ONE RUST BINARY. ZERO DEPENDENCIES.
50MB contains everything. OAuth2 server, WebAuthn, MCP host, agent orchestrator, scheduler, file storage, analytics. Fully extentable. No orchestration. You own it.
Everything in 50MB
One cargo build --release produces a 50MB binary containing everything: OAuth2 authorization server, WebAuthn authentication, MCP host, agent orchestrator, scheduler, file storage, content management, and analytics. No sidecars. No orchestration. No runtime dependencies.
What other platforms require you to wire together—auth service, job runner, file storage, observability stack—SystemPrompt includes. Copy the binary to any Linux server and run it. Millisecond startup. No JIT warmup. No interpreter initialization.
Static linking means zero runtime dependencies. Predictable deployment footprint. The same binary runs in Docker, on bare metal, or in your cloud VM. One artifact. Every environment.
- Complete Stack Included — OAuth2 server, WebAuthn, MCP host, agent orchestrator, scheduler, file storage, content CMS, and analytics—all in 50MB.
- Zero Dependencies — Static linking means no runtime dependencies. No package managers, no version conflicts, no missing libraries.
- Instant Startup — Millisecond startup time. No JIT warmup, no interpreter initialization. Copy, run, serve.
Production Auth. Day One.
Most AI demos fail at "now add users." SystemPrompt ships with a complete OAuth2/OIDC authorization server and WebAuthn passwordless authentication. Not "bring your own Clerk." Not "integrate Auth0." Built in.
PKCE authorization code flows. Client credentials for service-to-service. Token introspection. Standard OIDC discovery at /.well-known/openid-configuration. Every MCP tool call, every agent interaction is authenticated and authorized against scoped permissions.
Per-user, per-agent, per-tool scopes enforced at every layer. Multi-tenant isolation is automatic—User A cannot access User B's agents, files, or data. Memory-safe credential handling with no buffer overflow vulnerabilities in your auth stack.
- OAuth2/OIDC Server — PKCE flows, client credentials, token introspection, standard OIDC discovery. Production auth without external services.
- WebAuthn Passwordless — Biometric and hardware key authentication built in. No passwords to leak. No phishing risk.
- Multi-Tenant Isolation — User A cannot access User B's agents, files, or data. Automatic tenant isolation at every layer.
MCP That Works in Production
Most MCP servers run on localhost with no authentication. That works for demos. SystemPrompt hosts MCP over HTTP with real OAuth2 protection—the same MCP servers, production-ready from day one.
Per-tool OAuth2 scopes give you granular permission control. The content:write tool requires the content:write scope. The admin:users tool requires admin. Tenant isolation is automatic—User A's Claude Code only sees User A's data.
Works immediately with Claude Code, Claude Desktop, ChatGPT, and any MCP client. HTTP-native transport. Full audit trail of every tool call: who invoked what, when, with what parameters, what result. Tokio's async runtime handles thousands of concurrent tool calls efficiently.
- Per-Tool OAuth2 Scopes — content:write tool requires content:write scope. Granular permissions enforced at every tool boundary.
- Universal MCP Client Support — Works with Claude Code, Claude Desktop, ChatGPT, and any MCP-compatible client over standard HTTPS.
- Full Audit Trail — Every tool call logged: who invoked what, when, with what parameters, what result. Debug any interaction.
Your Code. Your Binary.
SystemPrompt is a Cargo dependency, not a platform. Add systemprompt = "x.x" to your Cargo.toml, implement extension traits, compile. You own the resulting binary. We never see your code.
Extension traits for everything: ApiExtension adds HTTP routes with full Axum power. SchemaExtension adds database tables with migrations. JobExtension adds background jobs. ProviderExtension adds custom LLM providers. Type-safe interfaces—if it compiles, it works.
Compile-time discovery via the inventory crate. No runtime reflection. Zero-cost trait abstractions. Pin your SystemPrompt version. Update when YOU decide. Ship YOUR product with YOUR proprietary logic on an open core.
- Extension Traits — ApiExtension for routes, SchemaExtension for tables, JobExtension for background jobs, ProviderExtension for LLMs.
- Compile-Time Safety — Type-safe interfaces via Rust traits. If it compiles, it works. No runtime reflection, zero-cost abstractions.
- You Own the Binary — Your code compiles into YOUR binary. We never see your proprietary logic. Ship your product on an open core.
Observability Without Instrumentation
Cost tracking and audit trails are compliance requirements, not nice-to-haves. SystemPrompt captures everything automatically—no instrumentation code, no custom logging, no third-party observability stack to deploy.
Every AI request logged: tokens in, tokens out, cost estimate, latency, model, user, agent. Every tool call audited: permissions checked, execution time, result status. Query via CLI: systemprompt analytics costs --by model, systemprompt infra logs --level error.
Compliance-ready exports for SOC 2, GDPR, HIPAA. Debug any agent session end-to-end. Catch cost anomalies before the invoice arrives. Structured tracing via the tracing crate. Async-aware logging with zero runtime overhead.
- Automatic Cost Tracking — Every AI request logged: tokens in/out, cost estimate, latency, model, user, agent. No instrumentation required.
- Compliance-Ready Exports — SOC 2, GDPR, HIPAA-ready audit exports. Generate compliance reports directly from CLI queries.
- Zero-Overhead Tracing — Structured tracing via the tracing crate. Async-aware logging with zero runtime performance impact.
