Governance Mcp

works.mimaPublished by mima.worksv0.1.13Updated Oct 24, 2026

AI governance evidence for EU AI Act, ISO 42001, SOC 2, and NIST AI RMF.

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Mima governance MCP server that lets an assistant read AI compliance posture and push evidence records mapped to EU AI Act, ISO 42001, SOC 2 and NIST AI RMF.

What you can do
  • Read compliance posture and per-framework readiness breakdowns
  • List registered and unregistered AI systems, and evidence records filtered by system and time
  • Preview and write GRC evidence records, including dry-run attestations before committing
  • Register AI systems under EU AI Act Art. 9 and record policy acknowledgments
  • Derive recommended evidence types and check or suggest compliance gates with pass/fail status
When to use it
Useful when a team tracks AI governance and wants an assistant to check readiness, register AI systems, or file compliance evidence against several frameworks from inside the coding agent.
Requirements
Runs locally over stdio via npx from the npm package @mima-ai/governance-mcp. Needs a Mima account and two required environment variables: MIMA_API_KEY and MIMA_WORKSPACE_ID. Desktop only; network access to the Mima service.
Before you install
Requires a Mima API key (MIMA_API_KEY) and workspace ID, which are stored in the MCP config. Several tools write data to the Mima workspace: attest, register_system and acknowledge_policy create records, so use dry_run_attest first. Evidence and system details are sent to the third-party Mima service.

Installation

In SourceWeft

  1. Open Governance Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@mima-ai/governance-mcp

[governance-mcp MCP server] [MCP Badge]

MCP server for AI governance — push compliance evidence to Mima from any agent, any stack, 4 lines of config.

One tool call maps to EU AI Act, ISO 42001, SOC 2, and NIST AI RMF simultaneously. Your readiness score updates automatically.

Install

bash
npx @mima-ai/[email protected]

Or add to your MCP config (always pin the version):

json
{  "mcpServers": {    "mima-governance": {      "command": "npx",      "args": ["-y", "@mima-ai/[email protected]"],      "env": {        "MIMA_API_KEY": "mima_ext_...",        "MIMA_WORKSPACE_ID": "ws-..."      }    }  }}

10 tools

ToolWhat it does
get_postureOverall readiness score + per-framework breakdown
list_systemsAll AI systems — registered vs unregistered
list_evidenceEvidence records filtered by system and time
dry_run_attestPreview which controls an attestation would earn
attestWrite a GRC evidence record
register_systemRegister an AI system under EU AI Act Art. 9
acknowledge_policyRecord a policy acknowledgment
derive_controlsRecommended evidence types for a system description
check_gatesGate pass/fail status with exit codes
suggest_gatesPrioritised gate recommendations

Usage — Claude Code

Add to ~/.claude/settings.json:

json
{  "mcpServers": {    "mima-governance": {      "command": "npx",      "args": ["-y", "@mima-ai/governance-mcp"],      "env": {        "MIMA_API_KEY": "mima_ext_...",        "MIMA_WORKSPACE_ID": "ws-..."      }    }  }}

Then ask Claude: "Check our compliance posture" or "Register this AI system and suggest which controls we need."

Usage — Cursor / Windsurf

Add to .cursor/mcp.json or .windsurf/mcp.json in your project root:

json
{  "mcpServers": {    "mima-governance": {      "command": "npx",      "args": ["-y", "@mima-ai/governance-mcp"],      "env": {        "MIMA_API_KEY": "mima_ext_...",        "MIMA_WORKSPACE_ID": "ws-..."      }    }  }}

Dry-run support

All write tools support dry-run — preview what controls you'd earn before committing:

dry_run_attest({ record_type: "ai_risk_assessment", system_name: "loan-scorer" })// → { mapped_controls: ["EUAIA_ART9", "ISO42001_6_1", "NIST_AIRF_MAP_1"] }

Four frameworks, one call

FrameworkWhat it covers
EU AI ActArt. 9–15 risk management, oversight, accuracy obligations
ISO 42001AI management system controls — A.6.x risk, A.9.x performance
SOC 2CC3.x–CC8.x risk, change, and incident management
NIST AI RMFGOVERN, MAP, MEASURE, MANAGE functions

Get an API key

mima.works → sign up → copy your key from the dashboard.

Python SDK

For app-code attestation (decorators, batch pushes, pre-approval gates):

bash
pip install mima-governance

Docs

docs.mima.works

Source: README.md at commit 54f9294

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.13LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.