WhiteBoxXAI

io.github.AgentaFlowPublished by GitHub account AgentaFlowv0.3.2Updated Oct 29, 2026

AI observability, explainability and governance: drift, fairness, ISO 42001, risk register.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringData & AnalyticsAI & ML

Overview

AI-generated overview

WhiteBoxXAI exposes AI observability, explainability and governance tools — drift, fairness, risk register, ISO 42001 evidence — to MCP clients.

What you can do
  • Manage models and predictions: model registry, Git-backed model diffing, prediction logging, performance metrics
  • Detect drift and audit bias/fairness, with asynchronous SHAP/LIME explanation generation
  • Explain LLMs: attention, token importance, sensitivity, counterfactual analysis and prompt debugging
  • Monitor LLM calls for tokens, cost and latency, plus RAG pipeline monitoring and content safety analysis
  • Handle governance: ISO/IEC 42001 readiness, compliance evidence, AI Risk Register and governance review queries, prompt governance
  • Work with alerts (rules, triage context, intelligence, management) and multi-agent workflow tracking
When to use it
Useful when an assistant needs to inspect or report on deployed AI models and LLM applications: checking drift, fairness and performance, generating explanations, reviewing governance and compliance evidence, or triaging alerts from a WhiteBoxXAI account.
Requirements
A WhiteBoxXAI account and API key from the dashboard (Settings > API Keys). Local stdio install via pip, configured with WHITEBOXXAI_MCP_API_KEY and optionally WHITEBOXXAI_MCP_API_BASE_URL; or the hosted Streamable HTTP endpoint with the key or a personal JWT in the Authorization header. Network access to the WhiteBoxXAI API.
Before you install
Requires a secret API key (WHITEBOXXAI_MCP_API_KEY, or Authorization / X-WhiteBox-API-Key headers); the key is long-lived until revoked. Tools cover logging, alert management and governance records, so some calls may write or change data in your account. Hosted endpoint support follows your Free/Business Cloud plan, and some workflow cost/bottleneck/timeline calls can take about 30 seconds.

Installation

In SourceWeft

  1. Open WhiteBoxXAI in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.AgentaFlow%2Fwhiteboxxai-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "whiteboxxai": {
      "type": "http",
      "url": "https://api.whiteboxxai.com/mcp/",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

whiteboxxai-mcp

[PyPI version] [Python versions] [Test] [License: MIT]

An MCP (Model Context Protocol) server that exposes WhiteBoxXAI observability and explainability capabilities — model registry, Git-backed model diffing, prediction logging, drift detection, bias/fairness auditing, ISO/IEC 42001 readiness and compliance evidence, AI Risk Register / governance review queries, prompt governance, asynchronous SHAP/LIME explanation generation, LLM explainability (attention/token-importance/sensitivity/counterfactual analysis and prompt debugging), LLM call monitoring (token/cost/latency tracking), RAG pipeline monitoring, content safety analysis, alert rules and triage context, alert intelligence, alert management, multi-agent workflow tracking, and model performance metrics (197 tools across 18 domains) — to any MCP-compatible client (Claude Desktop, Claude Code, LangChain, custom agent harnesses, etc.). Supports MCP Apps (ui:// resources) with sandboxed interactive audit cards, stdio transport, and Streamable HTTP transport (hosted at https://api.whiteboxxai.com/mcp/).

See the integration docs for full setup, connection examples, the tool reference, and known v1 limitations. See examples/ for runnable LangChain, Semantic Kernel, and raw-MCP-client integrations.

Install

bash
pip install whiteboxxai-mcp

Run (stdio — local/self-hosted)

Configure a credential via environment variables, then run the console script. Stdio transport authenticates via WHITEBOXXAI_MCP_API_KEY:

bash
# An API key generated from the WhiteBoxXAI dashboard's Settings > API Keys tab.# Never expires on a fixed schedule -- only when explicitly revoked -- and doesn't require storing a password.export WHITEBOXXAI_MCP_API_BASE_URL="https://api.whiteboxxai.com"export WHITEBOXXAI_MCP_API_KEY="wbx_live_..."
whiteboxxai-mcp

Point your MCP client at this command (e.g. in Claude Desktop's mcpServers config, or Claude Code's .mcp.json).

For hosted Streamable HTTP (https://api.whiteboxxai.com/mcp/), pass your API key or personal JWT in the Authorization: Bearer <token> header.

Agent skills

To have a coding agent set this up and call the tools correctly, give it the whitebox-mcp-server skill (and whitebox-governance-rules). They are published at https://whiteboxxai.com/skills/index.md. The tool list they reference is pinned in tests/mcp_inspector_snapshot.json; a rename or removal of a tool shows up as a diff there.

Versioning & support

This package follows Semantic Versioning; see CHANGELOG.md for release history. Self-hosted stdio usage (above) is best-effort supported; the hosted /mcp/ HTTP endpoint is a product surface whose support/SLA follows the caller's underlying Free/Business Cloud plan.

Known v1 limitations

  • Auth: stdio uses WHITEBOXXAI_MCP_API_KEY — a scoped, revocable credential that isn't tied to a human account's password or session lifecycle. Hosted Streamable HTTP (https://api.whiteboxxai.com/mcp/) accepts an API key or personal JWT.
  • Alerts: covers core alert rules and triage context (whitebox_alerts_*), alert intelligence (whitebox_alert_intelligence_*, 20 tools), and alert management (whitebox_alert_management_*, 13 tools).
  • whitebox_agent_workflows_cost_breakdown/_bottlenecks/_timeline: these three can take up to ~30s — the backend blocks server-side on a Celery task before responding, and the SDK client uses an extended (40s) timeout for exactly these calls.
  • Scope: models, predictions, drift, bias/fairness, AI Risk Register / governance queries, prompts, compliance, explanations, LLM explainability, LLM call monitoring, RAG monitoring, content safety, alert intelligence, alert management, multi-agent workflows, and metrics all ship across 18 domains (197 tools total) over both stdio and hosted Streamable HTTP.

MCP Registry

The server is published to the official MCP Registry as io.github.AgentaFlow/whiteboxxai-mcp.

Development

bash
pip install -e ".[dev]"pytest tests/unit
# MCP Inspector tool-list regression check (needs Node.js); after an intentional# tool change, regenerate the committed snapshot with --writepython tests/check_mcp_inspector_snapshot.py

Releases are cut from GitHub releases; see RELEASING.md.

License

MIT -- see LICENSE.

Source: README.md at commit f2ebcba

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v0.3.2LatestOct 29, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts