systemprompt

Start with control

SystemPrompt puts a policy boundary between your AI clients and the models and tools you connect. Permissions follow the authenticated user; audit records connect identity, policy decisions, tool activity and inference cost.

What you control	How
Model access	Route supported clients through the gateway and grant or deny access per user.
Tool execution	Check scope, credential patterns, blocklists and rate limits on governed MCP calls before execution.
Audit data	Keep request records and correlated tool traces in your PostgreSQL database.
Deployment	Run the compiled runtime on your infrastructure, with PostgreSQL as its required database.
Domain capabilities	Add Rust extensions for your integrations, policies and application behavior.

This repository is the evaluation template: Core plus configuration, an admin UI, extensions and executable demos. Use it to evaluate enforcement and as the starting point for your own deployment.

Quick start

Install Docker, just and Rust through rustup. The repo pins its toolchain in rust-toolchain.toml; the workspace requires Rust 1.96+. Local setup provisions PostgreSQL 18 and asks for an AI provider key.

git clone https://github.com/systempromptio/systemprompt-template
cd systemprompt-template
just setup-local
just start

Open http://localhost:8080. Setup builds the binary, provisions the local profile and database, runs migrations and publishes assets. Inference uses your chosen provider account.

For non-interactive setup, pass provider keys as documented in the installation guide. That guide also covers containers, deployment platforms and alternate ports.

Run the proof

Start with an allowed tool call, then a denied one:

./demo/00-preflight.sh
./demo/01-seed-data.sh
./demo/governance/01-happy-path.sh
./demo/governance/05-governance-denied.sh
./demo/governance/06-secret-breach.sh

Inspect the resulting decisions and traces in the admin UI. The demo index explains prerequisites and which scripts invoke paid models.

For a third-party client, follow the Pi walkthrough. Connect Pi to the gateway, make a request, disable that user's model in Model Selection (/admin/models), then retry. The denied request appears in the audit view (/admin/requests). Access tokens are managed at /admin/access-tokens.

Gateway routing governs inference sent through that endpoint. The Pi integration also installs hooks for prompt and local tool checks; connecting a model endpoint alone does not govern arbitrary local commands.

Build your capabilities into the runtime

SystemPrompt Core + your Rust extensions + your configuration
                            ↓
                  Your compiled deployment
                            ↓
                       PostgreSQL

Core supplies shared identity, gateway, MCP, policy and audit capabilities. You supply the domain behavior. Configure agents, providers, MCP servers and scheduled work under services/; implement application capabilities in extensions/.

Extensions register at compile/link time and are discovered and dependency-validated at startup. They can contribute routes, tools, jobs, schemas and migrations. Compiled extensions are trusted code sharing the runtime process; external MCP servers can run as separate processes.

The host entry point stays thin because it delegates to Core. Explore the Core API and this repo's web extension to see the composition model.

Deployment and security boundaries

Keep governance and audit storage inside your perimeter. Air-gapped operation requires locally available models, tools and dependencies; cloud inference still sends requests to the selected provider.

Tool credentials can be supplied to subprocess environments without requiring their inclusion in model context. Pattern scanning checks for recognizable credentials in governed arguments. Tool code, its outputs and its network access remain part of your security boundary.

See the deployment guides and reproducible performance demos for evaluation details.

License and next steps

This template is MIT licensed. Core is BSL-1.1, available for evaluation, testing and non-production use under its license terms. Production use requires a commercial license; each Core version converts to Apache-2.0 four years after publication.

Evaluate the hosted demo · Inspect Core · Discuss production licensing