<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1080 480" role="img" aria-label="A single Arcade runtime and its internal MCP servers share one private network. AI clients connect to scoped /mcp gateways; the ssrf_allowlist gates which internal addresses the runtime reaches; the runtime makes outbound-only calls to Arcade for identity and access.">
  <style>
    text{font-family:ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
    .t{font-size:13px;font-weight:680;fill:#16151a}.s{font-size:10.5px;fill:#6f6e79}
    .m{font-size:10px;fill:#827f8c;font-family:ui-monospace,SFMono-Regular,Menlo,monospace}
    .z{font-size:10px;font-weight:700;letter-spacing:.8px;fill:#9a98a4;font-family:ui-monospace,Menlo,monospace}
    .zp{fill:#4b33dd}
    .node{filter:drop-shadow(0 2px 4px rgba(18,16,32,.10))}
  </style>
  <rect x="0" y="0" width="1080" height="480" rx="16" fill="#ffffff"/>
  <defs><marker id="a" viewBox="0 0 10 10" refX="8.5" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0 L10 5 L0 10 z" fill="#475569"/></marker></defs>

  <g class="node"><rect x="370" y="22" width="340" height="56" rx="12" fill="#fff" stroke="#cfcdc6"/></g>
  <text class="t" x="540" y="48" text-anchor="middle">AI clients</text>
  <text class="s" x="540" y="67" text-anchor="middle">Claude · Cursor · ChatGPT · agents</text>
  <line x1="470" y1="78" x2="360" y2="190" stroke="#475569" stroke-width="1.5" marker-end="url(#a)"/>
  <line x1="610" y1="78" x2="720" y2="190" stroke="#475569" stroke-width="1.5" marker-end="url(#a)"/>
  <text class="m" x="430" y="120" text-anchor="middle">HTTPS + OAuth</text>

  <rect x="40" y="98" width="1000" height="306" rx="16" fill="#fbfaf7" stroke="#cfc7fb" stroke-dasharray="5 5"/>
  <text class="z zp" x="62" y="122">YOUR PRIVATE NETWORK</text>
  <rect x="66" y="134" width="722" height="184" rx="13" fill="#fcfcff" stroke="#cfc7fb" stroke-dasharray="5 5"/>
  <text class="z zp" x="86" y="156">ARCADE RUNTIME · :9099</text>
  <g class="node"><rect x="92" y="170" width="300" height="60" rx="11" fill="#fff" stroke="#cfc7fb"/></g>
  <text class="t" x="242" y="194" text-anchor="middle">/mcp/finance</text>
  <text class="s" x="242" y="213" text-anchor="middle">arcade_oauth · Bloomberg · SAP</text>
  <g class="node"><rect x="462" y="170" width="300" height="60" rx="11" fill="#fff" stroke="#cfc7fb"/></g>
  <text class="t" x="612" y="194" text-anchor="middle">/mcp/engineering</text>
  <text class="s" x="612" y="213" text-anchor="middle">arcade_oauth · GitHub · Jira</text>
  <g class="node"><rect x="297" y="258" width="260" height="44" rx="10" fill="#eeecff" stroke="#cfc7fb"/></g>
  <text x="427" y="285" text-anchor="middle" fill="#4b33dd" font-size="11" font-weight="700" font-family="ui-monospace,Menlo,monospace">ssrf_allowlist · *.corp.internal</text>
  <line x1="242" y1="230" x2="360" y2="258" stroke="#4b33dd" stroke-width="1.4" marker-end="url(#a)"/>
  <line x1="612" y1="230" x2="494" y2="258" stroke="#4b33dd" stroke-width="1.4" marker-end="url(#a)"/>

  <text class="z zp" x="62" y="344">INTERNAL MCP SERVERS</text>
  <g class="node"><rect x="62" y="352" width="166" height="44" rx="10" fill="#f4f1ff" stroke="#ddd6fe"/></g>
  <text class="t" x="145" y="372" text-anchor="middle" font-size="11.5">Bloomberg MCP</text>
  <text class="m" x="145" y="388" text-anchor="middle">bloomberg.corp.internal:8000</text>
  <g class="node"><rect x="244" y="352" width="150" height="44" rx="10" fill="#f4f1ff" stroke="#ddd6fe"/></g>
  <text class="t" x="319" y="372" text-anchor="middle" font-size="11.5">SAP MCP</text>
  <text class="m" x="319" y="388" text-anchor="middle">sap.corp.internal:8080</text>
  <g class="node"><rect x="410" y="352" width="186" height="44" rx="10" fill="#f4f1ff" stroke="#ddd6fe"/></g>
  <text class="t" x="503" y="372" text-anchor="middle" font-size="11.5">GitHub Enterprise MCP</text>
  <text class="m" x="503" y="388" text-anchor="middle">github.corp.internal</text>
  <g class="node"><rect x="612" y="352" width="150" height="44" rx="10" fill="#f4f1ff" stroke="#ddd6fe"/></g>
  <text class="t" x="687" y="372" text-anchor="middle" font-size="11.5">Jira MCP</text>
  <text class="m" x="687" y="388" text-anchor="middle">jira.corp.internal:8080</text>
  <line x1="370" y1="302" x2="200" y2="350" stroke="#4b33dd" stroke-width="1.5" stroke-linecap="round"/>
  <line x1="427" y1="302" x2="427" y2="350" stroke="#4b33dd" stroke-width="1.5" stroke-linecap="round"/>
  <line x1="484" y1="302" x2="640" y2="350" stroke="#4b33dd" stroke-width="1.5" stroke-linecap="round"/>
  <text class="m" x="427" y="332" text-anchor="middle">HTTP · private network</text>

  <g class="node"><rect x="828" y="200" width="206" height="56" rx="12" fill="#eafaf0" stroke="#b4e6c6"/></g>
  <text x="931" y="226" text-anchor="middle" fill="#1a9e4b" font-size="12" font-weight="700">Arcade</text>
  <text x="931" y="244" text-anchor="middle" fill="#3c3b46" font-size="10.5">identity · access · OAuth</text>
  <line x1="788" y1="226" x2="824" y2="226" stroke="#1a9e4b" stroke-width="1.4" stroke-dasharray="3 4" marker-end="url(#a)"/>
  <text x="931" y="276" text-anchor="middle" fill="#1a9e4b" font-size="10" font-family="ui-monospace,Menlo,monospace">outbound only</text>
</svg>
