About sphior-ai-governance-mcp
sphior-ai-governance-mcp lets AI agents submit execution records as supporting evidence for governance and audit processes. It stores hashes and metadata rather than prompts or outputs by default, and does not make compliance determinations.
Key features
- 01Record individual AI executions
- 02Submit batches of up to 200 executions
- 03Store hashes and metadata by default
- 04Chain records and anchor them periodically
- 05Verify record integrity independently
Use cases
- 01Keep evidence of AI executions for governance reviews
- 02Prepare supporting records for ISO 42001, EU AI Act, or SOC 2 work
MCP support
The MCP server exposes tools to submit one or multiple AI execution records to SPHIOR AI Governance. Records include execution metadata and are processed into chained, verifiable evidence.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
npx -y sphior-ai-governance-mcpSPHIOR_AIGOV_TOKENSecretIngestion token for your SPHIOR account. Without it the server still starts and tells you how to create one; no events are recorded until it is set. Create one at https://sphior.com/app?settings=aigovSPHIOR_AIGOV_ENDPOINTOverride the ingestion endpoint for self-hosted / regional deployments. Default: https://sphior.com/api/ai-governance/ingestLocal servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.
Tools
2Saved tool list · updated 1w ago
| Parameter | Type | Required | Description |
|---|---|---|---|
| cost | number | No | |
| actor | string | No | Agent or service name |
| model | string | No | Model display name (your label) |
| tokens | number | No | |
| latency | number | No | ms |
| provider | string | No | |
| trace_id | string | No | Correlation id |
| occurred_at | string | No | RFC3339; defaults to now |
| model_version | string | No | |
| policy_decision | string | No | Your outcome, e.g. allow | deny | flag |
Details
From the project READMEsphior-ai-governance-mcp
Official Model Context Protocol (MCP) server for SPHIOR AI Governance.
Let your AI agent (Claude, Cursor, Cline, Windsurf, Zed, VS Code, …) record its own executions as tamper-evident, independently verifiable evidence you can retain for ISO 42001 / EU AI Act / SOC 2.
Only hashes and metadata are stored (hash_only) — never your prompts or outputs unless you include them.
Records supporting evidence. Does not assert compliance, pass/fail, or an audit opinion.
Tools
| Tool | What it does |
|---|---|
record_ai_execution | Record one AI execution (actor, model, provider, policy_decision, tokens, cost, latency, trace_id, …) |
record_ai_executions | Record up to 200 executions in one call |
Setup
Get an ingestion token from your SPHIOR dashboard: Account → AI Governance → Ingestion tokens.
Claude Desktop / Claude Code (claude_desktop_config.json)
{
"mcpServers": {
"sphior-ai-governance": {
"command": "npx",
"args": ["-y", "sphior-ai-governance-mcp"],
"env": { "SPHIOR_AIGOV_TOKEN": "<your-token>" }
}
}
}
Cursor / Cline / Windsurf / Zed
Add an MCP server with command npx -y sphior-ai-governance-mcp and env SPHIOR_AIGOV_TOKEN=<your-token>.
Environment variables
| Var | Required | Default |
|---|---|---|
SPHIOR_AIGOV_TOKEN | yes | — |
SPHIOR_AIGOV_ENDPOINT | no | https://sphior.com/api/ai-governance/ingest |
SPHIOR_TIMEOUT | no | 30000 (ms) |
SPHIOR_DEBUG | no | false |
What SPHIOR does with it
Each event is canonicalized (RFC 8785 JCS), hashed (SHA-256), chained, and periodically anchored to an
append-only, independently verifiable record. You and your auditor can verify integrity with the open
sphior-verify tool and standard timestamp tooling — without trusting SPHIOR.
Prefer plain code over an MCP agent? Use the sphior-ai-governance SDK, or POST directly to the ingestion endpoint.
License
Apache-2.0
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.