Enterprise CLI Toolkit: Self-Hosted ACI Servers

Architecture Overview

All twenty-one servers share the same battle-tested architecture. One pattern, learned once, deployed twenty-one ways. Node.js built-in HTTP with zero external dependencies. 3-role RBAC. JSONL append-only stores. AES-256-GCM encryption at rest. Docker Alpine with read-only filesystem. Graceful shutdown.

Each server is a standalone Node.js process built on the built-in http module — no Express, no Fastify, no external dependencies. This eliminates supply chain risk entirely. Every request is authenticated via Bearer token, authorized against a 3-role RBAC model, logged to append-only JSONL with a correlation UUID, and served over a single HTTP port.

The servers compose naturally. xLink handles agent messaging. xPass enforces billing. xCompute coordinates MPC. xProve generates verification proofs. xBoot manages secure deployments. xGhost protects algorithms. Redact strips PII. Trust validates identity chains. Key Ceremony manages threshold key generation. Dead Drop enables anonymous share exchange. Audit Log provides tamper-evident event chains. Secure Ingest pipelines sensitive data ingestion. VaultDB stores encrypted records. Authorize enforces multi-party approval. xFuse orchestrates identity convergence. xChange handles fast key transport. xStore manages split-storage routing. Deploy one, deploy all twenty-one, or deploy any combination that matches your use case.

Shared Architecture Pattern

Port Assignments

The Server Suite

Twenty-one enterprise servers. Each self-contained with its own CLI, tests, Docker image, and documentation. Same architecture, different capabilities. Deploy the exact combination your use case requires.

Redact Enterprise

PII redaction API. Strip personally identifiable information from text, documents, and structured data before processing. SHA-256 audit trail for every redaction. Custom regex patterns for domain-specific PII (medical record numbers, account IDs, case numbers). Reversible tokenization for authorized reconstruction.

xLink Enterprise

Agent relay and messaging. DID registration, store-and-forward message relay, Ed25519 + X25519 key management. Agents connect, authenticate via DID, and exchange encrypted envelopes. Enterprise xLink adds persistent store-and-forward for offline agents and fleet-wide DID directory services.

xProve Enterprise

Proof generation and verification. All four tiers: T1 HMAC chain, T2 commit-reveal Beaver, T3 IT-MAC SPDZ-style, T4 KKW N-party MPC-in-the-Head. Generate proofs server-side for batch processing. Verify incoming proofs from clients. 32 repetitions for 128-bit security at ~50KB proof size (KKW).

xCompute Enterprise

MPC coordinator. Beaver triple pool management, session lifecycle (create/join/compute/close), configurable TTL (5-60 minutes). Coordinates multi-party computation across participants. XOR gates are Class 1 (zero communication). AND gates use pre-generated Beaver triples from the pool.

xPass Enterprise

Billing enforcement. Connection lifecycle management: create, activate, rotate, suspend, terminate. Epoch-based secret rotation (24h default). Every M2M connection is a billable unit — (DID_A, DID_B, scope). Connection secrets are XorIDA-split; decryption requires both shares.

xBoot Enterprise

Secure boot and deployment. Bundle creation (XorIDA-split deployment artifacts), manifest management (signed inventory of expected shares), revocation (immediate invalidation of compromised bundles). Ensures only authorized, unmodified code runs on target infrastructure.

xGhost Enterprise

Algorithm protection. The reference implementation. Heartbeat server for 30-second authorization cycles, algorithm upload and share management, license CRUD, HMAC-chained audit logs. The pattern all other enterprise CLIs follow. 67 tests across 6 test files.

Trust Enterprise

Identity chain validation. Challenge-response trust verification with XorIDA-split attestations. Verify agent identity, validate trust chains, and maintain continuity records. Supports multi-step verification workflows where each step produces a cryptographically linked attestation. 69 tests across 5 test files.

Key Ceremony Enterprise

Threshold key generation. Coordinate multi-party key generation ceremonies with participant management and ceremony lifecycle tracking. Generate threshold-split keys where no single participant holds the complete key. Ceremony audit trails record every participant action. 43 tests across 5 test files.

Dead Drop Enterprise

Anonymous share exchange. Time-limited, anonymous drop-and-retrieve for XorIDA shares. Senders create drops with configurable TTL; recipients retrieve with claim tokens. Expired drops are automatically purged. Zero metadata linking sender to recipient. 65 tests across 5 test files.

Audit Log Enterprise

Tamper-evident event chains. HMAC-chained audit events with hash-linked integrity. Every event contains the hash of the previous event, creating an immutable chain. Export events for SIEM ingestion. Detect any gap or modification in the chain with cryptographic proof. 41 tests across 5 test files.

