Search / com.moltlinestudio/govern
protogridR0· no sign-inAudit MCP configs and skill files for over-broad scope and injection risk. 6 of 8 free.
v1.2.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"govern": {
"type": "http",
"url": "https://mcp.moltlinestudio.com/govern"
}
}
}claude mcp add --transport http govern https://mcp.moltlinestudio.com/govern[mcp_servers.govern]
url = "https://mcp.moltlinestudio.com/govern"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"govern": {
"type": "remote",
"url": "https://mcp.moltlinestudio.com/govern",
"enabled": true
}
}
}{
"mcpServers": {
"govern": {
"type": "http",
"url": "https://mcp.moltlinestudio.com/govern"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=govern&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLm1vbHRsaW5lc3R1ZGlvLmNvbS9nb3Zlcm4ifQ%3D%3D"
}{
"servers": {
"govern": {
"type": "http",
"url": "https://mcp.moltlinestudio.com/govern"
}
}
}{
"mcpServers": {
"govern": {
"httpUrl": "https://mcp.moltlinestudio.com/govern"
}
}
}extensions:
"govern":
enabled: true
name: "govern"
type: streamable_http
uri: "https://mcp.moltlinestudio.com/govern"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations8 of 8 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 2,401 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +dns-namespace +website +reachable +uptime-95% ~updated-41d-ago -duplicate-repo(22 names)
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://mcp.moltlinestudio.com/govern streamable-http | none | yes | 95% | 161 ms | 2025-11-25 | 2026-10-19 |
agent_readiness_scanread-only | Score a public domain against 21 agent-readiness checks. FREE. Use when you need to know whether an autonomous agent can discover, read, use or pay a website - your own, or a vendor you are evaluating before recommending it. Typical input {"domain": "example.com"} returns {"score": 8, "total": 21, "grade": "F", "passed": [...], "failed": [{"title": "...", "detail": "...", "fix": "..."}], "report_url": "..."} where report_url is a permanent shareable page for the same result. Not for auditing an MCP client configuration (audit_mcp_config) and not for scanning text for injection (injection_scan) - this one reaches out over the network and fetches public URLs on a live domain. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "The readiness scanner is not reachable right now."}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
audit_mcp_configread-only | Audit an MCP server config for risk-ranked posture findings. FREE. Flags exposed machine credentials in the config, required inputs that aren't gated/optional, unpinned versions, over-broad env access, and dangerous auto-run flags. It never echoes any matched secret value back. Typical input {"config": "<mcpize.yaml, mcp.json, or a Claude/Cursor servers block>"} returns {"posture_score": 0-100, "verdict": "...", "findings": [{"line": N, "severity": 1-5, "issue": "...", "fix": "..."}], "note": "..."}. Use on a server configuration document. Not for a skill or instruction file (audit_skill_file) and not for untrusted content an agent is about to read (injection_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
audit_skill_fileread-only | Audit an agent skill or instruction file before you trust it. FREE. Checks for governance smells: prompt-injection and guardrail-bypass phrasing, concealment instructions ('don't tell the user'), exfiltration language, and exposed credential material. Typical input {"content": "<SKILL.md, system prompt, or tool description text>"} returns {"verdict": "reject — do not install" | "no governance red flags on a pattern pass", "findings": [{"severity": 1-5, "issue": "..."}], "note": "..."}. Use before trusting a skill or instruction file that came from outside your own repository. Not for arbitrary untrusted input at run time (injection_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
get_auditor_personaread-only | Load the Governance Auditor persona for consistent fleet audits. PREMIUM (license). The persona is methodical, evidence-driven, and allergic to 'it's probably fine'. Takes no arguments. Returns {"persona": ..., "identity": ..., "rules": ["...", ...], "opening_move": "..."} ready to adopt as a system prompt. Use to keep repeated audits consistent in voice and rigor. Not for running an audit - the audit tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
governance_policyread-only | Generate an audit-ready agent-governance policy for a fleet. PREMIUM (license). Covers inventory cadence, ownership rules, least-privilege approval gates, injection defense, logging/retention, and decommissioning triggers. Typical input {"fleet_context": "20 agents, 3 with shell access, one finance bot"} returns {"policy": ..., "sections": {...}, "context_note": ..., "audit_checklist": ["...", ...]}. Use when a fleet needs a written policy document. Not for assessing what the fleet currently does (inventory_report, audit_mcp_config). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
injection_scanread-only | Scan untrusted text for prompt-injection patterns before ingestion. FREE. Use on any web page, email, or document an agent is about to ingest to catch prompt-injection and data-exfiltration patterns before they reach the agent's context. Typical input {"text": "<untrusted content>"} returns {"injection_suspected": bool, "count": N, "hits": [{"line": N, "pattern": "...", "text": "<flagged line>"}], "note": "..."}. Not for reviewing a skill file you control (audit_skill_file), and a clean result is not a guarantee of safety - it reports pattern matches only. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
inventory_reportread-only | Build a governance inventory with risk tiers from a raw agent list. FREE. Turns a list of agents / MCP servers / skills into an audit-ready summary with critical/elevated/standard tiers and unowned-agent flags. Typical input {"items": "[{\"name\": \"deploy-bot\", \"owner\": \"ana\"}]"} returns {"total": N, "tiers": {"critical": N, ...}, "unowned_agents": [...], "inventory": [{"name": ..., "owner": ..., "tier": ..., "orphaned": bool}], "reading": "...", "note": "..."}. Use to turn a raw agent list into risk tiers. Not for auditing any single agent in depth (audit_mcp_config, scope_check). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
scope_checkread-only | Score the blast radius of every tool in a permission manifest. FREE. Ranks each tool by capability risk (command exec > money/delete > file-write/messaging > read > network) and flags the over-privileged ones that need approval gates. Typical input {"tools": "[\"run_shell\", \"read_docs\"]"} returns {"tools_scored": N, "high_risk_tools": N, "ranking": [{"tool": ..., "blast_radius": 0-5, "capabilities": [...]}], "recommendation": ["..."], "note": "..."}. Use on a permission manifest to rank tools by blast radius. Not for the configuration that mounts them (audit_mcp_config). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry. |
Schemas: list_tools.
21 other active names share this repository (showing 10): com.moltlinestudio/business, com.moltlinestudio/catalog, com.moltlinestudio/codereview, com.moltlinestudio/creator, com.moltlinestudio/data, com.moltlinestudio/dropship, com.moltlinestudio/educator, com.moltlinestudio/humanizer, com.moltlinestudio/merchant, com.moltlinestudio/optimize
And 15 more from this publisher.
{
"name": "com.moltlinestudio/govern",
"icons": [
{
"src": "https://moltlinestudio.com/icon-192.png",
"sizes": [
"192x192"
],
"mimeType": "image/png"
}
],
"title": "Moltline Agent Governance",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mcp.moltlinestudio.com/govern",
"type": "streamable-http"
}
],
"version": "1.2.0",
"repository": {
"url": "https://github.com/GarphenGate/moltline-mcp",
"source": "github"
},
"websiteUrl": "https://moltlinestudio.com/servers.html#govern",
"description": "Audit MCP configs and skill files for over-broad scope and injection risk. 6 of 8 free."
}