io.github.Stratogenic-AIPublished by GitHub account Stratogenic-AIv1.0.1Updated Nov 2, 2026
Governance middleware for AI agents: permission gates, approvals, compliance scanning, audit ledger.
Hosted governance layer for AI agents: permission checks, human approvals, compliance scans and a tamper-evident audit ledger.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.Stratogenic-AI%2Fcatalyst/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"catalyst-governance": {
"type": "http",
"url": "https://catalyst.stratogenic.ai/mcp",
"headers": {
"X-API-Key": "<YOUR_API_KEY>"
}
}
}
}Governance middleware for AI agents — hosted MCP server with both SSE and Streamable HTTP transports.
Catalyst puts a governance layer between your AI agent and consequential actions. Before your agent writes files, sends messages, deploys code, or calls external APIs, it checks in with Catalyst. Depending on your governance mode, actions are allowed, routed to a human for approval, or denied.
Core features:
observe → advisory → proposal → stricttouched_by.source=mcpproposal.accepted / proposal.declined eventsClaude Code is a primary use case Catalyst was designed for. Claude Code governs itself session-locally — it asks before running dangerous commands, but those decisions leave no audit trail, survive no context reset, and sit outside your organisation's approval workflows.
Catalyst externalises that governance. Once connected, every consequential action Claude Code attempts is routed through your policy, logged in an immutable ledger, and (if required) held for human approval in the Catalyst dashboard before Claude Code proceeds.
Connect in one command:
Or with Streamable HTTP (Claude Code 0.10+):
Claude Code will automatically call catalyst_check_action before destructive operations and catalyst_await_approval when a proposal is required. Every action is ledgered with touched_by.source=mcp — you get a permanent, verifiable record of what your AI coding agent did and when.
What governance looks like in practice:
Set your governance mode to observe to start with a full audit trail only, advisory to flag deviations without blocking, proposal to require human sign-off on sensitive actions, or strict to allow only explicitly whitelisted capabilities.
Get your API key at catalyst.stratogenic.ai.
Streamable HTTP (preferred — required by Glama, Smithery, and newer clients):
SSE (for clients that don't yet support Streamable HTTP):
Get your API key at catalyst.stratogenic.ai.
Source: README.md at commit b42e693
Ingest one or more tasks into Catalyst governance pipeline. Items should include at minimum a 'title'. Optional fields: details, owner, priority (Low/Medium/High/Critical), stage, domain, due_at, tags, group_id. Returns ingested count and proposal IDs created.
itemsrequireddomainSearch normalised tasks in the tenant flow cycle. Performs case-insensitive substring match on title/details. Filter by canonical domain (e.g. security, product, operations) or priority.
qlimitdomainoffsetpriorityUpdate a single task in the governance flow. Ledger-recorded. Patch may include: title, details, owner, priority, stage, domain, due_at, status, tags, done. Normalisation is applied automatically.
patchrequiredtask_idrequiredBulk update all tasks matching a filter. Growth/Enterprise plans only. filter keys: domain, priority, stage, owner, tag, group_id. updates keys: owner, priority, domain, stage, tags_add, tags_remove. Returns matched and updated counts.
filterrequiredupdatesrequiredList all pending governance proposals awaiting acceptance or decline. Proposals are work items that have been ingested but not yet committed to the live flow cycle. They require human (or agent) review. Each proposal contains an `idempotency_key` field — this is the canonical proposal identifier. Always use `idempotency_key` (not `task_id` or `id`) when passing proposal IDs to catalyst_accept_proposals, catalyst_decline_proposals, or catalyst_review_proposal.
Takes no parameters.
Accept one or more proposals, committing them to the flow cycle. ids: list of proposal `idempotency_key` values from catalyst_list_proposals. Do not pass `task_id` or `id` — the backend looks up proposals by `idempotency_key` and will silently match nothing if the wrong field is used. Acceptance is the governance commit step: items move from review state into live execution state and are recorded in the immutable ledger.
idsrequiredDecline one or more proposals without committing them. ids: list of proposal `idempotency_key` values from catalyst_list_proposals. Do not pass `task_id` or `id` — the backend looks up proposals by `idempotency_key` and will silently match nothing if the wrong field is used. Declined proposals are recorded for audit and learning but are not added to the live flow cycle.
idsrequiredApprove or reject a review-required proposal (AI governance hold). proposal_id: the `idempotency_key` field from catalyst_list_proposals. Do not pass `task_id` or `id` — the backend looks up by `idempotency_key`. decision must be 'approve' or 'reject'. Approved proposals can then be accepted via catalyst_accept_proposals. Rejected proposals are marked review-rejected in the ledger.
reasondecisionrequiredproposal_idrequiredreviewer_idGet all 7 governance graph views for the tenant. Views: org_snapshot, execution_flow, ownership_map, compliance_web, risk_heatmap, client_influence, catalyst_metrics. Read-only, derived from flow_cycle on demand. Requires governance_dashboard entitlement.
