internal/

Package alerter sends an optional, privacy-safe outbound webhook when the agent's DLP-block counter climbs past a configurable threshold within a polling window.

Package attestation produces a signed, offline-verifiable statement about what Prompt Gate build is running on a machine and how it is configured.

Package config loads and validates the YAML configuration for the Prompt Gate agent.

Package dlp implements the layered Data Loss Prevention (DLP) pipeline described in ARCHITECTURE.md section 2.

Package dns implements the embedded DNS resolver.

Package heartbeat sends an optional periodic POST to a central telemetry endpoint configured by the deployment.

Package logging exposes a global logrus logger configured at init time by the build-tagged files (logging_debug.go / logging_release.go).

Package mcp serves the Prompt Gate DLP engine as a Model Context Protocol (MCP) tool server over stdio.

Package notify provides real-time event delivery for Prompt Gate.

Package policy resolves a domain to one of three actions (allow, allow_with_dlp, deny) by combining the rule-file lookup index with the per-category policy stored in SQLite.

Package profile defines the enterprise configuration profile format and the in-memory holder used to expose the current profile to the API and tamper / heartbeat subsystems.

Per-device Root CA + on-the-fly leaf certificate issuance.

Package rules parses one-domain-per-line rule files and provides an in-memory lookup keyed by domain.

Package stats maintains the anonymous aggregate counters for the agent.

Package store wraps the SQLite persistence layer for the Prompt Gate agent.

Shell environment proxy integration for CLI/terminal tools.

Package tamper monitors the OS for evidence that the local DNS resolver or the MITM proxy configuration has been pointed away from the Prompt Gate agent.

Package updater implements agent self-update against a manifest hosted on GitHub Releases.