AI agent governance MCP servers

A server here enforces policy on, approves, audits or restricts what AI agents are allowed to do.

Not here: servers that are merely used by agents.

1,865servers
740 remote1,125 localTagged by Odel's AI, which can make mistakes

Best fit

1,131 made for this, ranked by starsRemoteLocal
  1. SynomosAI Governance MCP @medxpert-org/ubic-governance-mcpAI governance MCP: A3 scorecard, ISO 42001 evidence templates, compliance checklist, gov_scan.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
  2. chargehand @egoushka/chargehandRuns coding-agent workers on a codebase question; every claim in the answer carries evidence.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from NuGet.
  3. Peerkith @bgarofalo1/peerkith-mcpCheck an agent work row, post one, and preflight a no-spend cap before any spend/send.10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  4. Quirna @quirna/mcpAsk a human before your agent acts: approval requests decided on a phone.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  5. Reins @r2rlabs/hyperliquid-reinsRisk limits and an audit log for AI agents trading Hyperliquid, enforced outside the model.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  6. Runner MCP @blacksp1d3r/runner-mcpSelf-hosted MCP for controlled AI development and staging without a general-purpose remote shell.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  7. opencode subagents @sebstaq/opencode-subagent-mcpRun Claude Code subagents on cheaper opencode models (DeepSeek, opencode Go) with native parity.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  8. MCP Write Gate @goran-revops/mcp-write-gateSits in front of any MCP server. Reads pass, writes are checked against your lists.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  9. FluxGit @fluxgit-hq/fluxgit-mcp-serverSafety-first Git MCP server: rich read tools plus human-approved FluxGit operation proposals.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from cargo.
  10. Aga @attestedintelligence/aga-mcp-serverVerifiable decision records for AI agents: signed receipts for calls to its own governed tools.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  11. BRYDGE @brydge-ai/brydgeChecks whether an agent's actions actually happened, against the destination's own records.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  12. TWZRD Agent Intelligence @twzrd/twzrd-agent-intelPre-spend trust for AI agents that buy: check x402 services and product listings before paying.16% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  13. Yault AESP @yault/aespCrypto payments for the agent economy — policy-gated vault operations under human control9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  14. Oasis @p31ca/oasis-mcpAgent-native CLI: provenance, cost governance, and execution contracts for AI agents.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
  15. Continuity Gateway @zerohourzulu/continuity-gatewayLocal MCP gateway for approved jobs, current agent permissions and durable retry inspection.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  16. Vizier Guard @vassiliylakhonin/vizier-guardDeterministic authorization and security guard for AI agent actions with signed receipts.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  17. Securityscan @securityscan-api/securityscanSecurity for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  18. Agent Covenant @jdhart81/agent-covenantDeny-by-default authority leases for agents wielding real power.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  19. Agent Hive Orchestrator @jdhart81/agent-hive-orchestratorDeterministic nested hive-mind orchestration over the A2A rails: hire N solvers, adversarial cross-r8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  20. Mail @honeycrisp-suite/mailApple Mail over MCP: fenced reads, draft-only writing, human-gated actions, audited with undo.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  21. Bolyra MCP @bolyra/mcpMCP auth middleware: gate tool calls so only authorized agents can act.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  22. Gateway @authzx/mcp-gatewayAuthzX MCP Gateway — policy-enforcing proxy between AI agents and MCP servers9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  23. agentguard — policy proxy for agent tool calls @agentwares/agentguard-cloudFree spend report from an agent log, no key. Hosted proxies: caps, audit export, buy calls.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  24. Solana Pulse: agent safety layer @timothymycompc/solana-pulse-gatewayStops AI agents losing money on Solana: pre-sign checks, intent matching, token verdicts. x402 USDC.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.