Governance

Local

docs.mima.worksDeveloper Tools0Updated 17w ago

About Governance

Governance is an MCP server for sending AI governance evidence to Mima from agents and stacks. It provides tools for readiness checks, system registration, evidence attestations, and gate recommendations across four named frameworks.

Key features

01Readiness scores by framework
02AI system registration
03Evidence listing and attestation
04Dry-run control previews
05Compliance gate checks and suggestions

Use cases

01Review governance readiness across frameworks
02Register an AI system and identify controls
03Preview controls before attesting evidence

MCP support

Exposes 10 governance tools to MCP clients, including readiness queries, system registration, evidence attestation, and gate checks. Write tools support dry runs.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config

{
  "mcpServers": {
    "governance": {
      "command": "npx",
      "args": [
        "-y",
        "@mima-ai/governance-mcp"
      ],
      "env": {
        "MIMA_API_KEY": "<MIMA_API_KEY>",
        "MIMA_WORKSPACE_ID": "<MIMA_WORKSPACE_ID>"
      }
    }
  }
}

Run commandnpx -y @mima-ai/governance-mcp

Environment variables to set

MIMA_API_KEYSecretYour Mima API key (mima_ext_...)

MIMA_WORKSPACE_IDYour Mima workspace ID (ws-...)

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages

npm@mima-ai/governance-mcp0.1.13stdio

Tools

Saved tool list · updated 3w ago

Parameter	Type	Required	Description
payload	object	Yes	Event-specific fields. Unknown fields are stored but do not earn additional controls. For human_oversight: { decision, reviewer, outcome_summary, system_prompt_version? }. For ai_risk_assessment: { risk_level, risk_summary, art5_self_assessment?, mitigations? }. For model_evaluation: { accuracy, robustness_score?, bias_metrics?, evaluated_by? }. For incident_report: { severity, description, resolution? }.
identity	string	No	User or service identity performing the action. E.g. '[email protected]'.
resource	string	No	The resource or entity acted upon. E.g. 'customer-id:12345'.
environment	enum	No	Deployment environment. Defaults to 'production' on the server side.production \| staging \| development
occurred_at	string	No	ISO 8601 timestamp of when the event occurred. Defaults to now.
record_type	enum	Yes	The governance event type. Maps to the SDK's 11 record types.access_review \| change_event \| vendor_risk \| policy_acknowledged \| incident_report \| ai_risk_assessment \| training_data_governance \| model_evaluation \| human_oversight \| model_drift_event \| governance_review
system_name	string	Yes	Name of the AI system generating this record. E.g. 'loan-scoring-v2'. Alphanumeric, spaces, hyphens, underscores, and dots only.
enforce_gates	boolean	No	If true, checks all required governance gates before writing. Recommended for production actions and high-risk systems. If a required gate is failing, the write is blocked — use dry_run_attest to confirm this record would earn controls that close the gap, then re-call attest without enforce_gates once you have verified the impact.

Details

From the project README

@mima-ai/governance-mcp

MCP server for AI governance — push compliance evidence to Mima from any agent, any stack, 4 lines of config.

One tool call maps to EU AI Act, ISO 42001, SOC 2, and NIST AI RMF simultaneously. Your readiness score updates automatically.

Install

npx @mima-ai/[email protected]

Or add to your MCP config (always pin the version):

{
  "mcpServers": {
    "mima-governance": {
      "command": "npx",
      "args": ["-y", "@mima-ai/[email protected]"],
      "env": {
        "MIMA_API_KEY": "mima_ext_...",
        "MIMA_WORKSPACE_ID": "ws-..."
      }
    }
  }
}

10 tools

Tool	What it does
`get_posture`	Overall readiness score + per-framework breakdown
`list_systems`	All AI systems — registered vs unregistered
`list_evidence`	Evidence records filtered by system and time
`dry_run_attest`	Preview which controls an attestation would earn
`attest`	Write a GRC evidence record
`register_system`	Register an AI system under EU AI Act Art. 9
`acknowledge_policy`	Record a policy acknowledgment
`derive_controls`	Recommended evidence types for a system description
`check_gates`	Gate pass/fail status with exit codes
`suggest_gates`	Prioritised gate recommendations

Usage — Claude Code

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "mima-governance": {
      "command": "npx",
      "args": ["-y", "@mima-ai/governance-mcp"],
      "env": {
        "MIMA_API_KEY": "mima_ext_...",
        "MIMA_WORKSPACE_ID": "ws-..."
      }
    }
  }
}

Then ask Claude: "Check our compliance posture" or "Register this AI system and suggest which controls we need."

Usage — Cursor / Windsurf

Add to .cursor/mcp.json or .windsurf/mcp.json in your project root:

{
  "mcpServers": {
    "mima-governance": {
      "command": "npx",
      "args": ["-y", "@mima-ai/governance-mcp"],
      "env": {
        "MIMA_API_KEY": "mima_ext_...",
        "MIMA_WORKSPACE_ID": "ws-..."
      }
    }
  }
}

Dry-run support

All write tools support dry-run — preview what controls you'd earn before committing:

dry_run_attest({ record_type: "ai_risk_assessment", system_name: "loan-scorer" })
// → { mapped_controls: ["EUAIA_ART9", "ISO42001_6_1", "NIST_AIRF_MAP_1"] }

Four frameworks, one call

Framework	What it covers
EU AI Act	Art. 9–15 risk management, oversight, accuracy obligations
ISO 42001	AI management system controls — A.6.x risk, A.9.x performance
SOC 2	CC3.x–CC8.x risk, change, and incident management
NIST AI RMF	GOVERN, MAP, MEASURE, MANAGE functions

Get an API key

mima.works → sign up → copy your key from the dashboard.

Python SDK

For app-code attestation (decorators, batch pushes, pre-approval gates):

pip install mima-governance

Docs

docs.mima.works

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

Read the getting-started guide

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.