WhiteBoxXAI

io.github.AgentaFlow由 GitHub 帳號 AgentaFlow 發布v0.3.2更新於 Oct 29, 2026

AI observability, explainability and governance: drift, fairness, ISO 42001, risk register.

已驗證Streamable HTTP可網頁執行安全與監控資料與分析AI 與機器學習

概覽

AI 產生的概覽

WhiteBoxXAI 向 MCP 用戶端提供 AI 可觀測性、可解釋性與治理工具，涵蓋漂移、公平性、風險登錄與 ISO 42001 證據。

可以做什麼
  • 管理模型與預測：模型登錄、以 Git 為基礎的模型差異比對、預測記錄、模型效能指標
  • 偵測資料漂移並稽核偏差與公平性，支援非同步產生 SHAP/LIME 解釋
  • 解釋大型語言模型：注意力、詞元重要性、敏感度、反事實分析與提示詞除錯
  • 監控 LLM 呼叫（詞元、成本、延遲），以及 RAG 流程監控與內容安全分析
  • 處理治理事務：ISO/IEC 42001 就緒度、合規證據、AI 風險登錄與治理審查查詢、提示詞治理
  • 處理告警（規則、分流脈絡、智慧分析、告警管理）與多代理工作流程追蹤
適用情境
適合需要檢視或彙報已部署 AI 模型與 LLM 應用狀況的情境：檢查漂移、公平性與效能，產生解釋，查閱治理與合規證據，或對 WhiteBoxXAI 帳戶中的告警進行分流。
執行需求
需要 WhiteBoxXAI 帳戶，以及在儀表板（Settings > API Keys）產生的 API 金鑰。本機 stdio 方式以 pip 安裝，設定 WHITEBOXXAI_MCP_API_KEY，可選用 WHITEBOXXAI_MCP_API_BASE_URL；也可使用託管的 Streamable HTTP 端點，於 Authorization 標頭傳入金鑰或個人 JWT。需能連線至 WhiteBoxXAI API。
安裝前請注意
需要密鑰（WHITEBOXXAI_MCP_API_KEY，或 Authorization / X-WhiteBox-API-Key 標頭），該金鑰在明確撤銷前長期有效。工具涉及記錄、告警管理與治理紀錄，部分呼叫可能寫入或變更帳戶資料。託管端點的支援與 SLA 依 Free/Business Cloud 方案而定，部分工作流程成本、瓶頸與時間軸呼叫可能耗時約 30 秒。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 WhiteBoxXAI，將其新增到工作區。
  2. 連接 Authorization token 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.AgentaFlow%2Fwhiteboxxai-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "whiteboxxai": {
      "type": "http",
      "url": "https://api.whiteboxxai.com/mcp/",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

whiteboxxai-mcp

[PyPI version] [Python versions] [Test] [License: MIT]

An MCP (Model Context Protocol) server that exposes WhiteBoxXAI observability and explainability capabilities — model registry, Git-backed model diffing, prediction logging, drift detection, bias/fairness auditing, ISO/IEC 42001 readiness and compliance evidence, AI Risk Register / governance review queries, prompt governance, asynchronous SHAP/LIME explanation generation, LLM explainability (attention/token-importance/sensitivity/counterfactual analysis and prompt debugging), LLM call monitoring (token/cost/latency tracking), RAG pipeline monitoring, content safety analysis, alert rules and triage context, alert intelligence, alert management, multi-agent workflow tracking, and model performance metrics (197 tools across 18 domains) — to any MCP-compatible client (Claude Desktop, Claude Code, LangChain, custom agent harnesses, etc.). Supports MCP Apps (ui:// resources) with sandboxed interactive audit cards, stdio transport, and Streamable HTTP transport (hosted at https://api.whiteboxxai.com/mcp/).

See the integration docs for full setup, connection examples, the tool reference, and known v1 limitations. See examples/ for runnable LangChain, Semantic Kernel, and raw-MCP-client integrations.

Install

bash
pip install whiteboxxai-mcp

Run (stdio — local/self-hosted)

Configure a credential via environment variables, then run the console script. Stdio transport authenticates via WHITEBOXXAI_MCP_API_KEY:

bash
# An API key generated from the WhiteBoxXAI dashboard's Settings > API Keys tab.# Never expires on a fixed schedule -- only when explicitly revoked -- and doesn't require storing a password.export WHITEBOXXAI_MCP_API_BASE_URL="https://api.whiteboxxai.com"export WHITEBOXXAI_MCP_API_KEY="wbx_live_..."
whiteboxxai-mcp

Point your MCP client at this command (e.g. in Claude Desktop's mcpServers config, or Claude Code's .mcp.json).

For hosted Streamable HTTP (https://api.whiteboxxai.com/mcp/), pass your API key or personal JWT in the Authorization: Bearer <token> header.

Agent skills

To have a coding agent set this up and call the tools correctly, give it the whitebox-mcp-server skill (and whitebox-governance-rules). They are published at https://whiteboxxai.com/skills/index.md. The tool list they reference is pinned in tests/mcp_inspector_snapshot.json; a rename or removal of a tool shows up as a diff there.

Versioning & support

This package follows Semantic Versioning; see CHANGELOG.md for release history. Self-hosted stdio usage (above) is best-effort supported; the hosted /mcp/ HTTP endpoint is a product surface whose support/SLA follows the caller's underlying Free/Business Cloud plan.

Known v1 limitations

  • Auth: stdio uses WHITEBOXXAI_MCP_API_KEY — a scoped, revocable credential that isn't tied to a human account's password or session lifecycle. Hosted Streamable HTTP (https://api.whiteboxxai.com/mcp/) accepts an API key or personal JWT.
  • Alerts: covers core alert rules and triage context (whitebox_alerts_*), alert intelligence (whitebox_alert_intelligence_*, 20 tools), and alert management (whitebox_alert_management_*, 13 tools).
  • whitebox_agent_workflows_cost_breakdown/_bottlenecks/_timeline: these three can take up to ~30s — the backend blocks server-side on a Celery task before responding, and the SDK client uses an extended (40s) timeout for exactly these calls.
  • Scope: models, predictions, drift, bias/fairness, AI Risk Register / governance queries, prompts, compliance, explanations, LLM explainability, LLM call monitoring, RAG monitoring, content safety, alert intelligence, alert management, multi-agent workflows, and metrics all ship across 18 domains (197 tools total) over both stdio and hosted Streamable HTTP.

MCP Registry

The server is published to the official MCP Registry as io.github.AgentaFlow/whiteboxxai-mcp.

Development

bash
pip install -e ".[dev]"pytest tests/unit
# MCP Inspector tool-list regression check (needs Node.js); after an intentional# tool change, regenerate the committed snapshot with --writepython tests/check_mcp_inspector_snapshot.py

Releases are cut from GitHub releases; see RELEASING.md.

License

MIT -- see LICENSE.

來源：README.md，提交 f2ebcba

工具

0
該伺服器需要 API 金鑰等憑證，因此 SourceWeft 無法在沒有憑證的情況下讀取其工具，也未收錄。

版本歷史

1
  1. v0.3.2最新Oct 29, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分