flowchart TB
    subgraph Agent["AI Agent (Claude Code / Cursor / ...)"]
        A[LLM]
        SK[Built-in SKILL.md<br/>rules: never cat .env<br/>values via value_file]
    end

    subgraph MCP["keysmith (Go, single binary)"]
        T[tools<br/>list/get/put/rotate/delete]
        R[resources<br/>secret://secrets masked view]
        M["internal/mcp<br/>MCP Server"]
    end

    subgraph Store["internal/store (age encrypted)"]
        K[key.txt<br/>0600 private key]
        E[secrets.enc<br/>armor ciphertext]
    end

    subgraph Mask["internal/mask"]
        MR[masking rules<br/>prefix/entropy/URL segmentation]
    end

    A -->|"pass handles, not plaintext"| SK
    SK -->|"MCP protocol calls"| M
    M --> T
    M --> R
    T -->|"set/get/rotate"| Store
    R -->|"list masked view"| Store
    Store -->|"decrypt in memory"| Mask
    Mask -->|"masked output"| T
    Mask -->|"masked output"| R

flowchart TB
    subgraph Core["Core primitives"]
        STORE[age encrypted store<br/>internal/store]
        MASK[masking rules<br/>internal/mask]
        SCAN[leak scan + self-healing<br/>keysmith scan --rotate]
        VAULT[Vault short-TTL creds<br/>internal/vault]
    end

    subgraph Auto["Automation"]
        CRON[scheduled leak scan<br/>scripts/scan-cron.sh]
    end

    subgraph Access["Access"]
        STDIO[stdio]
        SSE[SSE -http]
        STREAM[Streamable -streamable]
    end

    SCAN -->|scheduled| CRON
    STORE --> SCAN
    MASK --> STORE
    VAULT -.->|optional backend| STORE
    STDIO -.-> SSE
    SSE -.-> STREAM