Atlas / MCP servers / lua-ai-global / governance-sdk

governance-sdkBLOCK

Name: governance-sdk
Author: lua-ai-global

mcp/lua-ai-global/governance

MCP server by lua-ai-global · agent framework · agent security · ai agents · Audited 2026-10-12

Zero-dependency TypeScript SDK for AI agent governance: policy enforcement, injection detection, tamper-evident audit, and standards mapping (EU AI Act, OWASP, NIST, ISO 42001)

Verdict

BLOCK

Grade

Trust score

46 /100

Exposed tools

60 51r · 7w · 2d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

AI Agent Governance for TypeScript — policy enforcement, behavioral scoring, injection detection, tamper-evident audit, and standards-mapped compliance for AI agents. Zero runtime dependencies.

[](https://www.npmjs.com/package/governance-sdk) [](https://github.com/lua-ai-global/governance/actions/workflows/ci.yml) [](https://packagephobia.com/result?p=governance-sdk) [](./packages/governance/package.json) [](https://www.npmjs.com/package/governance-sdk) [](./LICENSE)

Why

Every AI agent framework lets you build agents. None of them govern what those agents actually do at runtime. governance-sdk adds policy enforcement, behavioral scoring, injection detection, and compliance auditing to any TypeScript agent — regardless of framework.

Three things make governance real, and this SDK does all three:

Point of interception — sits between the agent and the tool/LLM before it fires
Deterministic agent identity — knows who's calling (optional Ed25519 signed tokens)
Ability to block or modify — not just observe after the fact

Everything downstream (scoring, audit, compliance) follows from those three.

Proof, not promises — tamper-evident audit by default. Every enforce() decision and recordOutcome() outcome can be HMAC hash-chained (opt in with integrityAudit: { signingKey }). Any edit, deletion, or sequence-renumber breaks chain verification — verifiable offline anywhere with just the secret. No competitor in the comparison table below ships this.

How it compares

Read from source at commit e9749f156a44OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add governance-sdk-benchmark --env GOVERNANCE_API_KEY=${GOVERNANCE_API_KEY} --env GROQ_API_KEY=${GROQ_API_KEY} --env HF_TOKEN=${HF_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "governance-sdk-benchmark": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GOVERNANCE_API_KEY": "${GOVERNANCE_API_KEY}",
        "GROQ_API_KEY": "${GROQ_API_KEY}",
        "HF_TOKEN": "${HF_TOKEN}"
      }
    }
  }
}

Exposed tools (60)

