.; Source: docs

Knowledge and memory#

What an agent can look up, and what it can remember about a caller.

Sources: Pasted text, Markdown, a web page fetched for you, or a file: a PDF or a Word document (.docx), up to 10 MB. A scanned PDF with no words in it is refused, and says why, rather than taken in empty.; Source: docs
Embeddings: From a model on your own machine (Ollama, verified) or an OpenAI-style service.; Source: docs
Search: In Postgres, with pgvector.; Source: docs
What a document says: It reaches a model as something found, never as instructions.; Source: docs
Memory of callers: A stage can be allowed to note things about a caller, and to be told them the next time the same number calls. People in the workspace can see what is kept, and remove it.; Source: docs

Workspaces and roles#

Who may do what in a workspace.

Ownerowner: Everything, including workspace settings and who the other owners are.; Source: catalogue
Adminadmin: Runs the workspace: members, API keys, models and telephony.; Source: catalogue
Builderbuilder: Designs and publishes agents, tools and skills.; Source: catalogue
Supervisorsupervisor: Works live conversations and decides approvals.; Source: catalogue
Analystanalyst: Reads conversations and numbers. Changes nothing.; Source: catalogue
Workspaces: One workspace’s data cannot be read from another. The database enforces it, not only the application.; Source: docs
API keys: An API key carries a role.; Source: docs
Audit log: Each workspace has an audit log.; Source: docs
Platform administration: A separate area for whoever runs the installation.; Source: docs

Security#

The model, row by row. The security page says the same in plain words.

Workspace isolation: Row-level security on every workspace table. The application’s database role cannot see across workspaces.; Source: docs
Stored credentials: Encrypted with AES-256-GCM, and bound to the hosts they may be sent to.; Source: docs
Instructions to a model: Only what the flow’s author wrote. What a caller, another agent, a tool or a document says never reaches a model as instructions.; Source: docs
Outbound requests: One guard. No private addresses unless a platform administrator allows them. The resolved address is the one connected to. Redirects are checked again.; Source: docs
Outbound calls: The platform dials nothing of its own accord: only destinations a workspace set up by name, under per-trunk rules on where and how often.; Source: docs
Between services: Short-lived tokens, with one signing key for each pair of services.; Source: docs

The security model in plain words

Deployment#

One Ubuntu server, everything in Docker, TLS by itself.

Not yet exercised end to end

The stack, the production settings and the host script have been checked on a development machine, and calls have been placed through the gateway on a Docker network. A call from a real PBX to a server set up by the runbook has not been made. Treat the first installation as a rehearsal.

Operating system: Ubuntu 24.04 LTS or 26.04 LTS.; Source: docs
Architecture: amd64 or arm64. amd64 is recommended for production: the telephony gateway treats other architectures as second-tier.; Source: docs
Server, with cloud models and speech: 4 CPU cores and 8 GB of memory.; Source: docs
Server, with local speech: 8 CPU cores and 16 GB of memory.; Source: docs
Server, with a local language model: A GPU.; Source: docs
Public address: One IPv4 address that your PBXs can reach.; Source: docs
DNS names: appfilesvoicesip
Four under your domain, all pointing at that address. Certificates are obtained automatically once they resolve.; Source: docs
Web ports: 80/tcp443/tcp
For the site, the app and the gateway for other agents.; Source: docs
SIP ports: 5060/udp5060/tcp5061/tcp
From your PBXs.; Source: docs
Call audio ports: 40000–41999/udp
Each call uses two.; Source: docs
Installation: One host script. It installs Docker, tunes the kernel for call audio, sets up the firewall and a fail2ban jail for SIP scanners, writes fresh secrets, builds the images and starts everything. It can be run again at any time.; Source: docs
Who may reach SIP: Only the PBX addresses you name, unless you choose to let any address in. Each trunk is then protected by its own credentials alone.; Source: docs
Backups: A nightly database dump, restored into a scratch database to prove that it can be, kept for fourteen days. The encryption keys are saved beside each dump. Copy both off the server.; Source: docs
Encryption keys: Losing them loses every stored provider key, tool token and SIP password.; Source: docs
Updates: Replace the release files, rebuild and restart. Database changes are applied before the services start. The SIP gateway restarts only if its image changed.; Source: docs

The host script, with its options

sudo /opt/sidekick-agents/infra/scripts/host/bootstrap-ubuntu.sh \
  --domain example.com --public-ip 203.0.113.10 \
  --admin-cidr 198.51.100.0/24 --pbx-cidr 192.0.2.10

Make the first account a platform administrator

cd /opt/sidekick-agents
docker compose exec api node src/cli/platform-admin.ts grant you@example.com

What runs#

Each part in its own container.

What runs in which container, and what of it can be reached from outside the server.
Container	What it does	Reachable from outside
caddy	TLS, and the routes to the site and the api.	80, 443
web	The site, the workspace app and platform administration.	Through caddy
api	Sign-in, the REST API, live events, and the gateway for other agents.	Through caddy
runtime	Runs every conversation: the flow engine, models, tools and call control.	No
voice	Call audio: turn-taking, speech to text, text to speech.	The voice name of your domain
asterisk	The SIP gateway: trunks to PBXs, call audio, bridges.	5060, 5061, 40000–41999 UDP, on the host’s own network
speachesoptional	Local speech, so that calls work with no cloud keys.	No
ollamaoptional	A local language model server, when you choose to run one here.	No
postgresvalkeyrustfs	The database, live state and stored files.	The files name of your domain, by signed links only

Not built yet#

Planned, and not part of anything above.

Speech-to-speech modelsComing soon

Start with a workspace of your own.

Create an account, connect a model, and make your first agent from a template.

Create an account Read the specifications

Quick start