Sphior Ai Governance Mcp

io.github.ToraastrtaPublished by GitHub account Toraastrtav0.2.1Updated Nov 2, 2026

Record what your AI did as tamper-evident evidence for ISO 42001, EU AI Act and SOC 2. Hash-only.

VerifiedSTDIODesktop onlySecurity & MonitoringAI & ML

Overview

AI-generated overview

Records an AI agent's own executions to SPHIOR AI Governance as hash-only, tamper-evident evidence for ISO 42001, EU AI Act and SOC 2 audits.

What you can do
  • Record a single AI execution with actor, model, provider, policy decision, tokens, cost, latency and trace ID
  • Record batches of up to 200 executions in one call
  • Send each record to SPHIOR, where it is canonicalized, SHA-256 hashed, chained and periodically anchored to an append-only record
  • Leave prompts and outputs out of the stored evidence unless they are explicitly included
When to use it
Worth adding when an organization needs a retained, independently verifiable log of what its AI agents did, for example to support ISO 42001, EU AI Act or SOC 2 evidence gathering. It is a logging and evidence tool, not a compliance verdict.
Requirements
Runs locally over stdio, typically via npx. Requires a SPHIOR account and an ingestion token in SPHIOR_AIGOV_TOKEN; without it the server starts but records nothing. Optional SPHIOR_AIGOV_ENDPOINT overrides the ingestion URL for self-hosted or regional deployments, plus SPHIOR_TIMEOUT and SPHIOR_DEBUG. Network access to the ingestion endpoint is needed.
Before you install
The ingestion token is a secret and should be kept out of shared config files. Execution metadata is sent to SPHIOR's servers, or to whatever endpoint SPHIOR_AIGOV_ENDPOINT points at. Prompts and outputs are stored only if you include them, so check what fields you pass. Records are supporting evidence only and do not assert compliance, pass/fail or an audit opinion.

Installation

In SourceWeft

  1. Open Sphior Ai Governance Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

sphior-ai-governance-mcp

Official Model Context Protocol (MCP) server for SPHIOR AI Governance.

Let your AI agent (Claude, Cursor, Cline, Windsurf, Zed, VS Code, …) record its own executions as tamper-evident, independently verifiable evidence you can retain for ISO 42001 / EU AI Act / SOC 2.

Only hashes and metadata are stored (hash_only) — never your prompts or outputs unless you include them.

Records supporting evidence. Does not assert compliance, pass/fail, or an audit opinion.

Tools

ToolWhat it does
record_ai_executionRecord one AI execution (actor, model, provider, policy_decision, tokens, cost, latency, trace_id, …)
record_ai_executionsRecord up to 200 executions in one call

Setup

Get an ingestion token from your SPHIOR dashboard: Account → AI Governance → Ingestion tokens.

Claude Desktop / Claude Code (claude_desktop_config.json)

json
{  "mcpServers": {    "sphior-ai-governance": {      "command": "npx",      "args": ["-y", "sphior-ai-governance-mcp"],      "env": { "SPHIOR_AIGOV_TOKEN": "<your-token>" }    }  }}

Cursor / Cline / Windsurf / Zed

Add an MCP server with command npx -y sphior-ai-governance-mcp and env SPHIOR_AIGOV_TOKEN=<your-token>.

Environment variables

VarRequiredDefault
SPHIOR_AIGOV_TOKENyes—
SPHIOR_AIGOV_ENDPOINTnohttps://sphior.com/api/ai-governance/ingest
SPHIOR_TIMEOUTno30000 (ms)
SPHIOR_DEBUGnofalse

What SPHIOR does with it

Each event is canonicalized (RFC 8785 JCS), hashed (SHA-256), chained, and periodically anchored to an append-only, independently verifiable record. You and your auditor can verify integrity with the open sphior-verify tool and standard timestamp tooling — without trusting SPHIOR.

Prefer plain code over an MCP agent? Use the sphior-ai-governance SDK, or POST directly to the ingestion endpoint.

License

Apache-2.0

Source: packages/ai-governance-mcp/README.md at commit 5e9fb71

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.1LatestOct 19, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts