系统提示词治理框架

Install the bridge credential helper

The systemprompt-bridge binary is the Credential helper script slot in Claude for Work. It turns a PAT into a short-lived JWT that Claude Desktop merges into every inference request routed at this binary. Download the prebuilt macOS, Windows, or Linux binary from systempromptio/systemprompt-core releases.

Current release: bridge-v0.9.0 — Linux x86_64, Windows x86_64 (MSVC ABI), macOS aarch64 (cosign-signed).

1. Download

Linux x86_64

curl -fsSL -o /usr/local/bin/systemprompt-bridge \
  https://github.com/systempromptio/systemprompt-core/releases/download/bridge-v0.9.0/systemprompt-bridge-x86_64-unknown-linux-gnu
chmod +x /usr/local/bin/systemprompt-bridge
curl -fsSL -O https://github.com/systempromptio/systemprompt-core/releases/download/bridge-v0.9.0/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

Windows x86_64 (PowerShell as Administrator):

$dir = "C:\Program Files\systemprompt"
New-Item -ItemType Directory -Force -Path $dir | Out-Null
Invoke-WebRequest `
  -Uri "https://github.com/systempromptio/systemprompt-core/releases/download/bridge-v0.9.0/systemprompt-bridge-x86_64-pc-windows-msvc.exe" `
  -OutFile "$dir\systemprompt-bridge.exe"
[Environment]::SetEnvironmentVariable("PATH", "$env:PATH;$dir", "User")

Windows Smart Screen will flag the unsigned binary on first run → "More info" → "Run anyway".

macOS (source build):

git clone https://github.com/systempromptio/systemprompt-core.git
cd systemprompt-core
cargo build --manifest-path bin/bridge/Cargo.toml --release \
  --target "$(rustc -vV | awk '/host:/ {print $2}')"
sudo install -m 755 \
  "bin/bridge/target/$(rustc -vV | awk '/host:/ {print $2}')/release/systemprompt-bridge" \
  /usr/local/bin/

2. Configure

Linux/macOS: ~/.config/systemprompt/systemprompt-bridge.toml Windows: %APPDATA%\systemprompt\systemprompt-bridge.toml

[gateway]
url = "http://localhost:8080"   # for the local-trial template; swap to your production host

[pat]
token = "sp-live-your-personal-access-token"

Issue a PAT from the running binary with systemprompt admin users pat issue <user-id> --name bridge-laptop. Absent config sections are silently skipped. Dev overrides: SP_BRIDGE_GATEWAY_URL, SP_BRIDGE_PAT.

3. Verify

systemprompt-bridge           # prints exactly one JSON {token, ttl, headers}
systemprompt-bridge --check   # exits 0 if a token can be issued

Diagnostics go to stderr only. The stdout JSON matches Anthropic's inferenceCredentialHelper contract byte-for-byte.

4. Point Claude Desktop at it

In Claude Desktop Enterprise → Settings → Inference:

• Credential helper script: /usr/local/bin/systemprompt-bridge (or C:\Program Files\systemprompt\systemprompt-bridge.exe).
• API base URL: the gateway.url from your TOML.

Every Claude Desktop request now lands a row in ai_requests with user_id, tenant_id, session_id, trace_id, tokens, cost, and latency — identical governance to every other tool call. Run systemprompt infra logs audit <request-id> --full after a prompt to see the trace end-to-end.

5. (Optional) Install the org-plugins/ sync agent

The same binary manages the bridge's signed plugin / managed-MCP mount:

systemprompt-bridge install     # register launchd (macOS) / scheduled task (Windows) / systemd --user (Linux)
systemprompt-bridge sync        # pull signed plugin manifest + allowlist now
systemprompt-bridge validate    # verify the ed25519 signature
systemprompt-bridge uninstall   # remove

Mount targets: /Library/Application Support/Claude/org-plugins/ (macOS), C:\ProgramData\Claude\org-plugins\ (Windows), ${XDG_DATA_HOME:-$HOME/.local/share}/Claude/org-plugins/ (Linux).

</details>

---

Quick start

git clone https://github.com/systempromptio/systemprompt-template
cd systemprompt-template
just setup-local <anthropic_key> [openai_key] [gemini_key]   # writes profile, starts Postgres, runs publish pipeline
just start                                                   # serves governance + agents + MCP + admin on :8080

One AI key is required; the other two are optional. Running a second clone side-by-side? just setup-local <keys> 8081 5433. Discover the CLI with systemprompt --help.

<details> <summary><strong>Prerequisites</strong></summary>

<br>

</details>

---

<details> <summary><strong>What a CISO gets</strong></summary>

<br>

• A single query answers every AI audit. Every request, scope decision, tool call, model output, and cost lands in one 18-column Postgres table. Six correlation columns (UserId, SessionId, TaskId, TraceId, ContextId, ClientId) bind identity at construction time, so a row without a trace is a programming error.
• Credentials physically cannot enter the context window. The governance process is the parent of every MCP tool subprocess. Keys are decrypted from a ChaCha20-Poly1305 store and injected into the child's environment by Command::spawn(). The parent, which owns the LLM context, never writes the value. 35+ regex patterns deny any tool call that tries to pass a secret through arguments.
• Self-hosted, air-gap capable, single artifact. One Rust binary. One PostgreSQL. No Redis, no Kafka, no Kubernetes, no SaaS handoff. The same binary runs on a laptop, a VM, and an air-gapped appliance without modification. Zero outbound telemetry by default.
• Policy-as-code on PreToolUse hooks. Destructive operations, blocklists, department scoping, six-tier RBAC (Admin, User, Service, A2A, MCP, Anonymous). Rate limiting at 300 req/min per session with role multipliers. Every deny reason is structured and auditable.
• Certifications-ready, not certification-marketing. Tiered log retention from debug (1 day) through error (90 days). 10 identity lifecycle event variants. SIEM-ready JSON events for Splunk, ELK, Datadog, Sumo. Built for SOC 2 Type II, ISO 27001, HIPAA, and the OWASP Agentic Top 10.

This repo is the evaluation template. Fork it, clone it, compile it. 43 scripted demos execute every claim above against the live binary on your own laptop.

</details>

<details> <summary><strong>What you'll see in the first five minutes</strong></summary>

<br>

• http://localhost:8080 — admin UI, live audit table, session viewer.
• systemprompt analytics overview — conversations, tool calls, costs in microdollars, anomalies flagged above 2x/3x of rolling average.
• systemprompt infra logs audit <request-id> --full — the full trace for any request: identity, scope, rule evaluations, tool call, model output, cost. One query, one row, one answer.
• Point Claude Code, Claude Desktop, or any MCP client at it. Permissions follow the user, not the client. Try to exfiltrate a key through a tool argument and watch the secret-detection layer deny it before the tool process spawns.
• ./demo/governance/06-secret-breach.sh — the scripted version of that denial, recorded above.

</details>

<details> <summary><strong>The scripted demos</strong></summary>

<br>

```bash ./demo/00-preflight.sh # acquire token, verify services, create admin ./demo/01-seed-data.sh # populate analytics + trace data

How it compares

Manual install is tested and works end-to-end today; signed installers, MDM packages, and Homebrew / winget distribution land in a later release. Install steps in the Advanced fold below.

</details>

<details> <summary><strong>Advanced — gateway routes, bridge install, org-plugins sync</strong></summary>

<br>

Manual install is tested end-to-end. Automated distribution — signed installers, MDM packages, Homebrew / winget — is in progress; today you download a binary and drop a TOML file, documented below.