Secure Ingest Enterprise

Sensitive data ingestion. Pipeline-based data ingestion with multi-stage processing. Define ingestion pipelines with validation stages, threshold checks, and routing rules. Each record is XorIDA-split at rest. Pipeline status tracking from intake through final storage. 81 tests across 5 test files.

VaultDB Enterprise

Encrypted record storage. Encrypted document vault with multi-backend support. Store, retrieve, and search encrypted records. Each record is AES-256-GCM encrypted at rest with per-record IVs. Backend management for storage providers. Full audit trail on every vault operation. 106 tests across 5 test files.

Authorize Enterprise

Multi-party approval. Threshold authorization for sensitive operations. Create authorization requests that require M-of-N approvals before proceeding. Policy engine with configurable approval thresholds, approver lists, and expiration windows. HMAC-chained audit trail for every authorization decision. 97 tests across 5 test files.

xLock Enterprise

Passwordless authentication. Push-based 1-tap authentication management. Challenge generation, device registration, and verification. XorIDA-split authentication tokens ensure no single point of compromise. 47 tests across 5 test files.

xWallet Enterprise

Credential management. Verifiable credential infrastructure with schema registry, issuance, selective disclosure, and revocation. Server stores credential metadata only — actual credentials are XorIDA-split across client-managed backends. OID4VP presentation support. 73 tests across 5 test files.

xID Enterprise

Identity wallet management. Digital identity wallet with ephemeral DID derivation. Wallet CRUD, credential import, presentation lifecycle, backup, and eIDAS compliance. Per-verifier HKDF-derived DIDs from XorIDA-split master seed with ~50µs exposure window. Master seeds never stored server-side. 83 tests across 5 test files.

xFuse Enterprise

Identity orchestration hub. The most comprehensive enterprise CLI — integrates 10 packages (xID, xPass, xLock, xStore, xCompute, Redact, xWallet, Authorize, xProve, Auditlog) into a 5-step atomic pipeline: verify → validate → evaluate → execute → log. ABAC policy engine, session-bound cryptographic identity, delegation controls, credential orchestration (OID4VP), agent accountability with human-in-the-loop gates, MPC convergence, and cancelable biometric templates. 479 tests across 11 test files.

xChange Enterprise

Key transport server. XorIDA-based key transport with ~1ms latency. Key generation, encrypt/decrypt lifecycle, bundle management. Bundle = AES-256-GCM key + IV + ciphertext, split via XorIDA for information-theoretic security. ~180x faster than split-channel V3 for real-time scenarios. 93 tests across 5 test files.

xStore Enterprise

Split-storage management. Universal split-storage layer with pluggable backends (memory, filesystem, cloud). Store instance management with XorIDA-split shares, HMAC verification before reconstruction, namespace isolation, and TTL expiry. Route shares to geographically diverse backends for regulatory compliance. 65 tests across 5 test files.

xGit Enterprise

DID watermarking. Cryptographic watermarking for source code and documents. Embed and verify DID-based provenance markers. Track document lineage across organizational boundaries with tamper-evident attribution. 78 tests across 5 test files.

Security Architecture

Every enterprise server enforces the same security model. Three RBAC roles. SHA-256 hashed API keys. AES-256-GCM encryption at rest. Append-only audit trails. Docker hardening. No exceptions, no shortcuts.

3-Role RBAC

Admin has full access: create resources, manage API keys, rotate encryption keys, read audit logs. Operator can read state and invoke operations but cannot modify configuration or access audit trails. Auditor has read-only access to resources and full access to audit logs — they see what happened but cannot change anything.

API Key Management

API keys are generated as cryptographically random tokens via crypto.getRandomValues(). Only the SHA-256 hash is stored in the JSONL key store — the plaintext key is shown once at creation time and never again. Authentication uses Bearer token in the Authorization header. Key rotation is atomic: new key activates before old key is revoked.

Encryption at Rest

All JSONL stores are encrypted with AES-256-GCM via the Web Crypto API. The encryption key is provided via environment variable ({PREFIX}_SHARE_ENCRYPTION_KEY) or fetched from a KMS in production. Each record has a unique IV. The GCM authentication tag ensures both confidentiality and integrity — tampered records are rejected on read.

Audit Trails

Every request generates a JSONL audit entry with: request_id (UUID v4 for SIEM correlation), timestamp (ISO 8601), method, path, role, outcome (success/denied/error), and latency. Audit logs are append-only — entries cannot be modified or deleted. Auditor role provides read access for compliance review and forensic analysis.

Docker Hardening

# Read-only root filesystem
--read-only

# Temporary filesystem for /tmp only
--tmpfs /tmp:rw,noexec,nosuid,size=64m

# Prevent privilege escalation
--security-opt no-new-privileges:true

# Non-root user (UID 1001)
USER appuser

# Drop all capabilities
--cap-drop ALL

# Alpine base (minimal attack surface)
FROM node:20-alpine

Deployment Guide

From docker compose up to production. Quick start in seconds, production-hardened in minutes. Every server runs offline — no phone-home, no telemetry, no external dependencies at runtime.

Quick Start

# Start all enterprise servers
docker compose up -d

# Verify all services are healthy
curl http://localhost:3200/health  # Redact
curl http://localhost:3300/health  # xLink
curl http://localhost:3400/health  # xProve
curl http://localhost:3500/health  # xCompute
curl http://localhost:3600/health  # xPass
curl http://localhost:3700/health  # xBoot
curl http://localhost:3100/health  # xGhost
curl http://localhost:3800/health  # Trust
curl http://localhost:3900/health  # Key Ceremony
curl http://localhost:4000/health  # Dead Drop
curl http://localhost:4100/health  # Audit Log
curl http://localhost:4200/health  # Secure Ingest
curl http://localhost:4300/health  # VaultDB
curl http://localhost:4400/health  # Authorize
curl http://localhost:4500/health  # xLock
curl http://localhost:4600/health  # xWallet
curl http://localhost:4700/health  # xID
curl http://localhost:4800/health  # xFuse
curl http://localhost:4900/health  # xChange
curl http://localhost:5000/health  # xStore

Environment Variables

Every server follows the same naming convention. Replace {PREFIX} with the server name (e.g., REDACT, XLINK, XPROVE).

Production Deployment

TLS reverse proxy: Place Nginx or Caddy in front of each server for TLS termination. Internal traffic between servers stays on a private Docker network.

KMS integration: In production, fetch {PREFIX}_SHARE_ENCRYPTION_KEY from AWS KMS, Azure Key Vault, or HashiCorp Vault at startup. Never hardcode encryption keys.

Network isolation: Each server listens on its own port. Use Docker network policies or firewall rules to restrict which services can communicate. xCompute should only accept connections from authenticated agents.

Air-Gapped Deployment

# On internet-connected machine: save images
docker compose build
docker save privateme-redact privateme-xlink privateme-xprove \
  privateme-xcompute privateme-xpass privateme-xboot privateme-xghost \
  privateme-trust privateme-keyceremony privateme-deaddrop \
  privateme-auditlog privateme-secureingest privateme-vaultdb \
  privateme-authorize privateme-xlock privateme-xwallet privateme-xid \
  privateme-xfuse privateme-xchange privateme-xstore privateme-xgit \
  | gzip > privateme-enterprise.tar.gz

# Transfer to air-gapped machine via USB/secure media

# On air-gapped machine: load and run
docker load < privateme-enterprise.tar.gz
docker compose up -d

# All servers run fully offline — zero phone-home

Monitoring

/health endpoints: Every server exposes GET /health returning JSON with status, uptime, and version. Wire into your existing monitoring (Prometheus, Datadog, Nagios).

Audit log analysis: JSONL audit logs are structured JSON — ingest directly into Splunk, ELK, or any SIEM. The request_id UUID enables cross-service request tracing.

SIEM integration: Forward audit logs via syslog, file shipping, or a dedicated log aggregator. Every entry has timestamp, role, action, and correlation ID — the fields your SOC team expects.

Use Cases

CLI Reference

Every enterprise CLI follows the same conventions. Standard commands, standard flags, standard exit codes. Learn one, operate all twenty-one.

Standard Commands

Every CLI ships with serve to start the HTTP server, plus domain-specific commands for its ACI. The --json flag outputs structured JSON to stdout (for scripting) while human-readable messages go to stderr.

# Every CLI has `serve`
redact serve   --port 3200 --data-dir ./data
xlink serve    --port 3300 --data-dir ./data
xprove serve   --port 3400 --data-dir ./data
xcompute serve --port 3500 --data-dir ./data
xpass serve    --port 3600 --data-dir ./data
xboot serve    --port 3700 --data-dir ./data
xghost serve   --port 3100 --data-dir ./data
trust serve    --port 3800 --data-dir ./data
keyceremony serve --port 3900 --data-dir ./data
deaddrop serve --port 4000 --data-dir ./data
auditlog serve --port 4100 --data-dir ./data
secureingest serve --port 4200 --data-dir ./data
vaultdb serve  --port 4300 --data-dir ./data
authorize serve --port 4400 --data-dir ./data
xlock serve     --port 4500 --data-dir ./data
xwallet serve  --port 4600 --data-dir ./data
xid serve      --port 4700 --data-dir ./data
xfuse serve    --port 4800 --data-dir ./data
xchange serve  --port 4900 --data-dir ./data
xstore serve   --port 5000 --data-dir ./data
xgit serve     --port 3200 --data-dir ./data

# Domain-specific commands
redact scan --input data.json --patterns hipaa --json
xghost build --source algo.js --exports "score,classify"
xghost verify --audit-log ./audit.json
xboot bundle --source ./dist --threshold "2-of-3"
xprove verify --proof ./proof.json --statement ./stmt.json

Standard Exit Codes

Config Hierarchy

Configuration resolves in order of precedence: CLI flags (highest) > environment variables > defaults (lowest). This lets you set base configuration via environment and override per-invocation via flags.

