Build on a secure path.

Clone the repository, configure secrets, apply migrations, and bring the stack up. The compose file starts PostgreSQL, Redis, OPA, the gateway, the SOC workers, the nightly red-team scheduler, and the legacy admin console.

git clone https://github.com/protexct/protexct.git
cd protexct
cp .env.example .env         # DATABASE_URL, REDIS_URL, JWT key paths,
                             # API_KEY_ENCRYPTION_KEY, ALLOWED_ORIGINS...

# Apply migrations in numeric order (owner credentials):
psql "$DATABASE_URL" -f db/migrations/001_initial_schema.sql
psql "$DATABASE_URL" -f db/migrations/002_rls_policies.sql
# ... through 011_request_traces.sql

docker compose up -d
curl http://localhost:8011/healthz   # {"status":"ok"}

# Optional: seed a demo tenant + admin + API key
python db/seed_demo.py --dsn "$DATABASE_URL"

Export the GUARD model once before first boot so the gateway can load its classifier:

python models/guard/export_onnx.py   # writes models/guard/checkpoints/guard.onnx

Point your agent at the gateway instead of the provider. The gateway authenticates the call, classifies the prompt, enforces policy, scrubs PII, forwards, and scans the response.

import httpx

resp = httpx.post(
    "https://api.protexct.com/call_tool",
    headers={"Authorization": f"Bearer {PROTEXCT_API_KEY}"},
    json={
        "upstream_url": "https://api.openai.com/v1/chat/completions",
        "payload": {
            "model": "gpt-4o-mini",
            "messages": [{"role": "user", "content": "hi"}],
        },
        "tool": "chat_completion",
    },
)
print(resp.json())

Prefer zero code change? Store your real provider key as a virtual key (Dashboard → Virtual Keys), hand the agent a protexct_vk_ key, and the gateway resolves the provider endpoint server-side — the agent never chooses the upstream URL.

MCP clients (Claude Desktop, Cursor) connect natively: remote clients use /mcp/sse, local clients use the stdio bridge over /mcp/ws.

Agents authenticate with scoped API keys or virtual keys; humans sign in to the dashboard with RS256 JWT sessions.

• API keys: protexct_live_sk_ /protexct_test_sk_ + 32 random bytes, SHA-256 hashed at rest, shown once.
• Virtual keys: protexct_vk_ + 32 random bytes; resolves to the AES-256-GCM-sealed provider key at forward time.
• Dashboard JWTs expire hourly; refresh tokens rotate on every use.

# Create an API key (dashboard admin session required)
curl -X POST https://api.protexct.com/api-keys \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"prod-agent","scope":"write","environment":"live"}'

The surface groups cleanly; every route is tenant-scoped.

Thin wrappers around the same gateway contract:

pip install protexct-guard

from langchain_openai import ChatOpenAI
from protexct_guard import ProtexctCallback

llm = ChatOpenAI(callbacks=[ProtexctCallback()])

from protexct_guard import protect

@protect
def research_node(state):
    ...

npm install @protexct/guard

import { ProtexctGuard } from '@protexct/guard'

const guarded = new ProtexctGuard(openaiClient)

FastAPI, Django, and Express middleware ship in the same packages for edge-of-stack enforcement.

Compose services and their cloud counterparts:

Required environment: DATABASE_URL, REDIS_URL, JWT key paths, API_KEY_ENCRYPTION_KEY, S3 credentials for audit logs, ALLOWED_ORIGINS, and ENVIRONMENT=production in prod (disables /docs and enforces stricter guards). See the README for the full template.

Ready? Create an account or head back to the live demo.