Steadfast Repository Governance

io.github.rllibo833-sudoPublished by GitHub account rllibo833-sudov0.4.1Updated Oct 30, 2026

Local-first repository governance and verification tools for AI coding agents.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.rllibo833-sudo/steadfast-governance
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Oct 29, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account rllibo833-sudo for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.rllibo833-sudo%2Fsteadfast-governance.svg)](https://sourceweft.com/mcp/io.github.rllibo833-sudo%2Fsteadfast-governance?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local-first repository governance server that lets an AI coding agent run read-only checks on repo scope, evidence, docs drift and release readiness.

What you can do: Run unified read-only governance checks and produce a human-readable audit report
Audit changed files against repository policy, required evidence bundles, contracts and documentation drift
Flag selected risky source patterns and workflow trust-boundary issues
Validate goal dependencies and evaluate release readiness
Discover skills, inspect MCP configuration and print a machine-readable capability map for tools and agents
When to use it: Useful when a coding agent works in a repository that has (or should have) explicit governance rules and you want it to verify change scope, evidence and documentation consistency before a pull request or release. It is a guardrail, not a sandbox or a proof of semantic correctness.
Requirements: Runs as a local process over stdio; install the steadfast-governance Python package (Python 3.10+ and Git required). Repository policy and pipeline configuration live in .steadfast/policy.json and .steadfast/pipeline.json, created with the init or onboard commands. No AI API key or declared environment variables.

Before you install

The onboard command writes repository guidance and agent integration files; review generated files before trusting a repository, though existing files are preserved by default. Pipeline manifests are executable configuration, so review their commands before running the pipeline separately. Findings depend on repository policy and should be reviewed before being treated as release decisions. The README also mentions paid pilots and evaluation requests.

Installation

In SourceWeft

Open Steadfast Repository Governance in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Steadfast

Repository checks and guardrails for coding agents.

[Steadfast Repository Governance MCP server]

Steadfast is a local-first CLI that helps developers and AI agents inspect repository health, enforce change scope, verify evidence, and spot documentation drift. It does not generate code, require an AI API key, or send repository contents to a Steadfast-hosted service.

Quick start

Requires Python 3.10+ and Git.

bash

python -m pip install --upgrade steadfast-governancecd /path/to/your/repositorysteadfast onboard --agent codexsteadfast verify

python -m pip install --upgrade steadfast-governancecd /path/to/your/repositorysteadfast onboard --agent codexsteadfast verify

Replace codex with claude, cursor, or all to configure another supported agent. Review generated files before trusting a repository. Existing files are preserved by default.

For the latest unreleased source, install from Git instead:

The commands most people need

Command	Purpose
`steadfast onboard`	Set up repository guidance and selected agent integration.
`steadfast verify`	Run the unified, read-only governance checks.
`steadfast report`	Generate a human-readable audit report.
`steadfast audit`	Check changed files, evidence, contracts, and documentation drift.
`steadfast discover`	Print a machine-readable capability map for tools and agents.
`steadfast mcp-server`	Start the read-only MCP server for compatible agents.

See the quick-start guide for a short walkthrough, the MCP client setup guide to connect compatible AI clients, and the command reference for the full CLI list. For a copy-ready pull-request workflow and an adoption checklist, see Adopt in GitHub Actions.

What it checks—and what it cannot

Scope: compare changed paths with repository policy.
Evidence: check required proof files and evidence-bundle integrity.
Security signals: flag selected risky source patterns and workflow trust-boundary issues.
Documentation and code truth: detect stale command examples and package-entrypoint drift.
Goals and releases: validate goal dependencies and evaluate release readiness.
Agent support: discover skills, inspect MCP configuration, and install repo-local guidance.

These checks are guardrails, not a sandbox or proof of semantic correctness. Results depend on repository policy and configuration; review findings before treating them as release decisions. Steadfast does not silently rewrite plans or execute the configured pipeline as part of verify. Run steadfast pipeline separately only after reviewing its manifest.

Configuration

Run steadfast init to create starter governance files. Repository policy lives in .steadfast/policy.json; pipeline steps are configured in .steadfast/pipeline.json. Treat pipeline manifests as executable configuration and review their commands before running them.

Project links

Development

bash

python -m pip install -e .python -m unittest discover -s tests -vsteadfast docs-checksteadfast code-truth

python -m pip install -e .python -m unittest discover -s tests -vsteadfast docs-checksteadfast code-truth

MIT licensed. See LICENSE.

Source: README.md at commit 3db9b7d

Tools

SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package type cannot run in the sandbox.

Version history

v0.4.1LatestOct 29, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.