Korext: AI Code Governance

io.github.Korext由 GitHub 账号 Korext 发布v3.0.1更新于 Oct 24, 2026

Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

Korext 依据合规策略包检查 AI 生成的代码，报告带治理背景的违规项，并生成签名证明包。

可以做什么
用一个或多个策略包检查代码片段，返回违规项的严重级别、行号以及 CWE、MITRE 和监管引用等治理背景。获取策略包的增强策略指令与现行标准。列出带行业和地区标签的可用策略包。扫描代码并生成加密签名的证明包，包含决定、违规数量和验证链接。按 ID 获取已有证明包，查看其决定、违规项、策略包和验证状态。
适用场景
适合助手编写或审查必须符合合规或安全策略的代码时使用，例如 web、PCI-DSS、OWASP、GDPR 或 HIPAA 策略包，希望在编码过程中标出违规并留下签名记录。
运行要求
可作为 app.korext.com 的远程端点运行，也可通过 npm 包 korext 配合 npx 在本地运行。完整访问需要携带 Korext 控制台 Settings 中生成的 Bearer 令牌的 Authorization 请求头；无令牌时匿名模式每小时限 20 次请求且策略包有限。需要网络访问。
安装前请注意
Authorization 请求头携带密钥 API 令牌，应避免出现在日志和共享配置中。代码片段和被扫描的代码会发送到 Korext 服务器检查，需考虑数据敏感性和处理区域。证明包是对通过或阻止决定的签名记录，不能替代完整审计。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Korext: AI Code Governance，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.Korext%2Fgovernance/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "korext-ai-code-governance": {
      "type": "http",
      "url": "https://app.korext.com/api/mcp"
    }
  }
}

README

KOREXT Enforce Action

Enforce compliance policies on AI generated code in your GitHub workflows.

72 policy packs. 532 rules. 13 languages. Violations appear as GitHub Code Scanning annotations on pull requests.

Quick Start

Add this to .github/workflows/korext.yml:

yaml
name: Korext Enforcementon: [push, pull_request]
permissions:  contents: read  security-events: write
jobs:  enforce:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: Korext/enforce-action@v3        with:          api-token: ${{ secrets.KOREXT_API_TOKEN }}

Korext scans your code on every push and PR using the default web policy pack.

How It Works

  1. Install: The action installs the Korext CLI
  2. Scan: Runs korext enforce against your codebase with the selected policy pack
  3. Report: Generates a SARIF file and uploads it to GitHub Code Scanning
  4. Gate: Fails the workflow if critical or high severity violations are found

Violations appear as annotations directly on the PR diff, powered by GitHub Code Scanning.

Inputs

InputDescriptionRequiredDefault
directoryDirectory to scan for policy violationsNo.
packPolicy Pack ID to enforceNoweb
api-tokenKorext API token for authenticated modeNo(anonymous)
fail-on-violationsFail workflow on critical/high violationsNotrue
sarif-uploadUpload SARIF to GitHub Code ScanningNotrue
regionData processing region (us, eu, apac)No(default)
sign-bundlesRequest signed proof bundlesNotrue

Outputs

OutputDescription
violationsTotal number of policy violations found
sarif-filePath to the generated SARIF results file
bundle-countNumber of proof bundles generated
bundles-signedNumber of signed proof bundles
bundle-idsComma separated list of proof bundle IDs

Examples

Multiple Policy Packs

yaml
- uses: Korext/enforce-action@v3  with:    pack: web,pci-dss-v1,owasp-v1    api-token: ${{ secrets.KOREXT_API_TOKEN }}

EU Data Sovereignty

yaml
- uses: Korext/enforce-action@v3  with:    pack: gdpr-v1    region: eu    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Scan Specific Directory

yaml
- uses: Korext/enforce-action@v3  with:    directory: src/    pack: hipaa-v1    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Warn Only (do not fail)

yaml
- uses: Korext/enforce-action@v3  with:    pack: web    fail-on-violations: 'false'

Authentication

For full access to all policy packs and signed proof bundles, create an API token in your KOREXT dashboard and add it as a GitHub secret:

  1. Go to app.korext.com > Settings > API Tokens
  2. Create a new token
  3. Add it as KOREXT_API_TOKEN in your repo's Settings > Secrets and variables > Actions

Without a token, the action runs in anonymous mode (20 requests per hour, limited packs).

Links

License

Proprietary. See Terms of Service.

来源：README.md，提交 94d49ae

工具

5

get_directives

Get enriched policy directives and living standards for one or more policy packs. Returns rules with governance context (CWE, MITRE, regulatory references) for inference time enforcement.

输入参数packId

check_code

Check a code snippet against one or more policy packs. Returns violations with severity, governance context (CWE, MITRE, regulatory), and line numbers.

输入参数code必填packId

list_packs

List available policy packs with industry and region tags.

输入参数regionindustry

generate_proof

Scan code against policy packs and generate a cryptographically signed proof bundle. Returns the bundle ID, decision (PASS/BLOCK), violation count, and verification URL.

输入参数code必填packIdfileNamelanguage

get_proof

Retrieve an existing proof bundle by ID. Returns the decision, violations, packs, and verification status.

输入参数bundleId必填

版本历史

1
  1. v3.0.1最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分