%% Reference MCP deployment: knowledge and action servers
%% Reference architecture: a reusable pattern, not a live client integration
flowchart TB
  subgraph z0["User's device and AI host"]
    user["User"]
    host["AI host<br/>chat app, IDE or agent"]
    client_kb["MCP client: knowledge"]
    client_ops["MCP client: actions"]
  end
  subgraph z1["Your MCP deployment"]
    edge["HTTP edge<br/>TLS, origin check, rate limit"]
    srv_kb["Knowledge server<br/>read-only tools and resources"]
    srv_ops["Actions server<br/>narrow tools, OAuth resource server"]
    audit["Audit log and metrics"]
  end
  subgraph z2["Identity and systems of record"]
    authz["Authorization server<br/>OAuth 2.1 with PKCE"]
    content["Approved content store"]
    bizapi["Business system API<br/>one domain per server"]
  end
  user -->|"question or prompt"| host
  host -.->|"confirm action"| user
  host -->|"tool and resource calls"| client_kb
  host -->|"confirmed tool calls"| client_ops
  client_ops -->|"OAuth 2.1 + PKCE"| authz
  client_kb -->|"Streamable HTTP POST"| edge
  client_ops -->|"POST with bearer token"| edge
  edge -->|"validated request"| srv_kb
  edge -->|"validated request"| srv_ops
  srv_kb -->|"read approved content"| content
  srv_ops -->|"scoped API call"| bizapi
  srv_ops -->|"audit event"| audit
  srv_kb -.->|"request log"| audit
  classDef data stroke:#2f8a3a,fill:#e9f6ea
  class content,audit data
  classDef ai stroke:#5747AF,fill:#f6f4fd
  class host,client_kb,client_ops ai
  classDef integration stroke:#334155,fill:#eef2f6
  class srv_kb,srv_ops integration
  classDef security stroke:#1f2937,fill:#f3f4f6
  class edge,authz security
  classDef external stroke:#64748b,fill:#ffffff
  class bizapi external
  classDef people stroke:#125BD8,fill:#ffffff
  class user people