kebab-stack
DE/EN
Plan a pilot

AN IT SUITE THAT CONNECTS THE DOTS.

Your IT.Less busywork.More possibility.

Kebabstack connects people, devices, support and contracts on your Cloud Engine. Less chasing the next task. More room to make things better.

Explore the stack How does it work? ↗
  • MIT licensed
  • On your Cloud Engine
  • Currently in alpha
One shared directoryConnected applicationsCode you can make your ownBUILT TO BE YOURS.

01 / THE STACK

Useful tools.
Better together.

Explore real workflows from the implemented alpha. These are illustrated examples: names, devices and numbers are sample data, not customer results.

Hub / People & access

One starting point for your team.

Manage people, groups and app access centrally. Share sign-in, move between apps and use Operations to see what needs attention.

  • Passkeys & SSO; directory from Okta, SCIM or OpenTeam
  • Central roles and app permissions
  • Operations overview and paired team displays
IMPLEMENTED · ALPHA

People and permissions form the shared foundation.

Sovereign IT
HubSample data

Access you can explain.

Define roles once in Hub

  • Hub OwnerAdministrative access to the official apps
    Admin
  • Support teamAssigned the Desk Agent role in Hub
    Desk Agent
  • EmployeesOwn devices, requests and explicitly shared content
    Employee
One source of permissions for the stack.

App access, roles and exceptions are visible in Hub. Project and content scopes still apply.

Explore the shared dashboard
Product illustration · Sample data

Desk / Support & on-call

A departure does not always start with a ticket.

When a known person is deactivated in Okta, OpenTeam, through SCIM or directly in Hub, Desk picks up the follow-up. IT reviews the reason, with authorized context from connected apps alongside the case.

  • Automatic review instead of forgotten follow-up
  • Hardware progress from Assets instead of duplicate checklists
  • Also customer projects, on-call and HR/Finance reporting
IMPLEMENTED · ALPHA

After the change reaches Hub; synchronization and app availability can cause delays. Verified mobile alerting remains planned.

IT offboarding
DeskSample data

One deactivation. A clear next step.

Account review · Alex Example
Needs review
  1. 01
    Okta deactivates the account

    Hub receives the change for the known person.

  2. 02
    Desk creates the internal review

    An existing open case is reused.

Is this actually a departure?

IT confirms the departure or records another reason for the deactivation. A deactivation alone does not trigger a return.

Person & related work
Permissions checked
  • AssetsNotebook, display and dock assigned
    3 devices
  • ContractsOne contract responsibility, two license allocations
    Review
  • FormsOne form owned by this person
    Reassign
  • TrustOne assigned notebook with a current report
    Current
Connected, within existing permissions.

Desk shows only context the agent is allowed to see in each tool. Details remain in the owning app.

Offboarding · Alex Example
Departure confirmed
1 / 3Hardware items completed
2Items still open
  • NotebookSale planned · handover outstanding
    Open
  • DisplayWith IT · preparation in progress
    Open
  • DockReturn and preparation confirmed
    Complete
Completion follows the actual result.

Desk reads progress from Assets. Outstanding items or an unavailable source prevent completion.

Product illustration · Sample data

Assets / Devices & inventory

Know what you have. And who has it.

Record hardware, assign it to people and follow its handover history. Import existing MDM and Apple data, manage returns and coordinate sales.

  • Inventory and assignment history
  • Issue, return and reuse
  • Hardware sales with a dedicated dealroom
IMPLEMENTED · ALPHA

Inventory complements your device management.

AssetsSample data

Departure confirmed. Hardware accounted for.

Notebook · 14″Current holder: Alex Example
Sale open
  1. 01Offer
  2. 02Invoice
  3. 03Paid
  4. 04Handover
  • Private dealroomOutside buyer · offer accepted
    Accepted
  • Data & device managementWipe, test setup and release device management
    IT checks
  • Physical handoverRecorded after preparation
    Pending
Paid does not mean handed over.

A former employee can buy through a private dealroom. Their company account stays deactivated.

Product illustration · Sample data

Trust / Device posture

Device posture, with evidence.

A read-only osquery agent reports system facts. Trust shows current checks, missing evidence and the devices that need IT attention.

  • Checks with inspectable results
  • Employees can see their own devices
  • Remediation through your existing management tools
IMPLEMENTED · ALPHA

Transparent posture checks. Not an MDM replacement.

TrustSample data

One device. Evidence for every check.

Notebook · 14″Assignment from Assets
Needs attention

Example report · 22 Sep 2026 · 09:40 UTC

  • Disk encryptionFileVault
    Passing
  • FirewallCurrent agent report: disabled
    Failing
  • Screen lockNo current check result
    Not verified
Fix the issue. Verify a fresh report.

Correct the firewall in your management tool. Check missing evidence separately. An old report is not treated as a pass.

Product illustration · Sample data

Contracts / Software & contracts

Stay ahead of the next renewal.

Review contracts alongside actual software payments: select Brex cards per space, import daily and assign individual charges to the right agreements. A guided conversation helps complete missing contract details.

  • SaaS overview and licence allocations
  • Renewals and cancellation deadlines
  • Brex payment review with individual assignments and optional AI
IMPLEMENTED · ALPHA

Brex uses read permissions only. AI suggestions and changed terms require confirmation; no payments or vendor provisioning.

ContractsSample data

Decide before the renewal.

Design softwareOwner: Design team
Decision due
12 Oct 2026Internal decision deadline
31 Oct 2026Cancellation deadline
Renewal
01 Dec 2026
Recorded cost
EUR 400 / month
License allocation
17 / 20
Three unassigned licenses. Review the need.

Allocations are not usage data. Review terms and requirements before renewing or cancelling with the vendor.

Product illustration · Sample data

Forms / Forms & review

From submission to decision.

Build forms, collect responses through public links and review them together. With owners, ratings and a clear decision at the end.

  • Form builder and public links
  • Review pipeline with notes and ratings
  • Sharing, insights and CSV export
IMPLEMENTED · ALPHA

Public participation; internal review with access controls.

FormsSample data

Review workshop proposals together.

8Received
3In review
2Accepted
1Declined
Workshop: everyday IT automationAssignee: Sam Example
Status
In review
Internal note
Clarify the agenda, then review together.
Submission and decision stay together.

A public form link collects proposals. Only authorized colleagues see reviews and notes.

Product illustration · Sample data

Watch / Domains & DNS

Give your domains some attention.

Monitor DNS configuration, domain findings and known expiry dates. Review the evidence and enable notifications where needed.

  • Domain and DNS monitoring
  • Findings with timestamps and evidence
  • Known expiry dates in view
IMPLEMENTED · ALPHA

DNS and domain evidence, not HTTP uptime monitoring.

WatchSample data

A DNS record needs attention.

docs.example.comCNAME → retired.example.net
Target missing

Example check · 22 Sep 2026 · 09:30 UTC

  • Cloudflare DNSretired.example.net
    NXDOMAIN
  • Google DNSretired.example.net
    NXDOMAIN
Correct DNS at the provider, then check again.

The missing target cannot be accepted as healthy. This is evidence of a DNS problem, not a confirmed takeover or HTTP downtime.

Product illustration · Sample data

Crumbs / Website analytics

See the traffic. Understand the next step.

Which sources bring interest — and which lead to an enquiry? Crumbs connects traffic, AI referrals, goals and revenue. Saved filters and funnels simplify recurring reports, with an overview across permitted websites.

  • AI referrals, campaign channels and scroll-depth goals
  • Funnels and source-attributed revenue, by currency
  • Multi-site overview, Hub permissions and data export
  • Google Search Console and Data Studio with setup guides
IMPLEMENTED · ALPHA

Native collector, no cookies or browser storage by default. Optional consented browser recognition includes setup guidance and a revocable choice. Google connections need separate configuration. Review privacy and capacity for each website.

Cookieless analytics
CrumbsSample data

What happens between visit and enquiry?

14–20 Sep 2026 · UTC
1,200Visits
1,920Pageviews
30%Bounce rate
  • Organic search600 visits
    24 enquiries
  • AI assistants240 visits
    18 enquiries
  • Paid search180 visits
    8 enquiries
  • Direct / other180 visits
    4 enquiries
Funnel: demo enquiry10% completion
  1. 1. Product page540
  2. 2. Form opened180
  3. 3. Enquiry sent54

Configured events within the same session; estimated visitors at each funnel step. These examples are not measurements of kebabstack.dev.

07–13 Sep 2026 · UTC
1,000Visits
1,500Pageviews
40%Bounce rate
  • Organic search550 visits
    18 enquiries
  • AI assistants150 visits
    10 enquiries
  • Paid search100 visits
    5 enquiries
  • Direct / other200 visits
    3 enquiries
Funnel: demo enquiry8% completion
  1. 1. Product page450
  2. 2. Form opened120
  3. 3. Enquiry sent36

Configured events within the same session; estimated visitors at each funnel step. These examples are not measurements of kebabstack.dev.

Product illustration · Sample data

Phone / iOS & Android

Your stack. On the go, too.

A companion app for iOS and Android is planned: connect your own stack, open the existing web apps and receive and acknowledge incidents directly on your phone.

  • Revocable device authorization for convenient sign-in
  • Native incident alerts with direct acknowledgement
  • Alert-readiness check on sign-in and return, with a test alert
PLANNED · NOT YET AVAILABLE

Not yet available. Push needs additional infrastructure and platform approvals. Settings changes cannot always be detected immediately; delivery is not guaranteed.

PhoneConcept

A look at the planned companion.

Planned, not available yet.

Stack access, incident acknowledgement and an alarm-readiness check for iOS and Android. Delivery requires native apps, delivery infrastructure and platform permissions.

  • Mobile stack accessConnect your own environment
    Planned
  • Incident alertsWith a test alert and acknowledgement
    Planned
Concept illustration · planned

And a foundation for running it.

ALPHA

KitchenInstallation & updates

Installs modules and applies verified releases. After the initial setup, manage apps from the Hub.

VaultSnapshots & recovery

Create, schedule and restore snapshots. Per canister — not one atomic backup of the whole suite.

kebab-mcpYour AI assistant

Connect your assistant to the apps. It acts with your existing rights; you configure integrations and data flows.

Ship the BugA small break

A game in 2D and 3D. Public play, with optional player names or Internet Identity and opt-in leaderboards.

02 / HUB OPERATIONS

Your IT at a glance.
Your next step in sight.

Requests, device posture, hardware, contract deadlines and domain alerts come together in Hub. See what needs attention, then continue in the app that owns the work.

Hub → OperationsSample data

What needs your attention?

Example · 5 of 5 sources available
ASSETS · NEXT STEP

Paid. Handover still open.

A sale stays open until physical handover. Operations surfaces the follow-up; the work is completed in Assets.

Explore the sale example

Your workspace: current totals and next steps from apps where you have Admin access. Links in this illustration open the product examples.

TEAM ROOM · EXAMPLE

One screen. A shared picture.

Read only

  • Desk

    12

    Open requests

    Internal support

    3 without an agent

  • Trust

    96/ 100

    Average verified score

    38 of 40 devices fully assessed

    2 with failing checks

  • Assets

    8

    Devices in stock

    48 devices in inventory

    2 more being prepared

  • Contracts

    3

    Decisions within 30 days

    24 active contracts

    Recorded decision deadlines

  • Watch

    1

    Domain with an alert

    12 domains monitored

    Review the DNS finding

Selected metrics · no names or ticket content

Pair by code in Hub, choose sources and approve for 1, 7 or 30 days. Separate display access instead of an admin sign-in on the TV. Sales and departures stay in the work view.

Product illustration · sample data · implemented alpha. No company data is loaded here.

Current, not assumed healthy.

The real overview refreshes every minute. Missing or stale sources are marked unavailable instead of appearing as zero.

One overview. No duplicate upkeep.

Tickets stay in Desk, hardware in Assets. Operations combines the picture; changes happen where the work is managed.

Share what belongs in the room.

An Owner selects sources and expiry and can revoke TV access. Even small counts can be sensitive: choose what is suitable for the audience.

Current snapshots, not historical trends or a company-wide health score. Trust scores cover fully assessed enrolled devices. Not every device in inventory is necessarily enrolled in Trust. Coverage & access model ↗

03 / THE TECHNOLOGY, IN PLAIN LANGUAGE

Less infrastructure.
More time for your IT.

Kebabstack’s core applications store their data with the application itself. There is no separate database for you to operate. Compatible upgrades retain tickets, device assignments and contracts.

HOW AN UPDATE WORKS

Existing app code

Compatible update

New app code

The stored data stays.

  • Tickets
  • Device assignments
  • Contracts
Simplified principle · each application canister holds its own state.
01

LESS TO OPERATE

No separate application database.

The core apps need no separate SQL service to set up, maintain or issue database credentials for. Code and stored state belong to the canister.

02

CONTROLLED UPDATES

New version. Existing data.

Compatible upgrades retain stored state. Kebabstack’s update service first snapshots the backend and frontend, then verifies the installed release after the update.

03

EASIER TO EXTEND

More room for your workflows.

Your own Motoko extensions can build on persistent state without connecting a separate database first. New data models and business logic still need review and testing.

OpenCloud provides a way to provision and manage Cloud Engines. kebabstack is the IT suite that runs on them.

Meet OpenCloud ↗
What does orthogonal persistence mean?

Motoko retains persistent application state across calls and compatible code upgrades. A canister brings the program and its data together. Kebabstack uses this Motoko capability on ICP for its core applications.

A Cloud Engine runs canisters on selected computers. ICP coordinates execution and replication; OpenCloud provides provisioning and management. Your team uses familiar web interfaces.

Read about the technology and implementation

Persistence does not replace backups or undo mistakes. Snapshots are per canister; recovery and data migrations still need planning. External integrations may require their own services. Operators, data location and the dependency on ICP remain part of the decision.

04 / YOUR STACK CAN KEEP GROWING

Your workflows are your own.
Your software can be, too.

An extra field. A different approval flow. An entirely new app. Open source and a shared SDK let your team build on what is already there.

  1. 01

    Adapt

    Fork existing apps and shape their interfaces or business logic around the way you work.

  2. 02

    Extend

    Connect your own app with the SDK: reuse sign-in, the people directory and shared navigation.

  3. 03

    Keep building

    Write code yourself or work with a coding agent. Review changes, test with data and roll them out deliberately.

YOUR STARTING POINTMIT
kebabstack/
├─ hub/Shared sign-in & permissions
├─ desk/Your service workflows
├─ assets/Your devices & assignments
├─ sdk/example/Starting point for your own app
└─ docs/agent/Guide for your team & coding agent
+
your-next-idea/

Your idea becomes part of the stack.

MIT. Take it your way.

The licence permits use, modification and redistribution, including commercially. Keep the copyright and licence notice.

Read the licence

Motoko helps detect structurally incompatible state changes. Business logic tests, authorization checks, upgrade tests and recovery remain your responsibility.

View source on GitHub

05 / THE DECISION

No fee per seat.
An honest total cost.

kebabstack charges no per-person licence fee. Your total cost depends on infrastructure, integrations and the time your team puts in.

01

Shared foundations

A shared directory and sign-in can reduce duplicate integration work.

02

Fewer separate services

The Motoko backends store data directly in canister state. Crumbs can run without a separate collector. Include additional integrations and their operation in your cost model.

03

Your own priorities

Source access and application control enable your own extensions. Maintenance, support and updates become your responsibility, too.

COMPARE THE WHOLE PICTURE

0kebabstack licence+Infrastructure+External APIs+Operating time+Amortized migration

Operating hours × internal hourly cost; spread migration over an agreed period. Count only subscriptions you can actually cancel. No validated cost or capacity benchmark yet.

06 / YOUR NEXT STEP

Start small.
Ask real questions.

Plan a bounded pilot with test data. Success is not the number of apps installed, but whether your workflows actually work better.

  1. 1

    Define the environment

    Agree the engine, responsible IT team, controllers and recovery. Initial setup uses the command line.

  2. 2

    Try a complete workflow

    Create five test people, assign a device, approve a request and deactivate a person again.

  3. 3

    Exercise the operation

    Test an update, a Hub outage and a restore with sample data. Record time, failures and the external services you still need.

Download the pilot checklist

IN PRACTICE

What should be easier for your IT team?

Sovereign ITMore control over your IT tools.IT offboardingA disabled account should not hide unfinished work.Cookieless analyticsUnderstand what works on your website.

FAQ

Good questions. Clear answers.

Does Kebabstack work with OpenSaaS and OpenTeam?

Hub can use OpenTeam as an optional directory source: people and employment status are imported after a reviewed preview, then checked every five minutes. App permissions and Finance stay central in Hub. This alpha connector is locally tested against the directory interface; pilot your specific OpenTeam version before adoption. Shared OpenSaaS sign-in and wider suite integration are not included.

Setup and compatibility scope

Does my team need to understand blockchain or crypto?

For everyday work, they use regular web interfaces. IT operators need platform knowledge for setup and operation. Cloud Engines are operated as infrastructure; employees do not need to buy tokens as part of the app workflow.

Does kebabstack replace our entire IT landscape?

That depends on your requirements. The suite covers specific jobs, but is not a feature-complete replacement for every IAM, ITSM or endpoint-management product. Email, device management and other external services may still be needed.

Can we really change the code ourselves?

Yes. The existing MIT licence permits modifications, commercial use and redistribution with the licence notice. The complete alpha is public on GitHub. Included third-party libraries and images retain their own licenses. Backends use Motoko, frontends use web technologies, and the SDK includes an example app.

Is our data automatically private or hosted in Switzerland?

No. Locations and operators depend on the infrastructure you choose. Replication is not end-to-end encryption against node operators. Identity providers, Slack or AI services can introduce additional data flows. Review them for your specific use.

How do updates, backups and access revocation work?

Kitchen manages releases; Vault provides per-canister snapshots. There is no atomic suite backup or complete off-site disaster recovery. Bundled apps deny access when directory data reaches 60 seconds without fresh Hub confirmation; upstream identity synchronization adds latency. A Hub outage therefore interrupts app access.

Is it production-ready?

The current status is alpha. Features are implemented, but cost, capacity and availability have not been established by validated benchmarks. Start with a bounded pilot and decide based on your requirements, testing and operating capacity.

Ready-made building blocks.
Open possibilities.

Back to the stack