systemprompt-template

This project uses systemprompt.io, self-hosted AI governance infrastructure. It is the evaluation template for systemprompt-core, published on crates.io as `systemprompt`.

Quick start

git clone https://github.com/systempromptio/systemprompt-template
cd systemprompt-template
just setup-local            # prompts: pick a provider (Gemini/Anthropic/OpenAI), enter its key
just start                  # serves governance + agents + MCP + admin on :8080

`setup-local` prompts for a provider key, or takes keys non-interactively (`just setup-local

Why agents cannot leak your keys: the code, twelve lines

Not a policy that asks agents nicely. A process boundary: the parent that owns the LLM context never writes the credential value.

When a tool call passes the pipeline, `spawn_server()` decrypts credentials from the ChaCha20-Poly1305 store and injects them into the child process environment. Source: `systemprompt-core/crates/domain/mcp/src/services/process/spawner.rs`.

let secrets = SecretsBootstrap::get()?;

let mut child_command = Command::new(&binary_path);

// Child env only. The parent (LLM context path) never touches the value.
if let Some(key) = &secrets.anthropic {
    child_command.env("ANTHROPIC_API_KEY", key);
}
if let Some(key) = &secrets.github {
    child_command.env("GITHUB_TOKEN", key);
}

// Detach; parent forgets the child after spawn.
let child = child_command.spawn()?;
std::mem::forget(child);

Before spawn, secret detection scans tool arguments for 35+ credential patterns. A tool call that tries to pass a secret through the context window is blocked even if the agent has scope to run the tool. The hero recording above is the scripted proof: `./demo/governance/06-secret-breach.sh`.

Performance: 3,308 req/s burst, p99 22.7 ms

Governance that adds more than 1% latency gets bypassed. This one doesn't. Each request performs JWT validation, scope resolution, three rule evaluations, and an async audit write.

Your first five minutes: admin UI, audit trace, live denial

• http://localhost:8080: admin UI, live audit table, session viewer.
• `systemprompt analytics overview`: conversations, tool calls, costs in microdollars, anomalies flagged above 2x/3x of rolling average.
• `systemprompt infra logs audit --full`: the full trace for any request: identity, scope, rule evaluations, tool call, model output, cost. One query, one row, one answer.
• Point Claude Code, Claude Desktop, or any MCP client at it. Permissions follow the user, not the client. Try to exfiltrate a key through a tool argument and watch the secret-detection layer deny it before the tool process spawns.
• `./demo/governance/06-secret-breach.sh`: the scripted version of that denial, recorded above.

Configuration & CLI: everything is a YAML diff, every task has a verb

Runtime configuration is flat YAML under `services/`, loaded through `services/config/config.yaml`. Unknown keys fail loudly (`#[serde(deny_unknown_fields)]`). No database-stored config, no admin UI required. Every change is a diff.

services/
  config/config.yaml        Root aggregator
  agents/.yaml          Agent: scope, model, tool access
  mcp/.yaml           MCP server: OAuth2 config, scopes
  skills/.yaml          Skill: config + markdown instruction body
  plugins/.yaml       Plugin bindings (references agents, skills, MCP)
  ai/config.yaml            AI provider config (Anthropic, OpenAI, Gemini)
  scheduler/config.yaml     Background job schedule
  web/config.yaml           Web frontend, navigation, theme
  content/config.yaml       Content sources and indexing

Eight CLI domains cover every operational surface. No dashboard required for any task.

More recordings: infrastructure, integrations, analytics, agents, compliance

Each recording is a live capture of the named script running against the binary.

Infrastructure: one binary, one process, one database. Same artifact runs laptop to air-gap.

All data on your infrastructure, zero outbound telemetry · ./demo/infrastructure/01-services.sh ·

Profile YAML promotes environments without rebuilding · ./demo/cloud/01-cloud-overview.sh ·

Every operational surface has a CLI verb · ./demo/infrastructure/03-jobs.sh ·

MCP, OAuth 2.0, PostgreSQL, Git · zero proprietary protocols · ./demo/mcp/01-mcp-servers.sh ·

MCP governance, analytics, closed-loop agents, compliance.

Each MCP server is an isolated OAuth2 resource server with per-server scope validation · ./demo/mcp/02-mcp-access-tracking.sh ·

Nine analytics subcommands, anomaly detection, SIEM-ready JSON · ./demo/analytics/01-overview.sh ·

Agents query their own error rate, cost, and latency via MCP tools and adjust · ./demo/agents/04-agent-tracing.sh ·

Tiered retention, 10 identity lifecycle events, SOC 2 / ISO 27001 / HIPAA / OWASP Agentic Top 10 · ./demo/users/03-session-management.sh ·

Integrations: any provider, web publisher, extensions.

Anthropic, OpenAI, Gemini swap at the profile level · cost attribution in integer microdollars · ./demo/agents/01-list-agents.sh ·

Same binary serves your website, blog, and docs · systemprompt.io runs on this binary · ./demo/web/01-web-config.sh ·

Your code compiles into your binary via the Extension trait · no runtime reflection · ./demo/skills/04-plugin-management.sh ·

3,308 req/s burst, p99 22.7 ms · just benchmark

Claude for Work, on your infrastructure

Claude for Work ships with extension points for inference, identity, and audit. Point them at this binary and every prompt, tool call, and cost line lands in a Postgres row you own.

Developer Machine              Enterprise Gateway              Upstream Inference
  (Pi, Claude Code, curl)        (this binary, your VPC)         (pluggable)
  ───────────────── ──────────▶  ─────────────────────  ──────▶  ─────────────────
  Access token                   /v1/messages                    Anthropic direct
  Managed MCP list               Governance pipeline             Bedrock / Vertex
  Signed plugins                 Audit to Postgres               OpenAI / Groq
                                                                 On-prem vLLM / Qwen
                                                                 Air-gap capable

The same governance pipeline described above enforces scope, secrets, policy, and quota before a byte leaves your network, in-process against a cached entitlement table: p99 22.7 ms,

Route any model anywhere: the `/v1/messages` gateway

`POST /v1/messages` at the Anthropic wire format. Every inference request flows through the same governance pipeline as every tool call. A route maps a requested model pattern to a provider you declared:

gateway:
  enabled: true
  default_provider: anthropic
  routes:
    - model_pattern: "claude-*"
      provider: anthropic
    - model_pattern: "MiniMax-*"
      provider: minimax

Routes evaluate in order; first match wins. Anthropic is a transparent byte proxy; OpenAI-compatible providers get full request/response/SSE conversion. Provider declarations, CLI route configuration, route access control, and the extensible provider registry: docs/gateway-routes.md.

Prerequisites

Upgrading core

Two ways to depend on `systemprompt-core`, chosen by the `[patch.crates-io]`

blocks in `Cargo.toml` and `tests/Cargo.toml`:

# Published release from crates.io — patch blocks commented out (the default).
just core-bump X.Y.Z

# Local sibling checkout, for a core change that is not released yet —
# patch blocks uncommented in BOTH manifests, pins set to the core version.
just build

Either way the core version pin in both manifests must match the version you

are building against: with a stale pin the patch is dropped silently and

you keep building the published crates while believing you are testing local

core. Core ships its own migrations, so run the new binary once against your

database after a bump.

License

This template is MIT. Fork it, modify it, use it however you like.

**systemprompt-core** is BSL-1.1: free for evaluation, testing, and non-production use. Production use requires a commercial license. Each version converts to Apache 2.0 four years after publication. Licensing enquiries: ed@systemprompt.io.