Model Context Protocol governance

From agent request to governance response

KoraSafe^™ exposes a standards-compliant MCP server that any AI agent can connect to for real-time governance intelligence.

What agents can do via MCP

KoraSafe^™'s MCP server exposes governance tools that any standards-compliant agent can invoke programmatically.

Query regulatory Knowledge Base

Agents can search and retrieve relevant regulations, standards, and compliance requirements from KoraSafe^™'s curated regulatory knowledge base. Supports semantic queries across EU AI Act, NIST AI RMF, ISO/IEC standards, and sector-specific frameworks.

Check compliance status

Real-time compliance verification for any registered AI system. Agents can check whether a model, workflow, or deployment meets active policy requirements before proceeding with an action -- enabling governance-aware decision-making at runtime.

Report governance events

Agents can report violations, flag anomalies, submit assessment results, and log governance-relevant events directly into KoraSafe^™'s tamper-evident audit trail. Every event is timestamped, attributed, and tied to the originating agent and organization.

Agent discovery and interoperability

KoraSafe^™ publishes a standardized agent card that describes its governance capabilities, supported tools, and authentication requirements. Any MCP-compatible agent can discover and connect automatically -- no custom integration needed.

Simple, standards-based integration

Connect any MCP-compatible agent to KoraSafe^™'s governance layer with a single tool call. Here's what a typical exchange looks like.

MCP Request / Response

// Agent requests a compliance check via MCP { "method": "tools/call", "params": { "name": "check_compliance", "arguments": { "system_id": "ai-credit-scoring-v2", "framework": "eu-ai-act", "context": "pre-deployment" } } } // KoraSafe^™ governance response { "result": { "status": "compliant", "risk_level": "high", "framework": "EU AI Act - Article 6(2)", "requirements_met": true, "obligations": [ "Conformity assessment completed", "Risk management system documented", "Human oversight measures in place" ], "audit_ref": "ks-audit-9f3a7b2e" } }

What an SDK should expect

The MCP server returns two shapes: JSON-RPC errors for tool dispatch failures and plain HTTP errors for transport-level failures. Code your retry logic against this table.

Code	Surface	Meaning	Retry behavior
HTTP 403 FORBIDDEN	Transport	API key missing, revoked, or not authorized for this tool.	Do not retry. Rotate the key or check audience scope.
HTTP 429 RATE_LIMITED	Transport	Per-token rate limit hit. Response includes `Retry-After`.	Retry after the backoff window in the header.
-32600 INVALID_REQUEST	JSON-RPC	Malformed envelope. Missing `method`, bad JSON, wrong protocol version.	Do not retry. Fix the request.
-32601 METHOD_NOT_FOUND	JSON-RPC	Tool name not in the registry, or audience scope hides it.	Do not retry. Call `tools/list` first.
-32602 INVALID_PARAMS	JSON-RPC	Required arg missing or wrong type.	Do not retry without fixing the call.
-32001 INSUFFICIENT_PERMISSIONS	JSON-RPC	Caller lacks write access for a write or admin tool.	Do not retry with the same credential. Use a service token or super admin session.
-32603 INTERNAL_ERROR	JSON-RPC	Server-side dispatch failure. Database error, downstream timeout, embedding service unavailable.	Retry with exponential backoff. Surface to the operator if it persists.

Idempotency for report_incident: pass an idempotencyKey in the tool arguments. Replaying the same key returns status: "existing" with the original incident record, so safe retries do not double-write the audit log.

Client surfaces

Governance where your team works

KoraSafe^™ extends beyond the web platform. MCP-powered governance runs inside your IDE, browser, and CI/CD pipeline.

VS Code extension

Workspace AI discovery, pre-launch checks, and system status in the IDE. The extension connects engineers to KoraSafe^™ governance context without editing code or enforcing policy locally.

Chrome extension

Manifest V3 browser extension that observes supported AI surfaces, records shadow AI usage, and displays governance context. Findings from customer-selected runtime tools feed back to the platform for review. Currently in Preview and not yet on the Chrome Web Store; Web Store rollout once the install path settles.

GitHub Action

Drop-in CI/CD governance gate. Runs governance checks on every pull request, posts findings as PR comments, and creates Check Runs that block merges on critical findings.

JS and Python SDKs

Programmatic access to the full governance API. Submit code for audit, query findings, manage policy packs, and trigger remediation from your own applications and scripts.

Keep exploring

Related KoraSafe^™ technology pages.

Govern AI agents with MCP.