flowchart TD
    Client["🤖 AI Client (Claude / Cursor / Windsurf / LangChain)"]

    subgraph InboundPipeline["🔒 Inbound Security Pipeline"]
        G["1. Prompt-Injection Guardrails & RBAC"]
        D["2. Inbound Detokenization Engine"]
        B["3. JIT Ephemeral Credential Broker"]
        A1["4. Merkle Audit Signer (Ed25519)"]
        G --> D --> B --> A1
    end

    Downstream[("🗄️ Downstream Services (Postgres, Redis, Remote APIs)")]

    subgraph OutboundPipeline["🎭 Outbound Privacy Pipeline"]
        M["5. In-Flight PII Masker (AES-256-GCM Vault)"]
        A2["6. Merkle Leaf Digest & JSONL Sync"]
        M --> A2
    end

    Client -->|"1. JSON-RPC Tool Request (stdio / SSE)"| G
    A1 -->|"2. Sanitized Cleartext Request"| Downstream
    Downstream -->|"3. Raw Database / API Result"| M
    A2 -->|"4. Protected Result with Surrogate Tokens ([EMAIL_REF_...])"| Client

# Option 1: Install with Go (Zero dependencies)
go install github.com/krypton-mcp/krypton/cmd/krypton@v0.1.0-alpha

# Option 2: Pull the production Docker image
docker pull ghcr.io/muhammetemirerkut/krypton-mcp:latest

# Option 3: Build from source
git clone https://github.com/MuhammetEmirErkut/krypton-mcp.git
cd krypton-mcp
go build -o krypton ./cmd/krypton

# 1. Generate production configuration template
krypton config init --out krypton.yaml

# 2. Generate Ed25519 cryptographic audit signing keypair
krypton audit keygen --out-dir ./security-keys

{
  "mcpServers": {
    "postgres-secure": {
      "command": "/usr/local/bin/krypton",
      "args": [
        "start",
        "--config", "/path/to/krypton.yaml",
        "--",
        "npx", "-y", "@modelcontextprotocol/server-postgres", "postgresql://admin:password@localhost:5432/mydb"
      ]
    }
  }
}

# Launch SSE gateway on port 8080 proxying a remote MCP service
krypton start --transport sse --host 0.0.0.0 --port 8080 --downstream-url http://downstream-service:8001/rpc

{
  "mcpServers": {
    "secure-gateway": {
      "command": "krypton",
      "args": ["start", "--config", "./krypton.yaml"]
    }
  }
}

version: "v1"

server:
  transport: "stdio" # "stdio" or "sse"
  host: "127.0.0.1"
  port: 8080
  log_level: "info"

downstream:
  transport: "stdio" # "stdio" or "http"
  # url: "http://localhost:8001/rpc"
  command: ""
  args: []

security:
  masking_enabled: true
  guardrails_enabled: true
  audit_enabled: true
  ephemeral_creds_enabled: true

masking:
  mode: "tokenize" # "tokenize", "redact", or "hash"
  builtin_rules:
    - "email"
    - "credit_card"
    - "ssn"
    - "api_key"
    - "jwt"
    - "phone"
    - "ip_address"

guardrails:
  block_injection: true
  block_exfiltration: true
  max_prompt_size_bytes: 1048576 # 1 MB
  # Declarative Tool RBAC
  allowed_tools:
    - "*"
  denied_tools:
    - "drop_*"
    - "delete_database"
    - "execute_raw_shell"

audit:
  log_path: "./audit.jsonl"
  sign_enabled: true
  signing_key_path: "./krypton_audit.key"
  public_key_path: "./krypton_audit.pub"