Status: LiveAI productDeveloper toolsSaaS

PromptFlowEngine

Prompt engineering, security and PromptOps platform for developers and teams

One deterministic TypeScript engine that analyses, secures and optimises prompts — shipped as a web workspace, HTTP API, Chrome and VS Code extensions, a CLI and an MCP server.

Status: Public site, workspace and HTTP API live (engine v1.1.0, Nov 2026). · Period: Aug 2026 – present · Source: Private repository. The engine, CLI and MCP server are MIT-licensed in the repo.

promptflowengine.com (opens in new tab)Enterprise overview (opens in new tab)
PromptFlowEngine homepage with the headline "Engineer better prompts. Connect AI to your codebase."
Public homepage, captured Nov 2026.

01Overview

PromptFlowEngine turns a rough request plus project context into a structured engineering prompt, and checks every prompt for ambiguity, wasted tokens, prompt-injection patterns, leaked secrets and personal data before it reaches an AI tool. The same engine runs in the browser, the editor, agent hooks, CI and the hosted API.

02The problem

Developers paste prompts into AI tools with missing requirements, excess tokens and sometimes credentials or personal data. Teams adopting AI coding assistants have no consistent way to check prompt quality or enforce a policy before data leaves the machine.

03Who it is for

  • Developers using AI coding assistants
  • Teams that need AI-usage guardrails and governance
  • AI agents calling tools over MCP
  • CI pipelines gating prompt quality

04My role

Sole designer and engineer: product definition, engine design, every client surface, the Cloudflare deployment, the test suites and the CI/CD pipeline.

05Implemented features

  • Prompt analysis, restructuring, optimisation and quality scoring with requirement-preservation checks.
  • Detection of secrets, personal data and prompt-injection patterns, with local redaction.
  • Token and cost comparison across models before and after optimisation.
  • Codebase-aware VS Code workflow that turns a change request into a specification with context, constraints, edge cases, tests and acceptance criteria.
  • Chrome extension with pre-submit protection on major AI chat sites.
  • MCP server with 19 read-only tools, and CLI commands for CI gating (`promptflow check`) and agent tool-call guarding.
  • Public HTTP API that needs no key, plus a browser workspace that needs no sign-up.

06System architecture

One Cloudflare Worker serves the static Astro site from the edge and runs only for /api/* requests. Every client embeds the same engine package.

Clients
Edge
Core
Data
AI
Delivery

07Engineering challenges and approaches

Identical behaviour on six surfaces

All prompt logic lives in one pure-TypeScript package with no Node APIs, so the same code runs in the browser, the Worker, the extensions, the CLI and the MCP server. No surface re-implements a rule.

Privacy without trust assumptions

Scanning happens where the prompt is. Servers receive counts and categories only, so prompt text cannot be stored by construction. Model calls are optional and labelled, and are never required.

Shipping safely as a solo developer

Every pull request deploys a preview version. Main deploys to staging and runs smoke tests, then production behind a GitHub environment gate, with instant Wrangler rollback.

08Outcomes and current status

  • Live product with web, API, extension, CLI and MCP surfaces, all sharing one engine.
  • Playwright suites cover the website, HTTP API, MCP server, Chrome and VS Code extensions and security scans.

No usage or revenue numbers are published here unless I can verify them.

09Roadmap (not yet shipped)

  • Self-hosted AI gateway (NestJS, Postgres + pgvector, Redis): built in the repository, not deployed.
  • Wider enterprise policy and reporting features.