Whity documentation

Start here

InstallationBring up FrankenPHP and PostgreSQL with Docker Compose, migrate, seed, and log in.

ArchitectureThe request lifecycle, the worker pool, plugin loading, and the data model.

Tenant isolationHow one shared database keeps many organisations apart — enforced three times.

Permission systemThe resource:action registry, role hierarchy, and org-unit inheritance.

Build on it

Plugin developmentWrite a plugin against the MIT SDK — routes, permissions, hooks, migrations.

Connect an AI clientPoint an MCP client at the JSON-RPC endpoint and issue an agent token.

MCP serverHow API routes become agent tools, and how calls stay permission-gated.

CLI referenceMigrations, seeding, OpenAPI generation and the rest of the command surface.

Run it

Deployment guideTaking Whity to a real environment.

Go-live checklistThe hardening gate to run before any production deployment.

Backups and restoreWhat to back up, how to restore it, and how to verify the restore worked.

Architecture decisionsADRs recording why things are the way they are, not just what they are.

How these docs are built

Every page under Guides & reference and Architecture decisions is generated from a markdown file in AmroKSaleh/whity-core — the same files a developer reads in the repo. A change merged to develop rebuilds this site, so there is no second copy of the documentation to drift out of date. Each page links to its source file.

Two security-audit documents are deliberately not published here: a STRIDE threat model and a penetration-test scoping brief, which enumerate untested attack surface. They remain readable in the repository for anyone who wants them; they are just not given their own indexed page. Security policy and vulnerability reporting live at whity.dev/security.