WhitePact

io.github.Guruprasath-AnnaduraiPublished by GitHub account Guruprasath-Annaduraiv1.2.3Updated Nov 2, 2026

AI governance MCP server: trust scoring, guardrails, bias/hallucination detection, compliance.

VerifiedStreamable HTTPWeb executableSecurity & Monitoring AI & ML

Server details

Identifier: io.github.Guruprasath-Annadurai/whitepact
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account Guruprasath-Annadurai for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Guruprasath-Annadurai%2Fwhitepact.svg)](https://sourceweft.com/mcp/io.github.Guruprasath-Annadurai%2Fwhitepact?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

WhitePact is an AI governance MCP server offering trust scoring, guardrails, bias and hallucination-risk signals, and compliance mapping for agent actions.

What you can do: Apply runtime governance decisions to proposed agent actions, with outcomes such as allow, allow with redaction, require approval, deny and quarantine
Run AI trust and risk assessments, including trust scoring, guardrails, bias evaluation and hallucination-risk signals
Map results to compliance requirements and keep governance decision records for audit and review
Support delegated authority and human approval for sensitive operations, plus cost awareness, drift monitoring and evaluation tooling
When to use it: Worth adding when you want a policy and approval layer between an AI agent's proposed action and its execution, or when you need trust, bias, hallucination-risk or compliance assessments recorded for review. It is an additional governance layer, not a replacement for secure application design.
Requirements: Either the hosted remote endpoint, which requires a bearer API key in the Authorization header obtained from the WhitePact dashboard after creating a free org, or the local PyPI package rai-governance-platform (Python 3.11+, MCP support via the mcp extra, run with uvx). Optional RAI_MCP_LOG_LEVEL environment variable. The README advises validating local service, authentication and dependencies, and checking live connectivity before relying on a remote connection.

Before you install

The hosted endpoint requires an API key sent as a bearer token in the Authorization header; treat it as a secret. The README states the broader enterprise runtime is still under security and integration qualification and that global enterprise production deployment has not been authorized, and warns that directory listings do not prove uptime or production readiness. It also advises against sending production data, credentials or consequential instructions to an endpoint just because it…

Installation

In SourceWeft

Open WhitePact in the dashboard and add it to a workspace.
Connect Authorization token credentials. They are stored privately and never shown on public pages.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Guruprasath-Annadurai%2Fwhitepact/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "whitepact": {
      "type": "http",
      "url": "https://whitepact-mcp-http.onrender.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

WhitePact

Intelligence may propose. WhitePact decides.

Runtime governance and assurance for AI agents, automated workflows and MCP-connected systems.

Python package · MCP Registry · Smithery listing · Report a security issue

Why WhitePact?

AI agents do more than generate text. They call tools, access information and propose actions that can change real systems.

An AI model proposing an action is not the same as an authorized system permitting that action.

WhitePact is designed to help developers put policy, identity, approvals, risk assessment and accountable evidence between an autonomous agent's proposal and its execution. It is an additional governance layer—not a substitute for secure application design or a guarantee that every AI risk can be eliminated.

What WhitePact covers

Area	What it is intended to help with
Runtime governance	Five structured decision outcomes: `ALLOW`, `ALLOW_WITH_REDACTION`, `REQUIRE_APPROVAL`, `DENY` and `QUARANTINE`.
Delegated authority & human approval	Explicitly limit sensitive operations and involve authorized reviewers.
Evidence & auditability	Preserve governance decision records for investigation and review.
MCP and agent integrations	Bring governance checks into compatible tool and agent workflows.
AI trust & risk assessments	Trust scoring, guardrails, bias evaluation, hallucination-risk signals and compliance mapping.
Operational insight	Cost awareness, drift monitoring, incident-oriented assessment and evaluation tooling.

These are product areas and published software capabilities, not a claim that every component is deployed, externally audited or generally available as an enterprise service. Feature availability depends on the particular released package and deployment.

Start with the published open-source package

The existing package is distributed on PyPI as rai-governance-platform, with Python 3.11+ support. The historical distribution and import names are retained for compatibility; WhitePact is the product name.

Latest PyPI release verified on 1 November 2026: 1.2.6, released 30 August 2026.

For developer-facing MCP support, the published distribution declares an mcp optional dependency group:

The package documentation identifies whitepact-mcp as a self-hosted MCP entry point. Configure and validate the appropriate local service, authentication and dependencies for your environment before using it with an MCP client.

See the published PyPI release for the actual distribution files, package metadata, supported extras, provenance and accompanying open-source license.

Important: Self-hosted package availability does not prove the availability of a separate hosted MCP service. Public directory listings may contain stale or unreachable endpoints. Check live connectivity and authentication before relying on any remote connection.

The open-source / enterprise separation

WhitePact follows a separated publication model:

Public materials	Private or restricted materials
This product overview and approved public documentation	Unreleased enterprise platform source
Previously published PyPI distributions under their accompanying licenses	Privileged runtime authority and operational integrations
Explicitly approved open-source SDKs or client components, if separately published	Private deployment, infrastructure and security evidence
Public installation, contact and distribution information	Credentials, customer data and internal incident records

This is a documentation repository, not the WhitePact enterprise source repository. It must not contain private source code, internal configuration, security reports, tokens, proprietary deployment files or confidential customer information.

Past MIT-licensed open-source releases retain the rights provided by the licenses under which they were distributed. Making a development repository private does not retroactively remove those rights or recall copies already distributed.

Current product readiness

Status as of 1 November 2026: The broader WhitePact enterprise runtime is still undergoing security and integration qualification. Global enterprise production deployment has not been authorized.

Successful component tests, a published package, badges or an MCP listing must not be treated as an end-to-end security certification or proof of production readiness.

Users may evaluate the published open-source package according to its release-specific documentation and license. No claim is made here that a new enterprise hosted service, production identity-verification workflow or public SaaS launch is generally available.

Integration ecosystem

WhitePact has a published MCP-related software offering and third-party directory listings. Listings establish discoverability, not service uptime or production acceptance.

PyPI: rai-governance-platform — versioned downloadable Python distribution.
Official MCP Registry — search for WhitePact; review the listing's current package and remote metadata before connecting.
Smithery: WhitePact — third-party listing; connection availability must be checked independently.

Do not send production data, credentials or consequential instructions to an endpoint solely because it appears in a directory.

Responsible security reporting

Please do not publish exploitable vulnerability details, private tokens or customer information in public issues. Contact WhitePact security with a concise impact statement and safe reproduction details. This repository's public issues are for documentation and product-discovery matters only.

Licensing and rights

The published rai-governance-platform release is distributed under the MIT License. See the license included with the specific distributed software.

This public documentation repository does not grant a license to any privately held, unpublished implementation, and it does not change licenses already granted for previously released source or packages. Product and brand use may be governed separately from software copyright licenses.

Govern the action. Preserve the evidence. Keep authority explicit.

Source: README.md at commit bf31d34

Tools

SourceWeft has not read this server's tools yet.

Version history

v1.2.3LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts