NOMOS

com.nomosprotocolPublished by nomosprotocol.comOfficial publisherv1.3.0Updated Nov 7, 2026

Ask a sealed authority whether an action may proceed. Answers are deterministic and citable.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

NOMOS lets an assistant check AI decisions against sealed governance policies, generate policy artifacts, and query published authorities.

What you can do
  • Check whether an AI decision is allowed, denied, or needs escalation against a sealed governance artifact
  • Convert policy documents into a sealed governance artifact with extracted rules, contradiction detection, and an Autonomy Readiness Index score
  • Analyze policy documents and optional decision logs for contradictions, hidden rules, and gaps between declared policy and observed behavior
  • Query published authorities on the NOMOS Exchange marketplace for a verdict, the exact rule and reason, and a citation
When to use it
Useful when an assistant or agent must justify whether an action is permitted under a written policy, when you want policy documents turned into a sealed, citable rule set, or when you need to audit policies for contradictions and gaps before relying on them.
Requirements
A remote streamable HTTP endpoint; no packages, environment variables, or headers are declared. The manifest declares no authentication, and public authorities on the NOMOS Exchange are described as queryable without a key.
Before you install
generate_governance sends policy documents to the service and uses Claude to extract rules, so confidential policy text leaves your environment. Generated artifacts are sealed and returned with an artifact_id, so treat them as records you may need to keep. verify_decision returns a shape that varies by artifact type; only the allowed field is described as safe to read uniformly.

Installation

In SourceWeft

  1. Open NOMOS in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.nomosprotocol%2Fnomos/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "nomos": {
      "type": "http",
      "url": "https://www.nomosprotocol.com/api/mcp"
    }
  }
}

Tools

4

verify_decision

Check whether an AI decision is allowed, denied, or needs escalation according to a sealed NOMOS governance artifact. Always returns `allowed` (boolean) — that field is safe to read regardless of which artifact type answered. The rest of the shape genuinely differs by artifact type, because it proxies two different underlying endpoints: pub_ demo artifacts return a flat shape (`outcome`: auto_approved/auto_rejected/escalated, `rule_applied`, `rule_reference`, flat `confidence` and `audit_hash`); your own sealed artifacts from Studio return a nested shape (`verdict`: approved/rejected/escalated, a nested `rule` object, and nested `confidence`/`audit`/`performance` objects). See outputSchema for both exact shapes — do not assume one without checking which kind of artifact_id was passed. Use artifact IDs starting with pub_ for public demo artifacts that require no API key: pub_lending_v1 (loan approval), pub_refund_v1 (refund policy), pub_fraud_v1 (fraud detection), pub_hr_leave_v1 (HR leave approval), pub_kyc_v1 (KYC/identity).

Parametersinputsrequiredapi_keydecisionrequireddomain_idartifact_idrequired

generate_governance

Convert one or more policy documents into a sealed NOMOS governance artifact (.nomos). Extracts executable rules using Claude, detects contradictions between rules, computes an Autonomy Readiness Index (ARI) score (0–1), and cryptographically seals the result. Returns an artifact_id you can use with verify_decision immediately. Optionally accepts historical behavioral decision logs to add a behavioral evidence layer and reach CERTIFIED confidence tier.

Parametersnamerequireddomainapi_keydocumentsrequiredorganizationrequiredbehavioral_logs

detect_contradictions

Analyze policy documents (and optional behavioral decision logs) to detect contradictions, hidden rules, and gaps between declared policy and observed behavior. Stateless — no artifact is created and nothing is persisted. Returns contradiction types: threshold_conflicts (numeric rule overlaps), ghost_terms (undefined terms used in rules), role_conflicts (same action allowed by one role, denied by another), rule_collisions (direct logical conflicts), and layer_divergences (policy says X but behavioral data shows Y).

Parametersapi_keydocumentsrequiredbehavioral_logs

ask_authority

Query a published authority on the NOMOS Exchange marketplace — a different system from verify_decision's own sealed policies. Every public authority (e.g. eu-ai-act.nomos) is queryable with no key. Returns the authority's own verdict (AUTHORIZED/DENIED/ESCALATED), the exact rule and reason, and a permanent, cryptographically-bound transcript (query_id + url) — replayable evidence, not just a reply. Nothing is invented or paraphrased: the verdict is the authority's sealed rules evaluated against your inputs. The default response is a short, curated summary (verdict, matched rule, source citation when the artifact has one, transparency/completeness disclosures, transcript link) — not the full rule-by-rule evaluation trace. Set include_evaluation_trace: true to get that complete diagnostic record when you or the user actually need it.

Parametersactioninputsrequiredauthorityrequiredexchange_api_keyinclude_evaluation_trace

Version history

1
  1. v1.3.0LatestNov 7, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.