Takes no parameters.
Get the governance dashboard snapshot including all views. Returns tenant metadata, execution metrics, and all 5 governance views (execution_flow, ownership_map, compliance_web, risk_heatmap, client_influence).
Takes no parameters.
Get an AI-generated narrative summary of the org's execution state. time_window: 'last_7_days' or 'last_30_days'. extra_query: optional focus bias (e.g. 'compliance', 'delivery risk'). Returns a MASC-L3 compliant narrative — no individual evaluations. Requires governance_dashboard entitlement.
extra_querytime_windowRun a compliance scan against all loaded compliance documents. Detects compliance gaps, conflicts, and policy violations across the current flow cycle. Requires can_scan entitlement. Returns findings grouped by severity.
Takes no parameters.
Get the latest compliance findings from the most recent scan. Returns findings flattened by category: conflicts, gaps, ok. Each finding includes category, severity, status, and task linkage. Does not trigger a new scan — use catalyst_run_compliance_scan first.
Takes no parameters.
Materialise compliance findings as actionable flow tasks. classes: list of finding classes to convert, e.g. ['MISSING_CONTROL', 'PROHIBITED_ACTION']. Defaults to both. Created tasks enter the governance pipeline like any other ingest.
classesList all available pre-built compliance framework packs. Returns each pack (GDPR, SOC 2, ISO 27001, HIPAA, PCI-DSS, EU AI Act, Bribery Act, AML/KYC) with its name, description, rule count, and whether it is currently active for this organisation. Activate a pack with catalyst_activate_compliance_framework.
Takes no parameters.
Activate a pre-built compliance framework pack for this organisation. framework: one of gdpr, soc2, iso27001, hipaa, pci_dss, eu_ai_act, bribery_act, aml_kyc. Once activated, the pack's DENY/REQUIRE/ADVISE rules are merged into every subsequent compliance scan — no document upload required. Requires can_scan entitlement.
frameworkrequiredList all compliance rules currently in effect for the organisation. Returns rules from three sources combined and deduplicated: - Rules extracted from uploaded policy documents - Custom org-level rules (PATCH /compliance/rules) - Rules from any activated framework packs Each rule includes: id, type (DENY/REQUIRE/ADVISE), trigger sentence, severity, scope, remediation guidance, confidence score, and authority citation.
Takes no parameters.
Register a machine actor (agent, automation) with Catalyst governance. runtime_type: zapier_zap | n8n_workflow | openai_assistant | make_scenario | claude_agent | custom_agent | internal_worker. governance_mode: observe | advisory | proposal | strict. risk_class: low | standard | high. Requires can_configure_ai_workflows entitlement (Enterprise+).
notesscopesrisk_classcapabilitiesdisplay_namerequiredruntime_typerequiredgovernance_modeEvaluate whether an agent action is permitted by the governance gate. Returns decision: 'allow' | 'proposal_required' | 'deny'. High-risk actors with allow decisions are escalated to proposal_required. The actor must be registered and active for this tenant.
contextactor_idrequiredcapabilityrequiredRegister an AI workflow for EU AI Act compliance governance. risk_level: unacceptable (rejected) | high | limited | minimal. mode: observe | advisory | proposal. High-risk workflows are forced to proposal. Sets ai_standards=True to opt into the Built to AI Standards evidence trail. Requires can_configure_ai_workflows (Enterprise+).
modenotesrisk_levelworkflow_idrequiredai_standardsSend a lifecycle event for a registered AI workflow. event_type examples: run.started, action.executed, approval.requested, run.completed, run.failed. Idempotent via request_id (UUID recommended). Payload is scrubbed of credentials before storage.
payloadevent_typerequiredrequest_idworkflow_idrequiredGet the four-component trust score for a registered AI workflow. Score = 0.25×ai_declared + 0.25×risk_eval + 0.25×override + 0.25×(1−failure). Range 0.0–1.0. window_days controls the lookback period (1–365).
window_daysworkflow_idrequiredExport audit events for an AI workflow as JSON. since: ISO timestamp filter (inclusive). ai_standards_only: limit to events from workflows opted into Built to AI Standards. Suitable for regulatory submissions and investor due diligence.
sinceworkflow_idrequiredai_standards_onlyGet a 7-day activity rollup: ingested, accepted, declined proposals, domain breakdown, priority breakdown, and average risk score. Fully deterministic — no LLM calls.
