Added Environmental setting of LAKERA_URL and LAKERA_RESULTS_URL

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.gitignore
+__pycache__/
+*.pyc
+venv/
+.env
+node_modules/

.gitignore

@@ -4,6 +4,7 @@ __pycache__/
 *.py[cod]
 *$py.class
 *.so
+*.box
 .Python
 build/
 develop-eggs/

Dockerfile

@@ -1,57 +1,83 @@
-# -------- Stage 1: Builder --------
+# ============================
+# Stage 1 — Python Builder
+# ============================
 FROM python:3.12-slim AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     VIRTUAL_ENV=/opt/venv
 
-# Install build dependencies in one layer and clean up
+# System deps for building Python wheels
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         git \
         build-essential \
         python3-dev && \
-    python -m venv $VIRTUAL_ENV
+    python -m venv $VIRTUAL_ENV && \
+    rm -rf /var/lib/apt/lists/*
 
 ENV PATH="$VIRTUAL_ENV/bin:$PATH"
 
 COPY requirements.txt .
 RUN pip install --no-cache-dir --upgrade pip && \
     pip install --no-cache-dir -r requirements.txt
 
-# Clone demo client and remove unnecessary files immediately
-RUN git clone --depth 1 https://github.com/lakeraai/guard-demo-client /home/lakeraai && \
+# Clone frontend repo
+RUN git clone --depth 1 https://github.com/vmummer/guard-demo-client /home/lakeraai && \
     rm -rf /home/lakeraai/.git
 
-# -------- Stage 2: Final Image --------
-# Using a single-layer approach for runtime dependencies
+
+# ============================
+# Stage 2 — Final Runtime Image
+# ============================
 FROM python:3.12-slim
 
-ENV VIRTUAL_ENV=/opt/venv \
+ENV PYTHONUNBUFFERED=1 \
+    VIRTUAL_ENV=/opt/venv \
     PATH="/opt/venv/bin:$PATH" \
-    PYTHONUNBUFFERED=1 \
-    NODE_MAJOR=20
+    NODE_MAJOR=20 \
+    BROWSERSLIST_UPDATE_DB=0
 
 WORKDIR /home/lakeraai
 
-# Combine all system setup: Node.js, Curl, and Cleanup
+# Create non-root user
+RUN groupadd -g 10001 appuser && \
+    useradd -u 10001 -g appuser -m -s /usr/sbin/nologin lakeraai-user
+
+# Install Node.js (clean, multi-arch safe)
 RUN apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates gnupg && \
     mkdir -p /etc/apt/keyrings && \
-    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
-    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \
+    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+      | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
+    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \
+      > /etc/apt/sources.list.d/nodesource.list && \
     apt-get update && \
     apt-get install -y --no-install-recommends nodejs && \
-    # Remove package lists to save space
-    apt-get purge -y --auto-remove gnupg && \
+    apt-get purge -y --auto-remove gnupg curl && \
     rm -rf /var/lib/apt/lists/*
 
-# Copy only necessary artifacts from builder
-COPY --from=builder $VIRTUAL_ENV $VIRTUAL_ENV
-COPY --from=builder /home/lakeraai /home/lakeraai
+# Copy Python venv + frontend code from builder
+COPY --from=builder --chown=lakeraai-user:appuser $VIRTUAL_ENV $VIRTUAL_ENV
+COPY --from=builder --chown=lakeraai-user:appuser /home/lakeraai /home/lakeraai
+
+# Copy backend code
+COPY --chown=lakeraai-user:appuser . .
+
+# Install frontend deps at build time (NOT runtime)
+#RUN npm ci --omit=dev || npm install --omit=dev
+
+RUN npm ci  || npm install || npm run build 
+
+# Fix permissions for non-root user
+
+RUN  mkdir -p /home/lakeraai/chroma && \
+     mkdir -p /home/lakeraai/backend/data/chroma && \
+     mkdir -p /home/lakeraai/data/chroma && \
+     chown -R lakeraai-user:appuser /home/lakeraai && \
+     chmod -R g+w /home/lakeraai
 
-# Copy local files (ensure .dockerignore excludes node_modules or venv)
-COPY . .
+USER lakeraai-user
 
 EXPOSE 8000
 

Dockerfile.box

@@ -0,0 +1,58 @@
+# -------- Stage 1: Builder --------
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    VIRTUAL_ENV=/opt/venv
+
+# Install build dependencies in one layer and clean up
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        git \
+        build-essential \
+        python3-dev && \
+    python -m venv $VIRTUAL_ENV
+
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir --upgrade pip && \
+    pip install --no-cache-dir -r requirements.txt
+
+# Clone demo client and remove unnecessary files immediately
+RUN git clone --depth 1 https://github.com/lakeraai/guard-demo-client /home/lakeraai && \
+    rm -rf /home/lakeraai/.git
+
+# -------- Stage 2: Final Image --------
+# Using a single-layer approach for runtime dependencies
+FROM python:3.12-slim
+
+ENV VIRTUAL_ENV=/opt/venv \
+    PATH="/opt/venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    NODE_MAJOR=20
+
+WORKDIR /home/lakeraai
+
+# Combine all system setup: Node.js, Curl, and Cleanup
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl ca-certificates gnupg && \
+    mkdir -p /etc/apt/keyrings && \
+    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
+    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends nodejs && \
+    # Remove package lists to save space
+    apt-get purge -y --auto-remove gnupg && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copy only necessary artifacts from builder
+COPY --from=builder $VIRTUAL_ENV $VIRTUAL_ENV
+COPY --from=builder /home/lakeraai /home/lakeraai
+
+# Copy local files (ensure .dockerignore excludes node_modules or venv)
+COPY . .
+
+EXPOSE 8000
+
+CMD ["python", "start_all.py"]

Helm Chart.md

@@ -0,0 +1,44 @@
+
+<img width="599" height="331" alt="image" src="https://github.com/user-attachments/assets/192e685e-ec1a-42e2-a349-811e91116f04" />
+
+# Deploying the Check Point AI Guardrails Demo in Kubernetes Cluster via a Helm Chart
+
+These instructions should work for a standard Kubernetes Cluster. x86 (amd64) & arm64 based deployments
+
+---
+
+## Deploy the Toolhive Operator CRDS and Toolhive Operator
+```bash
+helm upgrade --install toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-operator-crds 
+
+helm upgrade --install toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-operator -n checkpoint --create-namespace
+```  
+
+## Deploy the Check Point AI Guardrails Demo Helm Chart 
+**Mac / Windows:**
+
+```bash
+ helm upgrade --install  cpaiguard oci://registry-1.docker.io/vmummer/cpaiguard  --version 0.2.0 -n checkpoint --create-namespace 
+```
+Options:
+
+  --set guarddemo.volumePaths.data="/home/checkpoint/guard-data" \
+  --set guarddemo.volumePaths.upload="/home/checkpoint/guard-data/uploads" \
+  --set guarddemo.replicas=1 \
+  --set ingress.host="172.20.27.76.nip.io" \
+  --set env.OPENAI_BASE_URL="http://your-ollama-url"      <<< Optional - Remove to default to OpenAI API
+```
+
+
+# Admin Console Settings
+
+Verify the Toolhive Fetch is set to the following:
+
+Fetch
+Type:  HTTP(MCP Endpoint)
+Endpoint:  http://mcp-cpaiguard-fetch-proxy:8080/mcp      (Note:  If you deploy the Toolhive in its own namespace, you must change it here. In this helm chart, it defaults to checkpoint namespace)
+
+
+Files
+Type: MCP (SSE Endpoint)
+Endpoint:  http://mcp-cpaiguard-filesystem-proxy:8080/mcp   (Note:  If you deploy the Toolhive in its own namespace, you must change it here. In this helm chart, it defaults to checkpoint namespace)

Kurbernetes/Readme.md

@@ -0,0 +1,46 @@
+
+<img width="952" height="533" alt="image" src="https://github.com/user-attachments/assets/61a08f8f-bf34-4076-bc54-050b63c0fc6f" />
+
+
+
+# Deploying the Check Point AI Guardrails Demo in Kubernetes Cluster via a Helm Chart
+
+These instructions should work for a standard Kubernetes Cluster. x86 (amd64) & arm64 based deployments
+
+---
+
+## Deploy the Toolhive Operator CRDS and Toolhive Operator
+```bash
+helm upgrade --install toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-operator-crds 
+
+helm upgrade --install toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-operator -n checkpoint --create-namespace
+```  
+
+## Deploy the Check Point AI Guardrails Demo Helm Chart 
+**Mac / Windows:**
+
+```bash
+ helm upgrade --install  cpaiguard oci://registry-1.docker.io/vmummer/cpaiguard  --version 0.2.0 -n checkpoint --create-namespace 
+```
+Options:
+
+  --set guarddemo.volumePaths.data="/home/checkpoint/guard-data" \
+  --set guarddemo.volumePaths.upload="/home/checkpoint/guard-data/uploads" \
+  --set guarddemo.replicas=1 \
+  --set ingress.host="172.20.27.76.nip.io" \
+  --set env.OPENAI_BASE_URL="http://your-ollama-url"
+```
+
+
+# Admin Console Settings
+
+Verify the Toolhive Fetch is set to the following:
+
+Fetch
+Type:  HTTP(MCP Endpoint)
+Endpoint:  http://mcp-cpaiguard-fetch-proxy:8080/mcp      (Note:  If you deploy the Toolhive in its own namespace, you must change it here. In this helm chart, it defaults to checkpoint namespace)
+
+
+Files
+Type: MCP (SSE Endpoint)
+Endpoint:  http://mcp-cpaiguard-filesystem-proxy:8080/mcp   (Note:  If you deploy the Toolhive in its own namespace, you must change it here. In this helm chart, it defaults to checkpoint namespace)

README.md

@@ -231,16 +231,19 @@ All API routes are under the `/api` prefix.
 - `POST /api/chat` - Send message to AI assistant
 
 ### RAG
-- `POST /api/rag/upload` - Upload documents
+- `POST /api/rag/upload` - Upload and Ingest documents
 - `POST /api/rag/generate` - Generate AI content
 - `GET /api/rag/search` - Search stored content
+- `GET /api/rag/sources` - Request all RAG sources
+- `GET /api/rag/clear` -  Clear All RAG content 
 
 ### Tools
 - `GET /api/tools` - List tools
 - `POST /api/tools` - Create tool
 - `PUT /api/tools/{id}` - Update tool
 - `DELETE /api/tools/{id}` - Delete tool
 - `POST /api/tools/test/{id}` - Test tool
+- `GET /api/tools/{id}/capabilities` - Request Capabilities of an MCP Tool
 
 ### Lakera
 - `GET /api/lakera/last` - Get last guardrail result
@@ -253,6 +256,10 @@ All API routes are under the `/api` prefix.
 - `DELETE /api/demo-prompts/{id}` - Delete demo prompt
 - `POST /api/demo-prompts/{id}/use` - Track prompt usage
 
+### AI Models
+- `GET /api/models` - Request available Models
+- `GET /api/embeddings-models` - Request available Embedding Models
+
 ## 📁 Project Structure
 
 ```

backend/lakera.py

@@ -1,9 +1,10 @@
+import os
 from typing import Any, Dict, List, Optional
 
 import httpx
 
-LAKERA_URL = "https://api.lakera.ai/v2/guard"
-LAKERA_RESULTS_URL = "https://api.lakera.ai/v2/guard/results"
+LAKERA_URL = os.environ.get("LAKERA_URL", "https://api.lakera.ai/v2/guard")
+LAKERA_RESULTS_URL = os.environ.get("LAKERA_RESULTS_URL", "https://api.lakera.ai/v2/guard/results")
 
 # /guard/results returns confidence levels; treat these as detector hits for UI surfacing.
 _RESULTS_DETECTED_LEVELS = frozenset({"l1_confident", "l2_very_likely", "l3_likely"})