Afunana is delivered as a small set of self-contained containers on the customer's own infrastructure.That can be a data centre, a private cloud tenancy or an air-gapped network.No vendor-hosted service sits in the path.The software, the source it reads and the documentation it produces stay inside the estate.
The shape of an installation
One picture to orient on.Everything inside the dashed boundary runs on the customer's own hardware.Only two arrows cross it, and the customer configures and can sever both.
Users, and the AI tools on their desks
|
TLS proxy
|
- - - - - - - - - - - - - - - - - - - - - - - - - - customer boundary
| | |
| Afunana application |
| web UI . REST API . MCP . VS Code |
| | |
| +--------------+--------------+ |
| | | | |
| relational local search per-collection |
| database index working storage |
| (users, config, (meaning + (extracted source,|
| audit, history) keyword) generated docs) |
| |
- - - - - - - - - - - - - - - - - - - - - - - - - -
| |
source platform model provider
(IBM i / z/OS / Oracle) (or a local model,
read-only extraction for no egress at all)
The application is the only thing users talk to.It keeps its records in a database and builds its own search index on the box.It reaches outward exactly twice.Inward to the system whose code is read, outward to the model that writes the documentation.Replace the second with a local model and nothing leaves the perimeter.
How it deploys
Installation is a single command.It pulls the image, provisions secrets, generates the runtime configuration and starts the application.Connection setup, user access and operational checks are still required.Enterprise sites can pull from an internal registry or install fully offline.Updates re-pull and restart, preserving all data.
Two components are optional, because large organisations already have their own.A hardened database is bundled by default.It also runs against the customer's own database server, even a high-availability cluster, with no code change.A reverse proxy with automatic TLS is included, or omitted when the customer fronts the application themselves.
The pieces
The application — one process serving the web interface and the programmatic interfaces alike.It authenticates users, serves documentation and chat, and runs the analysis pipeline.It connects to the source platform and hosts the gateway every model call passes through.
A relational database — the system of record.Users and roles, collections, connections, build history, configuration, change plans, chat history, audit log.
A local search layer — built per collection over the generated documentation.The assistant finds things by meaning as well as by name.It is computed entirely on the customer's own hardware; no content goes to an external service.
Per-collection working storage — extracted source, parsed structures and generated documents.Each body of code is held separately.
Interfaces
The same data is reachable through the web application, a REST API and a VS Code extension.An authenticated Model Context Protocol endpoint lets AI tools query a collection directly.
Security posture
The application and database never face the network directly — TLS terminates at the proxy.Authentication is token-based with optional SSO/OIDC.Authorization is role-based, from full administration down to review-only.Secrets live in a secret store or the environment, masked in the UI and never logged.Security-relevant events go to a tamper-evident audit log the database refuses to let anyone alter.Security & Governance is where all of that is set out in full.
External connections
Source-system and AI connections are central to the deployment.Other services, such as identity, licensing, updates or monitoring, may also require connectivity.Review the configured network requirements before installation.
Inward to the source platform, to read code.Extraction is strictly read-only during analysis.IBM i (COBOL, RPG, CL) and IBM Z (COBOL, PL/I, JCL, DB2) are read from the compiler listing and system metadata.Nothing is installed on the host.Under an approved change plan Afunana can also write an executed change back.Oracle — PL/SQL — is read from the data dictionary into the same internal model.Natural/Adabas needs no connection: the Natural export is uploaded and read into the same model.SAP ABAP/BW needs no connection either: an abapGit export, with BW flow metadata, is uploaded and read into the same model.
Outward to a model provider, to write documentation.Anthropic, OpenAI, Azure OpenAI and local Ollama are supported.Sites that cannot make outbound calls at all run local models, fully air-gapped.
The analysis pipeline
The pipeline turns extracted source into searchable documentation in stages.Structural mapping is deterministic, language grammar and not AI.It produces the call graph, cross-reference matrix, field catalog and silent-failure findings.The documentation stages call a model; later stages build the local indexes and derive business-concept tags.After the first full build, only what changed is re-analyzed.The documentation stays current without paying for the whole estate again.
AI processing and usage
AI processing uses the services configured for the installation.Cloud services may receive selected source and context.A local configuration keeps that processing within the environment.
Usage records and cost estimates help the organization review operation.Discuss provider and data-handling requirements during deployment planning.
Design decisions
Source evidence
Afunana uses source analysis to identify supported relationships and code patterns.Generated explanations include source references for specialist review.Coverage depends on the language, available source and analysis results.
Shared application context
Programs, files and fields are available within a collection, so users can investigate their relationships together.The browser, VS Code extension and authenticated integrations use the collection's analyzed information.
Refresh and review
Rebuild the analysis when source changes.Review build results and findings before relying on updated documentation.Generated explanations do not replace domain expertise, compilation or testing.