Takes no parameters.
Export the immutable SHA-256 chained audit ledger. since: ISO timestamp to filter entries (inclusive). format: 'json' returns full entries; 'csv' sets entries to null (use REST API for CSV). The ledger is tamper-evident — any modification breaks the hash chain.
sinceformatShow your governance profile, actor registration, and plan capabilities. Returns governance_mode (observe/advisory/proposal/strict), risk_class, declared capabilities, and actor_id. Auto-registers you in observe mode on first connection — the lightest governance touch. Also returns plan_capabilities showing which features are active and which require an upgrade — relay any upgrade_required fields to the user so they can unlock compliance scanning or AI workflow governance. Call this first to understand what you are and are not permitted to do.
Takes no parameters.
Check if a capability/action is permitted by your governance policy. Returns decision: 'allow' | 'proposal_required' | 'deny' with guidance. Call BEFORE any consequential action (API call, data write, send, deploy). If title is provided and decision is 'proposal_required', the intent is logged automatically and proposal_id is returned — no second call needed. If 'proposal_required' without a title, call catalyst_log_task separately. capability examples: 'send_email', 'write_file', 'deploy_code', 'update_record', 'delete_record', 'external_api_call'.
titlecontextcapabilityrequiredLog a task or action into the Catalyst governance pipeline. Records work, decisions, and actions for audit and governance. priority: Low | Medium | High | Critical. domain: security | product | operations | compliance | finance | legal | other. Returns ingested count and any proposal_ids created (if a governance hold applies).
titlerequireddomaindetailspriorityList proposals currently awaiting governance approval. Shows proposals with status pending or in review. Use this to check whether an action you submitted is still waiting for human sign-off before you proceed. Returns count and full proposal objects with IDs for catalyst_await_approval.
Takes no parameters.
Check approval status for a specific proposal. Returns approved: true/false and clear guidance on whether to proceed. Call this after catalyst_check_action returns 'proposal_required'. Do NOT proceed with the gated action until approved: true is returned. POLLING vs EVENT-DRIVEN: For interactive sessions, poll this tool. For autonomous long-running workflows, prefer registering a webhook via catalyst_register_approval_webhook(callback_url) so your orchestrator is notified the moment a human acts — no polling loop required.
proposal_idrequiredRegister a callback URL to receive proposal approval notifications. Subscribes callback_url to proposal.accepted and proposal.declined events. When a human approves or declines any proposal, Catalyst POSTs the event to your URL with the resolved proposal IDs in data.ids. Use this instead of polling catalyst_await_approval for autonomous workflows: register once, let your orchestrator (Temporal, job queue, webhook relay) wake the agent when the relevant proposal_id arrives. Then call catalyst_await_approval once to confirm and proceed. Returns subscription IDs, the expected payload shape, and usage guidance. Returns upgrade_required: true if outbound webhooks are not on your plan.
callback_urlrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
claude mcp add catalyst \ --transport sse \ --url https://catalyst.stratogenic.ai/mcp/sse \ --header "X-API-Key: SGC_your_key_here"claude mcp add catalyst \ --transport http \ --url https://catalyst.stratogenic.ai/mcp \ --header "X-API-Key: SGC_your_key_here"{ "mcpServers": { "catalyst": { "url": "https://catalyst.stratogenic.ai/mcp", "transport": "http", "headers": { "X-API-Key": "<your-key>" } } }}{ "mcpServers": { "catalyst": { "url": "https://catalyst.stratogenic.ai/mcp/sse", "transport": "sse", "headers": { "X-API-Key": "<your-key>" } } }}catalyst_my_governance() # understand your mode + capabilities ↓catalyst_check_action("write_file") # allow | proposal_required | deny ↓ if proposal_requiredcatalyst_log_task("Deploy to prod") # creates proposal, returns proposal_id ↓catalyst_await_approval(proposal_id) # poll until approved: true ↓ proceed