Internet
                             |
                    +--------+--------+
                    |                 |
             zt-api.hanzo.ai    zt.hanzo.ai
              (Controller)       (Console)
                    |                 |
                    v                 v
    +-------------------------------+----------+
    |          hanzo-zt namespace               |
    |                                           |
    |   +------------------+                    |
    |   |    Controller    |  Identity authority |
    |   |    port 1280     |  PKI, policies,    |
    |   |    (LB:443)      |  sessions          |
    |   +--------+---------+                    |
    |            |                              |
    |     +------+------+                       |
    |     |             |                       |
    |   +-v----+   +----v---+   +------------+  |
    |   |Router|   | Router |   | zrok       |  |
    |   | 3022 |   |  3022  |   | Controller |  |
    |   +--+---+   +---+----+   | 18080      |  |
    |      |           |        +-----+------+  |
    |      +-----+-----+              |         |
    |            |              +-----v------+  |
    |            |              | MCP Gateway |  |
    |            |              | @hanzo/mcp  |  |
    |            |              +-------------+  |
    +-------------------------------+-----------+
                 |
      +----------+----------+
      |          |          |
   +--v--+   +--v--+   +--v--+
   | SDK |   | SDK |   | SDK |
   | Go  |   | C   |   |Node |
   +-----+   +-----+   +-----+
   App A      App B      App C

# Tag identities
hanzo zt update identity my-service \
  --role-attributes "production,backend,team-infra"

# Policy references attributes, not names
hanzo zt create service-policy prod-access Dial \
  --identity-roles '#production,#backend' \
  --service-roles '#internal-apis'

# Create a service backed by a local TCP server
hanzo zt create config my-api-intercept intercept.v1 \
  '{"protocols":["tcp"],"addresses":["my-api.hanzo.internal"],"portRanges":[{"low":443,"high":443}]}'

hanzo zt create config my-api-host host.v1 \
  '{"protocol":"tcp","address":"localhost","port":8080}'

hanzo zt create service my-api \
  --configs my-api-intercept,my-api-host \
  --role-attributes "api-services"

#attribute   -- All identities with this attribute
@name        -- A specific identity by name
*            -- All identities (use with caution)

Client App          ZT SDK          Edge Router        Hosting Router      Server App
    |                  |                 |                    |                  |
    |--- dial("svc") ->|                 |                    |                  |
    |                  |-- session ------>|                    |                  |
    |                  |                 |-- policy check --->|                  |
    |                  |                 |<-- authorized -----|                  |
    |                  |<-- circuit -----|-------- mTLS ----->|                  |
    |                  |                 |                    |--- connect ----->|
    |<===== encrypted bidirectional data channel =============================>|

# MCP Gateway config
aggregator:
  name: "hanzo-tools"
backends:
  - id: hanzo-mcp
    transport:
      type: stdio
      command: npx
      args: ["-y", "@hanzo/mcp"]
  - id: custom-tools
    transport:
      type: stdio
      command: python
      args: ["-m", "my_mcp_server"]

from hanzoai.mcp import MCPClient

# Connect through the ZT mesh -- no direct network access needed
client = MCPClient(
    gateway="hanzo-tools",
    identity="./agent-identity.json"
)

tools = await client.list_tools()
result = await client.call_tool("search", {"query": "latest papers"})

import "github.com/hanzozt/sdk-golang/ziti"

cfg, _ := ziti.NewConfigFromFile("identity.json")
ctx, _ := ziti.NewContext(cfg)

// Listen on the overlay (bind a service)
listener, _ := ctx.Listen("my-service")
defer listener.Close()

for {
    conn, _ := listener.Accept()
    go handleConnection(conn)
}

const ziti = require('@hanzozt/sdk-nodejs')

await ziti.init('identity.json')

// Dial a service
const conn = await ziti.dial('my-service')
conn.write('Hello from Node.js')

import hanzozt

ctx = hanzozt.Context("identity.json")

# Connect to a service by name
sock = ctx.dial("my-service")
sock.send(b"Hello from Python")
response = sock.recv(4096)

#include <hanzozt/ziti.h>

ziti_context ztx;
ziti_config cfg;

ziti_load_config(&cfg, "identity.json");
ziti_init(&ztx, &cfg);

// Dial
ziti_connection conn;
ziti_dial(conn, "my-service", on_connect, on_data);

# Controller
Deployment: 1 replica, Recreate strategy
PVC: 2Gi (persistent PKI and config)
Service: LoadBalancer (443 -> 1280)
Resources: 100m-500m CPU, 256Mi-512Mi RAM

# Router
Deployment: 1 replica
Storage: emptyDir (ephemeral, re-enrolls on restart)
Service: ClusterIP (3022)
Resources: 50m-250m CPU, 128Mi-256Mi RAM

# MCP Gateway
Deployment: 1 replica, Recreate strategy
PVC: 100Mi (zrok environment state)
Resources: 50m-250m CPU, 128Mi-256Mi RAM

# Share localhost:3000 through the ZT mesh
hanzo zt share private localhost:3000

# Output: Access your share at: <share-token>

# From any enrolled identity
hanzo zt access private <share-token>
# Proxies to localhost:9090 by default