AISchemaGate and DataContractGate

io.github.nightmoosePublished by GitHub account nightmoosev0.4.1Updated Nov 3, 2026

AISchemaGate validates and repairs structured LLM output against a contract, plus DataContractGate.

VerifiedSTDIODesktop onlyDeveloper ToolsData & AnalyticsAI & ML

Overview

AI-generated overview

Validates and repairs structured LLM output against contracts, and infers, deploys and validates DataContractGate data contracts.

What you can do
  • Infer draft contract YAML from real JSON sample events, without persisting it
  • Validate events against a deployed contract or inline YAML, with dry-run by default
  • Deploy contracts by name and version, and list the contracts the API key can see
  • Inspect quarantined rejected events with their violation details
  • Check structured LLM output against a contract and read min, max, pattern, enum and compliance_mode violations for bounded repair
When to use it
Useful when an assistant produces or checks structured JSON that must satisfy a data contract, or when you maintain DataContractGate contracts and want to infer, validate, deploy and review quarantine from the chat instead of the dashboard.
Requirements
Runs locally over stdio via npx (Node.js). Requires a DataContractGate API key in CONTRACTGATE_API_KEY; the gateway base URL defaults to the hosted API and can be overridden with CONTRACTGATE_BASE_URL. Network access to the gateway is needed.
Before you install
The API key is a live credential sent to the gateway; keep it out of shared configs. deploy_contract changes remote state: it creates or promotes a stable contract and deprecates the prior stable one, and is refused while quarantine is pending. Validation and egress checks default to dry_run true, so audit and quarantine only happen when you turn that off.

Installation

In SourceWeft

  1. Open AISchemaGate and DataContractGate in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@nightmoose/contractgate-mcp-server

AISchemaGate validates and repairs structured LLM output against a contract, plus DataContractGate data contracts. Repair uses the violation fields from that check. The contract checks values a JSON Schema or Pydantic validation can leave open.

Official Model Context Protocol server. Thin stdio wrapper over the HTTP API at https://api.datacontractgate.com (override with CONTRACTGATE_BASE_URL). The dashboard host https://app.datacontractgate.com is not the gateway.

One server, two products, same API key:

  • AISchemaGate — validates structured LLM output (egress_validate → POST /egress/{id}). Repair uses the violation fields from that check (min, max, pattern, enum, compliance_mode). Forward payload from the tool result, not the original body.
  • DataContractGate — infer and deploy data contracts, validate ingest (validate_events → POST /v1/ingest/{id}), including ODCS v3.1.0 and v3.2.0 contracts, and inspect quarantine (get_quarantine). Replay stays on the HTTP API (POST /contracts/{id}/quarantine/replay).

Registry metadata for the Official MCP Registry is server.json. The title and description lead with AISchemaGate (description is the 100-character registry field). The server name stays io.github.nightmoose/contractgate. Keywords and the longer summary are under _meta. Smithery config is smithery.yaml; its default contractgateBaseUrl is the API gateway. npm keywords, this README, and DIRECTORY_LISTINGS.md are the directory listing.

See docs/mcp-reference.md for tools and auth. AISchemaGate app integrations: docs/integrations/.

json
{  "mcpServers": {    "contractgate": {      "command": "npx",      "args": ["-y", "@nightmoose/contractgate-mcp-server"],      "env": {        "CONTRACTGATE_API_KEY": "${CONTRACTGATE_API_KEY}"      }    }  }}
bash
cd mcpnpm installnpm testnpm run build

Source: mcp/README.md at commit b6ac5f4

Tools

6

infer_contract

Infer a contract from sample events

Generate draft DataContractGate YAML from real JSON sample events via POST /contracts/infer. Does not persist. Review and write the YAML to contracts/<name>.yaml before deploying.

Parametersnamerequiredsamplesrequireddescription

validate_events

Validate events against a contract

Validate events. Pass contract_id to hit POST /v1/ingest/{id} (dry_run defaults true — no audit, quarantine, or usage). Pass yaml_content to hit POST /playground/validate per event (never persists). Exactly one of contract_id or yaml_content. 207/422 responses are returned as data so you can apply each violation's suggestion.

Parameterseventsrequireddry_runcontract_idyaml_content

deploy_contract

Deploy a contract to stable

POST /contracts/deploy — find-or-create by name, insert YAML as stable, deprecate prior stable. 409 if that (name, version) exists: bump version in the YAML. Refused while quarantine is pending. Save the returned contract_id.

Parametersnamerequiredsourcedeployed_byyaml_contentrequired

get_quarantine

List quarantined events

GET /quarantine — rejected events for the caller's org, newest first, with violation details.

Parameterslimitoffsetcontract_id

list_contracts

List contracts

GET /contracts — identities the API key can see.

Takes no parameters.

egress_validate

Validate an outbound payload

AISchemaGate structured-output check. POST /egress/{contract_id}. dry_run defaults true — no audit row or quarantine. Returns 200/207/422 so you can read min, max, pattern, enum, and compliance_mode violations and run a bounded auto-repair. Forward response.payload only — never the original body after a block or fail.

Parameterseventsrequireddry_runversioncontract_idrequireddisposition

Version history

6
  1. v0.4.1LatestOct 29, 2026
  2. v0.4.0Oct 13, 2026
  3. v0.3.1Oct 13, 2026
  4. v0.3.0Oct 12, 2026
  5. v0.2.0Sep 30, 2026
  6. v0.1.2Sep 17, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts