# the-minecrafters/mailent architecture

> Architecture diagram of the GitHub repository the-minecrafters/mailent, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/the-minecrafters/mailent
- Repository: https://github.com/the-minecrafters/mailent

## Overview

Mailent is a mail-transport security platform for forensic analysis, infrastructure assessment, and continuous monitoring. Analysts use the web console or CLI to inspect captures, assess mail infrastructure, review findings, and manage remediation; sensors and probes also submit evidence to the core service. The documented analysis flow combines normalized evidence with deterministic policy evaluation, drift/posture analysis, and separate Jev risk triage, then exposes results and reports. Major subsystems are included from the README and tree; detailed wiring for unsampled API handlers and optional integrations is necessarily summarized.

Main entry points: [`apps/core/src/api/mod.rs`](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/api/mod.rs) (Core API), [`apps/core/src/pipeline.rs`](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/pipeline.rs) (Evidence Pipeline), [`apps/core/src/dual_storage.rs`](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/dual_storage.rs) (Storage Facade), [`apps/sensor/src/main.rs`](https://github.com/the-minecrafters/mailent/blob/main/apps/sensor/src/main.rs) (Sensor Agent)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interfaces["Analyst Interfaces"]
  node_web["Web Console<br/>[App.tsx]"]
  node_webapi["Web API Client<br/>[api.ts]"]
  node_cli["CLI<br/>[main.rs]"]
  node_core["Core Service<br/>[main.rs]"]
  node_api["Core API<br/>[mod.rs]"]
end

subgraph group_collection["Evidence Collection"]
  node_zeek["Zeek Analyzer"]
  node_sensor["Sensor Agent<br/>[main.rs]"]
  node_probe["Active Probe<br/>[main.rs]"]
  node_scanner["Infrastructure Scanner<br/>[scanner.rs]"]
  node_integrations["Mail Security Lookups<br/>[lib.rs]"]
end

subgraph group_analysis["Security Analysis"]
  node_pipeline["Evidence Pipeline<br/>[pipeline.rs]"]
  node_policy["Deterministic Policies<br/>[evaluator.rs]"]
  node_correlation["Drift and Posture<br/>[lib.rs]"]
  node_jev["Jev Risk Triage<br/>[jev.rs]"]
  node_reports["Forensic Reports<br/>[builder.rs]"]
  node_domain["Domain Models<br/>[lib.rs]"]
end

subgraph group_operations["Security Operations"]
  node_remediation["Remediation Workflow<br/>[remediation.rs]"]
  node_devices["Connected Devices<br/>[devices.rs]"]
  node_monitoring["Live Monitoring<br/>[live.rs]"]
end

subgraph group_persistence["Persistence"]
  node_storage["Storage Facade<br/>[dual_storage.rs]"]
  node_database[("Postgres and ClickHouse<br/>[lib.rs]")]
end

node_analyst(("Analyst"))

node_analyst -->|"uses console"| node_web
node_analyst -->|"runs commands"| node_cli
node_web -->|"requests data"| node_webapi
node_webapi -->|"calls endpoints"| node_api
node_cli -->|"analyzes captures"| node_zeek
node_sensor -->|"analyzes traffic"| node_zeek
node_sensor -->|"submits observations"| node_api
node_probe -->|"produces probe evidence"| node_domain
node_analyst -->|"requests assessment"| node_scanner
node_scanner -->|"checks mail security"| node_integrations
node_core -->|"serves routes"| node_api
node_api -->|"processes observations"| node_pipeline
node_pipeline -->|"evaluates findings"| node_policy
node_pipeline -->|"correlates drift"| node_correlation
node_pipeline -.->|"requests triage"| node_jev
node_pipeline -->|"builds security records"| node_domain
node_api -->|"builds dossiers"| node_reports
node_api -->|"manages fixes"| node_remediation
node_api -->|"manages enrollment"| node_devices
node_sensor -->|"runs live capture"| node_monitoring
node_api -->|"reads and writes"| node_storage
node_pipeline -->|"persists results"| node_storage
node_storage -->|"delegates repository operations"| node_database
node_storage -->|"stores domain records"| node_domain

click node_web "https://github.com/the-minecrafters/mailent/blob/main/apps/web/src/App.tsx"
click node_webapi "https://github.com/the-minecrafters/mailent/blob/main/apps/web/src/api.ts"
click node_cli "https://github.com/the-minecrafters/mailent/blob/main/apps/cli/src/main.rs"
click node_core "https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/main.rs"
click node_api "https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/api/mod.rs"
click node_sensor "https://github.com/the-minecrafters/mailent/blob/main/apps/sensor/src/main.rs"
click node_probe "https://github.com/the-minecrafters/mailent/blob/main/apps/probe/src/main.rs"
click node_scanner "https://github.com/the-minecrafters/mailent/blob/main/crates/scanner/src/scanner.rs"
click node_integrations "https://github.com/the-minecrafters/mailent/blob/main/crates/integrations/src/lib.rs"
click node_pipeline "https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/pipeline.rs"
click node_policy "https://github.com/the-minecrafters/mailent/blob/main/crates/policy/src/evaluator.rs"
click node_correlation "https://github.com/the-minecrafters/mailent/blob/main/crates/correlation/src/lib.rs"
click node_jev "https://github.com/the-minecrafters/mailent/blob/main/crates/decision/src/jev.rs"
click node_reports "https://github.com/the-minecrafters/mailent/blob/main/crates/reporting/src/builder.rs"
click node_remediation "https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/remediation.rs"
click node_devices "https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/api/devices.rs"
click node_monitoring "https://github.com/the-minecrafters/mailent/blob/main/apps/sensor/src/live.rs"
click node_domain "https://github.com/the-minecrafters/mailent/blob/main/crates/domain/src/lib.rs"
click node_storage "https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/dual_storage.rs"
click node_database "https://github.com/the-minecrafters/mailent/blob/main/crates/storage/src/lib.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web,node_webapi,node_cli,node_core,node_api toneBlue
class node_zeek,node_sensor,node_probe,node_scanner,node_integrations toneAmber
class node_pipeline,node_policy,node_correlation,node_jev,node_reports,node_domain toneMint
class node_remediation,node_devices,node_monitoring toneRose
class node_storage,node_database,node_analyst toneIndigo
```

## Components

### Analyst Interfaces

- [Web Console](https://github.com/the-minecrafters/mailent/blob/main/apps/web/src/App.tsx): `apps/web/src/App.tsx`
- [Web API Client](https://github.com/the-minecrafters/mailent/blob/main/apps/web/src/api.ts): `apps/web/src/api.ts`
- [CLI](https://github.com/the-minecrafters/mailent/blob/main/apps/cli/src/main.rs): `apps/cli/src/main.rs`
- [Core Service](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/main.rs): `apps/core/src/main.rs`
- [Core API](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/api/mod.rs): `apps/core/src/api/mod.rs`

### Evidence Collection

- **Zeek Analyzer**
- [Sensor Agent](https://github.com/the-minecrafters/mailent/blob/main/apps/sensor/src/main.rs): `apps/sensor/src/main.rs`
- [Active Probe](https://github.com/the-minecrafters/mailent/blob/main/apps/probe/src/main.rs): `apps/probe/src/main.rs`
- [Infrastructure Scanner](https://github.com/the-minecrafters/mailent/blob/main/crates/scanner/src/scanner.rs): `crates/scanner/src/scanner.rs`
- [Mail Security Lookups](https://github.com/the-minecrafters/mailent/blob/main/crates/integrations/src/lib.rs): `crates/integrations/src/lib.rs`

### Security Analysis

- [Evidence Pipeline](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/pipeline.rs): `apps/core/src/pipeline.rs`
- [Deterministic Policies](https://github.com/the-minecrafters/mailent/blob/main/crates/policy/src/evaluator.rs): `crates/policy/src/evaluator.rs`
- [Drift and Posture](https://github.com/the-minecrafters/mailent/blob/main/crates/correlation/src/lib.rs): `crates/correlation/src/lib.rs`
- [Jev Risk Triage](https://github.com/the-minecrafters/mailent/blob/main/crates/decision/src/jev.rs): `crates/decision/src/jev.rs`
- [Forensic Reports](https://github.com/the-minecrafters/mailent/blob/main/crates/reporting/src/builder.rs): `crates/reporting/src/builder.rs`
- [Domain Models](https://github.com/the-minecrafters/mailent/blob/main/crates/domain/src/lib.rs): `crates/domain/src/lib.rs`

### Security Operations

- [Remediation Workflow](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/remediation.rs): `apps/core/src/remediation.rs`
- [Connected Devices](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/api/devices.rs): `apps/core/src/api/devices.rs`
- [Live Monitoring](https://github.com/the-minecrafters/mailent/blob/main/apps/sensor/src/live.rs): `apps/sensor/src/live.rs`

### Persistence

- [Storage Facade](https://github.com/the-minecrafters/mailent/blob/main/apps/core/src/dual_storage.rs): `apps/core/src/dual_storage.rs`
- [Postgres and ClickHouse](https://github.com/the-minecrafters/mailent/blob/main/crates/storage/src/lib.rs): `crates/storage/src/lib.rs`

### Other components

- **Analyst**

## Connections

- Analyst → Web Console: uses console
- Analyst → CLI: runs commands
- Web Console → Web API Client: requests data
- Web API Client → Core API: calls endpoints
- CLI → Zeek Analyzer: analyzes captures
- Sensor Agent → Zeek Analyzer: analyzes traffic
- Sensor Agent → Core API: submits observations
- Active Probe → Domain Models: produces probe evidence
- Analyst → Infrastructure Scanner: requests assessment
- Infrastructure Scanner → Mail Security Lookups: checks mail security
- Core Service → Core API: serves routes
- Core API → Evidence Pipeline: processes observations
- Evidence Pipeline → Deterministic Policies: evaluates findings
- Evidence Pipeline → Drift and Posture: correlates drift
- Evidence Pipeline → Jev Risk Triage: requests triage
- Evidence Pipeline → Domain Models: builds security records
- Core API → Forensic Reports: builds dossiers
- Core API → Remediation Workflow: manages fixes
- Core API → Connected Devices: manages enrollment
- Sensor Agent → Live Monitoring: runs live capture
- Core API → Storage Facade: reads and writes
- Evidence Pipeline → Storage Facade: persists results
- Storage Facade → Postgres and ClickHouse: delegates repository operations
- Storage Facade → Domain Models: stores domain records