Council of AI GSPC

Independent AI governance measurement MCP.

CommunityOnlineNo sign-inGlobalFreeCan modify data

What it can do

  • Measure: Return the GSPC measurement CONTRACT for a subject: which axes exist, how they are graded, and where the published results live. This endpoint DOES NOT MEASURE — it contacts no model and grad
  • Verify: Verify a signed CSOAI card. Recomputes the id (or content_id) from the canonical body under the published rule, checks the Ed25519 signature over exactly those bytes, and pins the signer again
  • Jail Probe: Return the jail-probe verdict CONTRACT for a model and prompt. This endpoint DOES NOT RUN the probe — sandbox execution and signed card issuance happen on the measurement fleet, not here —

What data it sees

Do you need an account

No: the server works without sign-in

Independent AI governance measurement MCP. Remote HTTP (7 tools, no auth): POST https://councilof.ai/mcp — board_totals, get_axis, verify_card, list_cards, get_root, get_card, verify_inclusion. stdio npm csoai-gspc-mcp@0.1.0 is four tools; prefer the remote URL. Verify: https://councilof.ai/gspc-verify. Keywords: AI governance, model safety, EU AI Act, agent verification, MCP governance. Measurement, not certification. UNMEASURED is first-class.

How to connect

How to connect Council of AI GSPC to Claude

The server address to paste into Claude settings:

https://gspc--csoai.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect Council of AI GSPC to ChatGPT

The server address to paste into ChatGPT settings:

https://gspc--csoai.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect Council of AI GSPC to Cursor

The server address to paste into Cursor settings:

https://gspc--csoai.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (8)

Raw names from tools/list. Only developers need these.

measureReturn the GSPC measurement CONTRACT for a subject: which axes exist, how they are graded, and where the published results live. This endpoint DOES NOT MEASURE — it contacts no model and grades nothing, so it always answers measured:false. Published measurements are at GET /api/gspc (axes) and /signed/card_index.json (signed cards); an axis with no card is UNMEASURED and stays UNMEASURED. Never a certification.
verifyVerify a signed CSOAI card. Recomputes the id (or content_id) from the canonical body under the published rule, checks the Ed25519 signature over exactly those bytes, and pins the signer against the keys published at did:web:csoai.org. Recognises both published families: gspc.measurement-card (top-level id + body + pubkey + signature) and the content_id families (cross-border, axis-signal). A hash mismatch, an invalid signature and an unpublished signing key are reported as three DIFFERENT failures — they mean different things. Accepts the card as an object, as a JSON string, or as a councilof.ai / csoai.org URL. Free, anonymous, no account. There is no time-anchor: CSOAI publishes no RFC-3161 token and this tool does not pretend to check one.
jail-probeReturn the jail-probe verdict CONTRACT for a model and prompt. This endpoint DOES NOT RUN the probe — sandbox execution and signed card issuance happen on the measurement fleet, not here — so it always answers measured:false and issues no verdict. Never a certification.
enter-arenaSelf-enrolment for external agents. Present an A2A agent card URL + machine-readable consent:true; we run the honest live predicates now (card validity, signing state, endpoint liveness) and return an UNSIGNED intake receipt with contentId, queued for signed fleet measurement. No placement for sale, Firewall 2, UNMEASURED shown honestly.
board_totalsLive GSPC board totals from https://councilof.ai/api/gspc. Returns the slot count and the measured count as two labelled numbers WITH their kind — a slot is a declared position on the board, a measurement is a real run behind it; the two are never summed and never swapped — plus as_of dates for the board and for this fetch. We measure, never certify. If the board cannot be fetched the answer is a distinct UNREACHABLE state: no cached number is ever presented as live.
get_axisOne axis row from the live GSPC board at https://councilof.ai/api/gspc: n, accuracy, interval, MEASURED or UNMEASURED status, family, and dates. An unmeasured axis is a first-class answer — a declared slot with no run behind it, published so the gap is visible — never an error and never a zero. Never a certification.
verify_cardVerify a signed gspc.measurement-card under the published rule (https://councilof.ai/signed/HOW-TO-VERIFY.md): recompute the id from the canonical body bytes, then check the Ed25519 signature under the PINNED key published at did:web:csoai.org#card-attestation-1. A card that carries its own key proves only that the file is self-consistent — anyone can alter a body and sign it with a key they just generated — so a signer other than the published key is reported INVALID. Three verdicts, never two: VALID, INVALID (with the reason), or UNCHECKABLE when the check could not be completed — 'could not check' is a different claim from 'forged'. Accepts the card as a JSON object, a JSON string, or a councilof.ai / csoai.org URL. Never a certification.
list_cardsThe published signed-card index (https://councilof.ai/signed/card_index.json): what the index declares (n_cards) and how many rows it actually carries, reported next to — never reconciled with — the count the card store endpoint (https://councilof.ai/api/cards) reports for itself. Two labelled numbers from two surfaces; if they disagree, this tool shows the disagreement rather than picking one. Optional filters return recent rows: axis, limit.