governance-platform

Pre-execution governance for AI agents.

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

    What data it sees

    Do you need an account

    No: the server works without sign-in

    Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.

    How to connect

    How to connect governance-platform to Claude

    The server address to paste into Claude settings:

    https://app.geodesiclabs.ai/mcp

    1. Open Claude (claude.ai or the desktop app).
    2. Go to Settings → Connectors.
    3. Click Add custom connector.
    4. Paste the server address copied below into Remote MCP server URL and click Add.
    5. In a chat, click + → Connectors and switch the new connector on.

    Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

    Authorization

    After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

    How to connect governance-platform to ChatGPT

    The server address to paste into ChatGPT settings:

    https://app.geodesiclabs.ai/mcp

    1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
    2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
    3. Open Settings → Connectors and click Create.
    4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
    5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
    6. In a new chat open + → Apps/Connectors and enable the connector.

    OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

    Authorization

    On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

    How to connect governance-platform to Cursor

    The server address to paste into Cursor settings:

    https://app.geodesiclabs.ai/mcp

    Fastest: click Open in Cursor below and confirm the prompt.

    Manually:

    1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
    2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
    3. Save the file. The server appears in the MCP list; authorize it there if asked.

    Authorization

    If the service needs sign-in, an authorize button appears next to the server in the MCP list.

    Server tool list (37)

    Raw names from tools/list. Only developers need these.

