WhitePact

Why WhitePact?

AI agents do more than generate text. They call tools, access information and propose actions that can change real systems.

An AI model proposing an action is not the same as an authorized system permitting that action.

WhitePact is designed to help developers put policy, identity, approvals, risk assessment and accountable evidence between an autonomous agent's proposal and its execution. It is an additional governance layer—not a substitute for secure application design or a guarantee that every AI risk can be eliminated.

What WhitePact covers

These are product areas and published software capabilities, not a claim that every component is deployed, externally audited or generally available as an enterprise service. Feature availability depends on the particular released package and deployment.

Start with the published open-source package

The existing package is distributed on PyPI as rai-governance-platform, with Python 3.11+ support. The historical distribution and import names are retained for compatibility; WhitePact is the product name.

Latest PyPI release verified on 1 November 2026: 1.2.6, released 30 August 2026.

python -m pip install "rai-governance-platform==1.2.6"

For developer-facing MCP support, the published distribution declares an mcp optional dependency group:

python -m pip install "rai-governance-platform[mcp]==1.2.6"

The package documentation identifies whitepact-mcp as a self-hosted MCP entry point. Configure and validate the appropriate local service, authentication and dependencies for your environment before using it with an MCP client.

See the published PyPI release for the actual distribution files, package metadata, supported extras, provenance and accompanying open-source license.

Important: Self-hosted package availability does not prove the availability of a separate hosted MCP service. Public directory listings may contain stale or unreachable endpoints. Check live connectivity and authentication before relying on any remote connection.

The open-source / enterprise separation

WhitePact follows a separated publication model:

This is a documentation repository, not the WhitePact enterprise source repository. It must not contain private source code, internal configuration, security reports, tokens, proprietary deployment files or confidential customer information.

Past MIT-licensed open-source releases retain the rights provided by the licenses under which they were distributed. Making a development repository private does not retroactively remove those rights or recall copies already distributed.

Current product readiness

Status as of 1 November 2026: The broader WhitePact enterprise runtime is still undergoing security and integration qualification. Global enterprise production deployment has not been authorized.

Successful component tests, a published package, badges or an MCP listing must not be treated as an end-to-end security certification or proof of production readiness.

Users may evaluate the published open-source package according to its release-specific documentation and license. No claim is made here that a new enterprise hosted service, production identity-verification workflow or public SaaS launch is generally available.

Integration ecosystem

WhitePact has a published MCP-related software offering and third-party directory listings. Listings establish discoverability, not service uptime or production acceptance.

• PyPI: rai-governance-platform — versioned downloadable Python distribution.
• Official MCP Registry — search for WhitePact; review the listing's current package and remote metadata before connecting.
• Smithery: WhitePact — third-party listing; connection availability must be checked independently.

Do not send production data, credentials or consequential instructions to an endpoint solely because it appears in a directory.

Responsible security reporting

Please do not publish exploitable vulnerability details, private tokens or customer information in public issues. Contact WhitePact security with a concise impact statement and safe reproduction details. This repository's public issues are for documentation and product-discovery matters only.

Licensing and rights

The published rai-governance-platform release is distributed under the MIT License. See the license included with the specific distributed software.

This public documentation repository does not grant a license to any privately held, unpublished implementation, and it does not change licenses already granted for previously released source or packages. Product and brand use may be governed separately from software copyright licenses.