@anchrd/intel-api

Intel is a customer-deployed, model-agnostic operating layer for company knowledge and processes. It gives people and MCP-capable AI clients the same governed access to three surfaces:

• Knowledge — company content with sharing, immutable versions, retrieval, citations and a graph
• Flows — versioned, durable processes that reference Knowledge and Tools
• Tools — MCP capabilities discovered through a Cloudflare MCP Portal

The UI, the HTTP API and the Intel MCP surface call the same application services, so authorization, validation and side effects never differ by surface. You deploy it into your own Cloudflare account against your own Gate; nothing runs on Anchrd infrastructure.

This package contains the portable server, the Cloudflare adapter, the D1 migrations and the customer CLI.

Requirements

• A Gate instance — Gate owns identity and capabilities, and is the only required Anchrd dependency
• A Cloudflare account with Workers, D1, R2, Queues and Workflows (Vectorize and Workers AI are optional and only add semantic search and attachment conversion)
• Node 22 or newer

Install

npm install @anchrd/intel-api @anchrd/intel-ui
npx intel prepare
npx intel bootstrap
npx intel build
npx intel doctor

Use the Cloudflare export from a customer Worker:

// biome-ignore lint/performance/noBarrelFile: Wrangler needs the named Workflow entrypoint.
export { default, IntelFlowWorkflow } from "@anchrd/intel-api/cloudflare";

intel build reads an optional strict intel.json. Customer theme files override shadcn semantic tokens; SVG logo/favicon and complete language catalogs are embedded at build time. Installed builds land in .intel/ui, and migrations in .intel/migrations.

Put intel.json next to the customer project's package.json:

{
  "ui": {
    "theme": "./branding/theme.css",
    "logo": "./branding/logo.svg",
    "favicon": "./branding/favicon.svg",
    "defaultLanguage": "en",
    "languages": {}
  }
}

The theme is plain CSS containing shadcn semantic tokens such as --primary, --background, --sidebar, and --radius. It is loaded after Intel's defaults, so customer tokens win without a component fork. Unknown config fields, missing assets, non-SVG branding, and incomplete language catalogs fail the build. A ready-to-copy starting point is included under node_modules/@anchrd/intel-api/examples.

Configure customer-specific GATE_URL, INTEL_URL, and the comma-separated exact-origin allowlist TOOL_SOURCE_ORIGINS in the deployment environment. The Worker requires GATE_SERVICE_KEY and a random INTEL_SESSION_SECRET of at least 32 bytes as Wrangler secrets. ALLOW_INSECURE_OAUTH=true is only supported for explicit local development; production OAuth issuers must use HTTPS. Gate OAuth uses PKCE and dynamic public-client registration; browser access tokens stay inside an encrypted HttpOnly cookie and are never exposed to the UI bundle or D1. Copy node_modules/@anchrd/intel-api/examples/dev.vars.example to .dev.vars for a local customer Worker.

The portal endpoint exposes RFC 9728 metadata. The Tools UI follows that metadata, dynamically registers with Gate or Cloudflare Access, and completes a separate PKCE flow — silently, with prompt=none, as soon as a Gate session exists. Nobody is asked to connect anything.

⚠️ Two settings outside this repository decide whether that silent sign-in can work. In Cloudflare Zero Trust → Access controls → AI controls → your portal → Edit → Advanced settings, Managed OAuth must be enabled, and an Access policy must carry the people who use Intel. Without both, every silent sign-in is refused and the Tools area shows "No access to the company portal" — correct behaviour for somebody outside every policy, and a misleading one for a deployment that simply never enabled the setting.

The only tool secret Intel stores is the resulting per-user access token for its own portal endpoint — one per person, never one shared operator token — sealed with a key derived from INTEL_SESSION_SECRET and kept in the portal_tokens table of your D1; provider credentials stay with the portal and never reach Intel. The Intel audience token is never forwarded to another OAuth resource.

The reference Wrangler deployment binds DB, CONTENT, INDEXING, AI, SEARCH, FLOWS, and ASSETS. Create SEARCH as a 1024-dimension cosine Vectorize index for the default multilingual Workers AI @cf/baai/bge-m3 embedding adapter. FLOWS targets the exported IntelFlowWorkflow class. The portal speaks standard Streamable HTTP MCP; Intel caches schemas and unseals the caller's portal token from portal_tokens just in time, refreshing it shortly before use. Durable Flow state contains no browser, Gate, or provider credentials.

Related packages

• @anchrd/intel-ui — the browser application, built from source with your own theme
• @anchrd/intel-contract — the shared wire schemas

License

Proprietary. Published publicly for installation convenience; this is not an open-source license and grants no right to use, copy, modify or redistribute the software. Contact Anchrd for licensing.