Private, managed Claude Cowork. Five minutes from sign-up.

Sign up, get $1 of credit, download the Bridge, and Claude Cowork and Claude Desktop are configured for you automatically. Every request runs through a gateway you can see into: every prompt, every tool call, every cent, one audit trail. Most AI access is a black box someone else operates. This one shows you every row.

Built on systemprompt-core Template · MIT Core · BSL--1.1 Rust 1.75+ PostgreSQL 18+

systemprompt.io · Documentation · Guides · Discord

_{Not a diagram. A live capture: an agent tries to pass a GitHub PAT through a tool argument. Denied in under 5 ms, before the tool process spawns. One audit row. The model never saw the key.}

This repository is the source of demo.systemprompt.io, the hosted demo of systemprompt.io: a governed /v1/messages gateway you sign up for, plus the Systemprompt Bridge desktop app that connects Claude Cowork, Claude Desktop, and Claude Code to it. Built on systemprompt-core, published on crates.io as systemprompt.

From landing page to governed Claude in five steps

The hosted demo lives at demo.systemprompt.io (launching soon). This is the exact flow. No sales call, no credit card, no API key of your own: the $1 credit covers your usage.

1. Create your account with a passkey. Touch ID, Windows Hello, or a security key. No password to leak.
2. Tell us about yourself. A 30-second form.
3. Check your email. $1 of credit is waiting on your account.
4. Download the Systemprompt Bridge for macOS (Apple Silicon) or Windows.
5. Sign in with a one-time code from your setup page. The Bridge writes the MCP configuration for Claude Cowork, Claude Desktop, and Claude Code. You are done.

From that point, everything Claude does runs through your gateway. Prefer configuring a client by hand? The setup page also issues a personal access token, shown once.

What you get inside Claude

Enable the Bridge and every signed-in user gets the systemprompt MCP server: a documentation hub with four read-only tools (list_topics, get_topic, search_docs, governance_stats) over seven topics — plus fetch_remote_docs, which policy refuses on purpose — and four marketplace skills that show the platform explaining and enforcing itself.

Try these prompts in Claude Cowork or Claude Desktop:

• "What is systemprompt?" The agent lists the topics and reads the answer from the hub.
• "How does governance work here?" It pulls the governance-pipeline topic, then demonstrates a live policy denial.
• Run the demonstrate_tool_rejection skill. It reaches for an egress tool the blocklist refuses, and the call is stopped before any connection is made. That refusal is the product working.
• Run the analyse_governance_stats skill. It reads back what the session just cost and how every call was judged.

Why "private" is not a slogan here

Every inference request and every MCP tool call passes a synchronous four-stage pipeline before anything executes: scope check, secret scan (35+ credential patterns), blocklist, rate limit. Allow or deny, the decision lands in an audit row in PostgreSQL, linked from identity to agent to tool to cost.

• Your keys cannot enter the model's context. Credentials are decrypted from an encrypted store and injected into the tool subprocess environment only. The process that owns the LLM context never writes the value, and the secret scan denies any tool call that tries to smuggle one through arguments. The recording above is that denial happening.
• Your usage is a query, not a mystery. systemprompt infra logs request list shows every gateway request with model, tokens, cost, and latency. systemprompt infra logs audit <id> --full reconstructs one request end to end.
• Your $1 is enforced at the gateway. Cost is metered per request in microdollars. When the credit is gone, the gateway returns a clean 403 instead of a surprise bill.

  Claude (Cowork / Desktop / Code)
      │
      ▼
  Governance pipeline  (in-process, synchronous, <5 ms p99)
      │
      ├─ 1. Identity & scope check
      ├─ 2. Secret detection      (35+ patterns: API keys, PATs, PEM, AWS)
      ├─ 3. Blocklist             (destructive operation categories)
      └─ 4. Rate limiting         (per session, role multipliers)
      │
      ▼
  ALLOW or DENY  →  audit row, always
      │
      ▼ (ALLOW)
  spawn tool process   credentials injected here, never in the LLM context

Or host the whole funnel yourself

This repository is the source of demo.systemprompt.io. You can run the entire funnel, from splash page to credit exhaustion, on your own machine. One difference from the hosted demo: locally there is no funded gateway behind you, so setup-local asks for your own AI provider key and inference is billed to it. The $1 credit mechanics still work, they just meter spend against your key.

git clone https://github.com/systempromptio/systemprompt-demo
cd systemprompt-demo
just setup-local      # prompts for a provider key, starts Docker Postgres
just build            # compiles the workspace, runs migrations
just start            # gateway + agents + MCP server on :8080
just publish          # prerenders the public pages

Open http://localhost:8080 and walk the five steps above against your own binary. The scripted governance and analytics demos live in demo/, and the Bridge source is in bridge/.

setup-local grants no credit, so the gateway refuses inference until a grant exists — that is the exhaustion path, reached from the other side:

INSERT INTO credit_grants (id, user_id, microdollars, reason)
VALUES (gen_random_uuid(), '<user-id>', 1000000, 'local_dev');

You will need Docker, Rust 1.75+, just, and at least one AI provider key. systemprompt --help covers the rest.

License

This template is MIT. Fork it, modify it, use it however you like.

systemprompt-core is BSL-1.1: free for evaluation, testing, and non-production use. Production use requires a commercial license. Each version converts to Apache 2.0 four years after publication. Licensing enquiries: [email protected].