Docker Compose — All 21 Services

version: '3.8'
services:
  redact:
    image: privateme/redact-enterprise
    ports: ["3200:3200"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
    environment:
      - REDACT_SHARE_ENCRYPTION_KEY=${REDACT_KEY}
  xlink:
    image: privateme/xlink-enterprise
    ports: ["3300:3300"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xprove:
    image: privateme/xprove-enterprise
    ports: ["3400:3400"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xcompute:
    image: privateme/xcompute-enterprise
    ports: ["3500:3500"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xpass:
    image: privateme/xpass-enterprise
    ports: ["3600:3600"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xboot:
    image: privateme/xboot-enterprise
    ports: ["3700:3700"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xghost:
    image: privateme/xghost-enterprise
    ports: ["3100:3100"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  trust:
    image: privateme/trust-enterprise
    ports: ["3800:3800"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  keyceremony:
    image: privateme/keyceremony-enterprise
    ports: ["3900:3900"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  deaddrop:
    image: privateme/deaddrop-enterprise
    ports: ["4000:4000"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  auditlog:
    image: privateme/auditlog-enterprise
    ports: ["4100:4100"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  secureingest:
    image: privateme/secureingest-enterprise
    ports: ["4200:4200"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  vaultdb:
    image: privateme/vaultdb-enterprise
    ports: ["4300:4300"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  authorize:
    image: privateme/authorize-enterprise
    ports: ["4400:4400"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xlock:
    image: privateme/xlock-enterprise
    ports: ["4500:4500"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xwallet:
    image: privateme/xwallet-enterprise
    ports: ["4600:4600"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xid:
    image: privateme/xid-enterprise
    ports: ["4700:4700"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xfuse:
    image: privateme/xfuse-enterprise
    ports: ["4800:4800"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xchange:
    image: privateme/xchange-enterprise
    ports: ["4900:4900"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xstore:
    image: privateme/xstore-enterprise
    ports: ["5000:5000"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
  xgit:
    image: privateme/xgit-enterprise
    ports: ["3200:3200"]
    read_only: true
    tmpfs: ["/tmp:size=64m"]

Integration Patterns

Deploy one server or all twenty-one. Six standard patterns cover the most common enterprise deployments. Cross-service communication uses the same RBAC key management pattern — one API key model across the entire suite.

Pattern 1: Full Stack (All 21 Ports)

Deploy the complete PRIVATE.ME enterprise platform. All twenty-one servers on a single host or distributed across a cluster. Full capabilities: redaction, messaging, computation, verification, billing, deployment, algorithm protection, trust validation, key ceremonies, anonymous exchange, audit chains, secure ingestion, encrypted storage, multi-party authorization, identity fusion, key transport, split storage, and DID watermarking. Best for organizations building a comprehensive cryptographic infrastructure.

Pattern 2: Minimal (Redact + xLink)

PII redaction with authenticated agent relay. Two servers, two ports. Redact strips sensitive data; xLink provides DID-authenticated message delivery. Deploy when you need to process sensitive data across organizational boundaries without exposing PII.

Pattern 3: Computation (xCompute + xProve)

Privacy-preserving computation with verifiable proof. xCompute coordinates MPC sessions; xProve generates proofs of correct execution. Deploy when multiple parties need to compute over shared data without revealing their inputs to each other — credit scoring, collaborative analytics, joint risk assessment.

Pattern 4: Protection (xGhost + xPass + xBoot)

Algorithm protection with billing enforcement and secure deployment. xGhost protects the code, xPass enforces payment, xBoot ensures only authorized builds run. Deploy when you license proprietary algorithms to customers and need cryptographic enforcement of both IP protection and subscription compliance.

Pattern Summary

Platform Statistics

The Enterprise CLI Toolkit is part of the PRIVATE.ME platform — 94 packages, 7,207+ tests, 140 ACIs. Twenty-one enterprise servers extend the platform to your infrastructure.

Benchmarks

Performance and test coverage across all 21 Enterprise CLI servers. Each server cold-starts in under 100ms and handles typical API operations in under 5ms.

Enterprise Deployment Comparison

Honest Limitations

Five known limitations documented transparently. The Enterprise CLI Toolkit prioritizes simplicity and air-gap capability over enterprise-scale orchestration.

Verifiable Enterprise Operations

Every enterprise server operation produces a verifiable audit trail via xProve. HMAC-chained integrity proofs confirm that data was processed correctly, access was authorized, and results are tamper-evident.

Ready to deploy Enterprise CLI Toolkit?

Talk to Sol, our AI platform engineer, or book a live demo with our team.