51 read · 7 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Model`	read	The LLM directly — manipulating its output through prompt-level injection.
`Orchestrator`	read	The agent planner/orchestrator — hijacking goals, redirecting workflows, manipulating planning.
`Parser`	read	Input/output parsers — exploiting format handling, delimiters, or schema validation.
`a`	read	A
`action_type`	read	Gate specific action types
`agent_level`	read	Require minimum governance level
`all_of`	read	Match if all sub-conditions match
`always_block`	read	Always triggers
`any_of`	read	Match if any sub-condition matches
`b`	read	B
`bad_tool`	read	fails
`blocklist`	read	Block input containing specific terms
`broken`	read	A tool that breaks
`calculate`	read
`concurrent_limit`	read	Cap parallel tool executions
`cost_budget`	read	Cap monetary cost per session
`crash`	read	crashes
`custom`	read	Custom
`data_classification`	read	Block classified data access
`database_drop`	destructive	Drop a database table
`db_query`	write	Run a database query
`delete_records`	destructive	Delete database records
`deploy_code`	write	Deploy code to production
`fail`	read	fails
`fetch_data`	read
`from_config`	read	Config condition
`geo_fence`	read	Block actions outside allowed regions
`high_cost`	read	Block when session cost exceeds threshold
`injection_guard`	read	Detect prompt injection attacks (regex detector, synchronous)
`input_length`	read	Reject oversized inputs
`input_pattern`	read	Block input matching a regex
`is_weekend`	read	Check if metadata says weekend
`ml_injection_guard`	read	Consume an ML-classifier score pre-computed by the host.
`network_allowlist`	read	Only allow listed domains
`not`	read	Invert a condition
`output_check`	read	Check output for forbidden content
`output_length`	read	Reject oversized outputs
`output_pattern`	read	Detect patterns in output
`rate_limit`	read	Limit actions per time window
`read_file`	read	Read a file from disk
`require_signed_action`	read	Require a cryptographic signature in action metadata
`require_signed_identity`	read	Require a valid Ed25519 identity signature verified against the host
`schema_only`	write	No execute
`scope_boundary`	read	Restrict file/resource access paths
`send_email`	write	Send an email message
`sensitive_data_filter`	read	Detect leaked credentials and secrets
`shell_exec`	write	Execute a shell command
`temp`	read	Temporary
`tenant_a_check`	read	Tenant A custom condition
`time_window`	read	Restrict to specific hours
`tmp`	read	tmp
`token_limit`	read	Cap per-session token usage
`tool_allowed`	read	Only allow listed tools
`tool_blocked`	read	Block specific tools
`tool_match`	read	Match specific tools by name (outcome-neutral membership test on ctx.tool)
`tool_sequence`	write	Require tools to run in order
`vip_user`	read	Check if user is VIP
`web_search`	read	Search the web for information
`write_file`	write	Write content to a file
`x`	read	x

Trust audit

BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: none-observed
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

research/governance-benchmark/src/generator.ts:41

config: [".env", "/etc/passwd", ".aws/credentials", ".ssh/id_rsa", "kubeconfig"],

Why it matters. touches a credential store

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

README.md:90

- **No built-in red team / jailbreak harness.** Use inspect-ai, PyRIT, or

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

README.md:344

4,835 benign) across 12 sources: TrustAIRLab in-the-wild jailbreak prompts

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

README.md:346

(990), jackhhao jailbreak-classification (538), reshabhs SPML (537),

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

README.md:348

llm-semantic-router jailbreak-detection (371), deepset prompt-injections

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules

node_modules

Why it matters. link not followed

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/governance/src/cli/connect.ts:43

print(`  API Key: ${DIM}${apiKey.slice(0, 8)}...${apiKey.slice(-4)}${RESET}`);

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

packages/governance/src/injection-patterns-ext.ts:42

pattern: /[ΙІі]gn[oοо]re?|ign[οо]re/i,

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

examples/demo-app/src/App.tsx:122

{ label: "API key leak", value: "Here's your config:\nAPI_KEY=sk-proj-4f8a9b2c1d3e5f6a7b8c\nDATABASE_URL=postgres://admin:p@[email protected]:5432", dangerous: true },

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

packages/governance/src/conditions/conditions.test.ts:270

...base, outputText: "Token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij",

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

packages/governance/src/conditions/conditions.test.ts:306

...base, outputText: "Token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij",

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/governance/src/conditions/conditions.test.ts:285

...base, outputText: "-----BEGIN RSA PRIVATE KEY-----\nMIIEow...",

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

database_drop, delete_records

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/governance/src/plugins/mastra-processor-tool-wrap.test.ts:21

execute: async (input: T) => exec(input),

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/governance/benchmark/scripts/llm-audit.ts:132

const { detectInjection } = await import("../../dist/injection-detect.js");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/governance/benchmark/scripts/run-benchmark.ts:48

const { detectInjection } = await import("../../dist/injection-detect.js");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/governance/benchmark/scripts/run-full-baseline.ts:14

import { detectInjection } from "../../src/injection-detect.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/governance/benchmark/scripts/threshold-sweep.ts:49

const { detectInjection } = await import("../../dist/injection-detect.js");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/governance/benchmark/scripts/validate-labels.ts:89

const { detectInjection } = await import("../../dist/injection-detect.js");