    validateValidate structured data against a Blueprint's rules BEFORE the result is used. Returns PASS, FAIL, or REVIEW with plain-language findings, repair suggestions, a determinism hash, and a re-verifiable certificate. Same input + same rules = same verdict, every time.
    validate_repairValidate structured data against a Blueprint and, when it fails, include repair suggestions (corrected values with the rule each fix is based on) in the same call. Same verdicts as validate: PASS, FAIL, or REVIEW, with reasons and proof.
    create_blueprintCreate a Blueprint - the governance contract validation runs against. A Blueprint defines what correct means for your data: fields, the math that must hold between them, and acceptable ranges. Start from load_rule_pack or discover_patterns if you have no rules yet; invoke the blueprint_guide prompt for the full rule/constraint reference. Returns the new Blueprint's API key.
    list_blueprintsList the Blueprints on this account with field/rule/constraint counts and mode. Use the returned workflow_name as 'blueprint' in validate.
    repairOne-shot repair: return corrected values that would make failing data valid under the Blueprint. Use repair_path to see the steps instead.
    check_blueprint_healthStatic pre-deploy analysis of a Blueprint's rule set. Returns a health verdict - healthy, acceptable, fragile, rigid, split, brittle_islands, or unsatisfiable - with advice, including joint conflicts pairwise checks miss.
    compare_semantic_equivalenceCompare two payloads under the dual-hash design: content_hash is content_hash normalizes field order and numeric formatting. Semantic comparison preserves field roles; renaming requires an explicit bijection. With supplied rules, scalar types and whitespace remain significant. Structural similarity alone does not establish decision equivalence.
    govern_inferenceQuality-govern an in-progress AI generation step BEFORE its output is used (complements validate, which checks finished documents). Returns an action - STOP, CONTINUE, REPAIR_REGION, REUSE_MOTIF, REVIEW, ESCALATE - with a plain-language explanation. Structural scores do not establish task correctness. Check safe_to_finalize and acceptance coverage. Persistence success is reported; read traces in the same Blueprint namespace.
    get_inference_traceRetrieve the durable audit trail for a governed generation: every recorded decision and its reasons.
    recent_inference_decisionsRecent generation-governance decisions in this owner's Blueprint version.
    verify_certificateIndependently re-verify a validation certificate. Integrity mode checks the hash chain; full mode (certificate + original data) recomputes every attested rule from scratch - trust nothing, recheck everything.
    profile_blueprint_robustnessSweep the Blueprint's numeric constraint bounds and report verdict stability: the stable band, the scales where the verdict first flips, and advice. Use before deploying bound changes.
    forecastDeterministic forward reasoning: from the current data state, generate and rank the valid next states reachable under the Blueprint's rules.
    discover_patternsLearn candidate validation rules and structural document types from a batch of your records, deterministically - no Blueprint required. Promote results with approve_rule. Source data is not stored.
    repair_pathFind the shortest sequence of field changes taking invalid data to a valid state, as an ordered path of intermediate states. Different from repair (one-shot nearest fix): use repair_path to explain or audit the fix, or compare alternative repairs.
    counterfactualRun the same data under two rule sets and compare which future states remain valid - what-if analysis for rule changes.
    analyze_anomalyExplain whether a record fits the usual pattern for records like it, and which fields stand out. No Blueprint required.
    create_chainCreate a multi-agent sequential chain: stages validate in order against one Blueprint, repairs propagate forward, TTL bounds the run. Siblings: submit_chain_stage advances the chain; handoff_audit verifies a transition between stages. Returns chain_id.
    submit_chain_stageSubmit data for the chain's current stage; the platform validates it and advances the chain if it passes. Response includes next-stage info and accumulated repairs.
    handoff_auditAudit a handoff between two chain stages: a context capsule of verified facts from the prior stage, and (if proposed_data is given) a compatibility verdict that catches fields mutated in transit. Siblings: create_chain, submit_chain_stage.
    approve_rulePromote a rule discovered by discover_patterns into Blueprint-ready form.
    reject_ruleReject a discovered candidate rule so it will not be promoted into a Blueprint. Pair with approve_rule after discover_patterns.
    structural_typesRetrieve the document categories a discover_patterns session identified (counts, distinguishing fields, domain hints). Read-only; returns status=no_session if discovery has not run for this namespace.
    decompose_failureSplit the error between original and corrected values into direct rule violations, boundary violations, and systemic structural error, with per-field contributions. Use with a known-correct version to diff against; use analyze_anomaly when you only have the suspicious payload. Diagnostics-tier tool.
    geometric_confidenceSummarize an already-computed state_vector into a confidence level (high/medium/low) with a recommendation. Post-hoc digest - use analyze_anomaly or check_drift for fresh analysis of raw data.
    check_realizationStructural realization analysis of a payload against the Blueprint's reference configuration (requires a 'realization' block; otherwise status=skipped). Diagnostics-tier tool; prefer validate or analyze_anomaly for standard checks.
    check_driftCheck whether recent submissions still match the established pattern for this Blueprint. Returns a stability verdict and observation count.
    authorize_executionGo/no-go for a real-world action (payment, filing, API write): runs full validation, then the Blueprint's execution gate. authorized=true only on PASS; REVIEW means do not proceed automatically. Different from validate: validate asks is this data correct, authorize_execution asks should this action happen.
    load_rule_packLoad a prebuilt Blueprint template (invoices, timecards, legal, POs, claims). Call without pack_id to list packs; then create_blueprint to save a customized copy.
    get_execution_traceRun validation and return the per-node execution trace (node names, deterministic flags, timing) plus the verdict and determinism hash. Use validate for normal operation; this is for debugging and audit preparation.
    verify_replayCheck replay commitment integrity and compare recorded execution components. Version 4 includes reference context and the final result/status. A match compares commitments; this tool does not rerun the workflow or reconstruct historical reference populations, and does not prove factual correctness.
    account_statusThis account's plan, key usage, Blueprint counts, and the deployed platform build fingerprint (version, build, deployed).
    delete_blueprintPermanently delete a Blueprint and revoke its API keys. Irreversible; requires confirm=true. Account-level keys are unaffected.
    update_blueprintUpdate an existing Blueprint in place. Only passed fields change; pass [] to clear a list. workflow_name cannot be renamed and existing API keys keep working. Different from create_blueprint: modifies an existing Blueprint, mints no new key.
    list_api_keysList this account's API keys (masked) with their Blueprint bindings.
    rotate_api_keyReplace an API key with a fresh one. The old key stops working immediately; the new key inherits its bindings.
    delete_api_keyPermanently delete one of the caller's API keys. DESTRUCTIVE — agents using the deleted key will receive auth errors immediately. The Blueprint a key was tied to (if any) is NOT affected; only the credential is revoked. To delete a Blueprint and all its keys, use delete_blueprint. The target key can be specified two ways: - As the full key string (gai_...). - As a key_id (SHA-256 hash from list_api_keys).