> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Ultra's system architecture

Ultra is built as a layered proxy with clear separation between transport, processing, routing, and storage. It runs locally on each user's machine as a single binary -- MCP clients launch it as a subprocess, and all processing happens on-device. There are no cloud components in the data path.

## System Architecture

```mermaid theme={null}
graph TD
    Clients["<b>MCP Clients</b>"]

    subgraph UltraBox[" "]
        direction TB
        UltraLabel["<b>Ultra</b>"]
        Transport["Transport"]

        subgraph PipelineBox["Pipeline"]
            direction LR
            Trace["Trace"]
            Logging["Logging"]
            Audit["Audit"]
            Metrics["Metrics"]
            Trace --> Logging --> Audit --> Metrics
        end

        Aggregator["Aggregator"]

        UltraLabel ~~~ Transport
        Transport --> PipelineBox
        PipelineBox --> Aggregator
    end

    Server1["Upstream Server"]
    Server2["Upstream Server"]
    ServerN["Upstream Server"]

    Clients -->|"MCP"| Transport
    Aggregator --> Server1
    Aggregator --> Server2
    Aggregator --> ServerN

    style UltraLabel fill:transparent,stroke:transparent
```

## Layers

### Transport Layer

Handles MCP protocol communication. Ultra supports all MCP transport types:

* **stdio** — Standard I/O for local clients (Claude Desktop, Cursor, Codex)
* **HTTP/SSE** — Server-sent events over HTTP
* **Streamable HTTP** — Modern HTTP streaming

The client-facing side typically uses stdio (since MCP clients launch Ultra as a subprocess), while upstream connections use whatever transport the server requires.

### Pipeline

The [interceptor chain](/concepts/pipeline) processes every request and response, handling tracing, logging, auditing, and metrics.

### Aggregator

The [aggregator](/concepts/aggregator) manages connections to upstream MCP servers and presents them as a single unified interface to the client.

### Storage

Observability data is stored locally on the gateway by default, with optional sync to Ultra Hub for cloud deployments.