Korext: AI Code Governance

io.github.KorextPublished by GitHub account Korextv3.0.1Updated Oct 24, 2026

Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Korext checks AI-generated code against compliance policy packs, reports violations with governance context, and issues signed proof bundles.

What you can do
Check code snippets against one or more policy packs and get violations with severity, line numbers and governance context such as CWE, MITRE and regulatory references. Retrieve enriched policy directives and living standards for policy packs. List available policy packs with industry and region tags. Scan code to generate a cryptographically signed proof bundle with a decision, violation count and verification link. Retrieve an existing proof bundle by ID to see its decision, violations, packs and verification status.
When to use it
Useful when an assistant writes or reviews code that must meet compliance or security policies, such as web, PCI-DSS, OWASP, GDPR or HIPAA packs, and you want violations flagged during coding and a signed record of the result.
Requirements
Runs as a remote endpoint at app.korext.com or locally via the npm package korext with npx. An Authorization header carrying a Bearer token from the Korext dashboard Settings is needed for full access; without a token, anonymous mode is limited to 20 requests per hour and limited packs. Network access is required.
Before you install
The Authorization header carries a secret API token; keep it out of logs and shared configuration. Code snippets and scanned code are sent to Korext's servers for checking, so consider data sensitivity and the processing region. Proof bundles are signed records of a pass or block decision and should not be treated as a substitute for a full audit.

Installation

In SourceWeft

  1. Open Korext: AI Code Governance in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Korext%2Fgovernance/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "korext-ai-code-governance": {
      "type": "http",
      "url": "https://app.korext.com/api/mcp"
    }
  }
}

README

KOREXT Enforce Action

Enforce compliance policies on AI generated code in your GitHub workflows.

72 policy packs. 532 rules. 13 languages. Violations appear as GitHub Code Scanning annotations on pull requests.

Quick Start

Add this to .github/workflows/korext.yml:

yaml
name: Korext Enforcementon: [push, pull_request]
permissions:  contents: read  security-events: write
jobs:  enforce:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: Korext/enforce-action@v3        with:          api-token: ${{ secrets.KOREXT_API_TOKEN }}

Korext scans your code on every push and PR using the default web policy pack.

How It Works

  1. Install: The action installs the Korext CLI
  2. Scan: Runs korext enforce against your codebase with the selected policy pack
  3. Report: Generates a SARIF file and uploads it to GitHub Code Scanning
  4. Gate: Fails the workflow if critical or high severity violations are found

Violations appear as annotations directly on the PR diff, powered by GitHub Code Scanning.

Inputs

InputDescriptionRequiredDefault
directoryDirectory to scan for policy violationsNo.
packPolicy Pack ID to enforceNoweb
api-tokenKorext API token for authenticated modeNo(anonymous)
fail-on-violationsFail workflow on critical/high violationsNotrue
sarif-uploadUpload SARIF to GitHub Code ScanningNotrue
regionData processing region (us, eu, apac)No(default)
sign-bundlesRequest signed proof bundlesNotrue

Outputs

OutputDescription
violationsTotal number of policy violations found
sarif-filePath to the generated SARIF results file
bundle-countNumber of proof bundles generated
bundles-signedNumber of signed proof bundles
bundle-idsComma separated list of proof bundle IDs

Examples

Multiple Policy Packs

yaml
- uses: Korext/enforce-action@v3  with:    pack: web,pci-dss-v1,owasp-v1    api-token: ${{ secrets.KOREXT_API_TOKEN }}

EU Data Sovereignty

yaml
- uses: Korext/enforce-action@v3  with:    pack: gdpr-v1    region: eu    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Scan Specific Directory

yaml
- uses: Korext/enforce-action@v3  with:    directory: src/    pack: hipaa-v1    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Warn Only (do not fail)

yaml
- uses: Korext/enforce-action@v3  with:    pack: web    fail-on-violations: 'false'

Authentication

For full access to all policy packs and signed proof bundles, create an API token in your KOREXT dashboard and add it as a GitHub secret:

  1. Go to app.korext.com > Settings > API Tokens
  2. Create a new token
  3. Add it as KOREXT_API_TOKEN in your repo's Settings > Secrets and variables > Actions

Without a token, the action runs in anonymous mode (20 requests per hour, limited packs).

Links

License

Proprietary. See Terms of Service.

Source: README.md at commit 94d49ae

Tools

5

get_directives

Get enriched policy directives and living standards for one or more policy packs. Returns rules with governance context (CWE, MITRE, regulatory references) for inference time enforcement.

ParameterspackId

check_code

Check a code snippet against one or more policy packs. Returns violations with severity, governance context (CWE, MITRE, regulatory), and line numbers.

ParameterscoderequiredpackId

list_packs

List available policy packs with industry and region tags.

Parametersregionindustry

generate_proof

Scan code against policy packs and generate a cryptographically signed proof bundle. Returns the bundle ID, decision (PASS/BLOCK), violation count, and verification URL.

ParameterscoderequiredpackIdfileNamelanguage

get_proof

Retrieve an existing proof bundle by ID. Returns the decision, violations, packs, and verification status.

ParametersbundleIdrequired

Version history

1
  1. v3.0.1LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts