Korext: AI Code Governance

io.github.Korext由 GitHub 帳號 Korext 發布v3.0.1更新於 Oct 24, 2026

Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

Korext 依合規政策包檢查 AI 產生的程式碼，回報附帶治理背景的違規項目，並產生簽章證明包。

可以做什麼
以一個或多個政策包檢查程式碼片段，回傳違規項目的嚴重程度、行號，以及 CWE、MITRE 和法規引用等治理背景。取得政策包的強化政策指示與現行標準。列出附產業與地區標籤的可用政策包。掃描程式碼並產生加密簽章的證明包，包含判定、違規數量和驗證連結。依 ID 取得既有證明包，查看其判定、違規項目、政策包和驗證狀態。
適用情境
適合助理撰寫或審查必須符合合規或安全政策的程式碼時使用，例如 web、PCI-DSS、OWASP、GDPR 或 HIPAA 政策包，希望在撰寫過程中標出違規並留下簽章紀錄。
執行需求
可作為 app.korext.com 的遠端端點執行，也可透過 npm 套件 korext 搭配 npx 在本機執行。完整存取需要帶有 Korext 儀表板 Settings 產生之 Bearer 權杖的 Authorization 標頭；沒有權杖時匿名模式每小時限 20 次請求且政策包有限。需要網路存取。
安裝前請注意
Authorization 標頭帶有機密 API 權杖，應避免出現在日誌和共用設定中。程式碼片段與被掃描的程式碼會傳送到 Korext 伺服器檢查，需考量資料敏感度和處理區域。證明包是通過或阻擋判定的簽章紀錄，不能取代完整稽核。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Korext: AI Code Governance，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.Korext%2Fgovernance/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "korext-ai-code-governance": {
      "type": "http",
      "url": "https://app.korext.com/api/mcp"
    }
  }
}

README

KOREXT Enforce Action

Enforce compliance policies on AI generated code in your GitHub workflows.

72 policy packs. 532 rules. 13 languages. Violations appear as GitHub Code Scanning annotations on pull requests.

Quick Start

Add this to .github/workflows/korext.yml:

yaml
name: Korext Enforcementon: [push, pull_request]
permissions:  contents: read  security-events: write
jobs:  enforce:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: Korext/enforce-action@v3        with:          api-token: ${{ secrets.KOREXT_API_TOKEN }}

Korext scans your code on every push and PR using the default web policy pack.

How It Works

  1. Install: The action installs the Korext CLI
  2. Scan: Runs korext enforce against your codebase with the selected policy pack
  3. Report: Generates a SARIF file and uploads it to GitHub Code Scanning
  4. Gate: Fails the workflow if critical or high severity violations are found

Violations appear as annotations directly on the PR diff, powered by GitHub Code Scanning.

Inputs

InputDescriptionRequiredDefault
directoryDirectory to scan for policy violationsNo.
packPolicy Pack ID to enforceNoweb
api-tokenKorext API token for authenticated modeNo(anonymous)
fail-on-violationsFail workflow on critical/high violationsNotrue
sarif-uploadUpload SARIF to GitHub Code ScanningNotrue
regionData processing region (us, eu, apac)No(default)
sign-bundlesRequest signed proof bundlesNotrue

Outputs

OutputDescription
violationsTotal number of policy violations found
sarif-filePath to the generated SARIF results file
bundle-countNumber of proof bundles generated
bundles-signedNumber of signed proof bundles
bundle-idsComma separated list of proof bundle IDs

Examples

Multiple Policy Packs

yaml
- uses: Korext/enforce-action@v3  with:    pack: web,pci-dss-v1,owasp-v1    api-token: ${{ secrets.KOREXT_API_TOKEN }}

EU Data Sovereignty

yaml
- uses: Korext/enforce-action@v3  with:    pack: gdpr-v1    region: eu    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Scan Specific Directory

yaml
- uses: Korext/enforce-action@v3  with:    directory: src/    pack: hipaa-v1    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Warn Only (do not fail)

yaml
- uses: Korext/enforce-action@v3  with:    pack: web    fail-on-violations: 'false'

Authentication

For full access to all policy packs and signed proof bundles, create an API token in your KOREXT dashboard and add it as a GitHub secret:

  1. Go to app.korext.com > Settings > API Tokens
  2. Create a new token
  3. Add it as KOREXT_API_TOKEN in your repo's Settings > Secrets and variables > Actions

Without a token, the action runs in anonymous mode (20 requests per hour, limited packs).

Links

License

Proprietary. See Terms of Service.

來源：README.md，提交 94d49ae

工具

5

get_directives

Get enriched policy directives and living standards for one or more policy packs. Returns rules with governance context (CWE, MITRE, regulatory references) for inference time enforcement.

輸入參數packId

check_code

Check a code snippet against one or more policy packs. Returns violations with severity, governance context (CWE, MITRE, regulatory), and line numbers.

輸入參數code必填packId

list_packs

List available policy packs with industry and region tags.

輸入參數regionindustry

generate_proof

Scan code against policy packs and generate a cryptographically signed proof bundle. Returns the bundle ID, decision (PASS/BLOCK), violation count, and verification URL.

輸入參數code必填packIdfileNamelanguage

get_proof

Retrieve an existing proof bundle by ID. Returns the decision, violations, packs, and verification status.

輸入參數bundleId必填

版本歷史

1
  1. v3.0.1最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分