[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_129":130},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_57":49,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":11,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":-5,"_79":-5,"_80":49,"_81":-5,"_82":83,"_84":85,"_86":87,"_88":89,"_90":91,"_92":93,"_94":95},"apiUrl","https://odel.app/api","creator","guruprasath-annadurai","moduleId","whitepact","@guruprasath-annadurai/whitepact","displayName","WhitePact","tagline","AI governance MCP server: trust scoring, guardrails, bias/hallucination detection, compliance.","iconKey","https://avatars.githubusercontent.com/u/192743778?v=4","category","remote","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://whitepact-mcp-http.onrender.com/mcp\",\"transport\":\"streamable-http\",\"authType\":\"bearer\"}","pricingModel","free","creatorUserId","system:external-import","createdAt",1786595549000,"updatedAt",1788775358000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=io.github.Guruprasath-Annadurai%2Fwhitepact","sourceVerified",true,"sourceMissingSince","importedAt","upstreamStars",1,"upstreamUpdatedAt",1788605378000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt",1788065110000,"githubRepoUrl","https://github.com/Guruprasath-Annadurai/Whitepact","githubRepoFullName","Guruprasath-Annadurai/Whitepact","releaseId","ext-guruprasath-annadurai-whitepact","version","1.2.3","descriptionMarkdown","\n

\n $\"CI\"/$ \n $\"PyPI$ \n $\"Python$ \n $\"License:$ \n $\"Listed$ \n $\"Listed$ \n $\"OpenSSF$ \n $\"OpenSSF$ \n $\"OpenSSF$ \n

\n\n

WhitePact — an independent runtime authority, governance, and assurance layer for autonomous systems: a five-way governance decision engine (ALLOW / ALLOW_WITH_REDACTION / REQUIRE_APPROVAL / DENY / QUARANTINE), trust scoring, bias detection, guardrails, hallucination detection, compliance mapping (NIST AI RMF / EU AI Act / ISO 42001), cost intelligence, drift monitoring, a public Trust Index / leaderboard / AI Incident Database, and an MCP server (30 tools, 20 resources) with LangChain, LangGraph, and Google ADK trust-gate integrations.

\n\n```\n┌──────────────────────────────────────────────────────────────────────────────┐\n│ WhitePact v1.2.6 │\n│ │\n│ ┌──────────────┐ ┌─────────────┐ ┌──────────────┐ ┌──────────────────┐ │\n│ │ Governance │ │ Trust Score │ │ Compliance │ │ Guardrails │ │\n│ │ 5-way decide │ │ 6-dim A–F │ │ NIST/EU/ISO │ │ PII + Tox │ │\n│ └──────────────┘ └─────────────┘ └──────────────┘ └──────────────────┘ │\n│ ┌──────────────┐ ┌─────────────┐ ┌──────────────┐ ┌──────────────────┐ │\n│ │ Hallucination│ │ Cost Intel │ │ Red Team │ │ Drift Monitor │ │\n│ │ Self-consist.│ │ Route+Budget│ │ 10 attacks │ │ Alerts+Trend │ │\n│ └──────────────┘ └─────────────┘ └──────────────┘ └──────────────────┘ │\n│ ┌──────────────┐ ┌─────────────┐ ┌──────────────┐ ┌──────────────────┐ │\n│ │ AI Passport │ │ BiasBuster │ │ PrivacyLabel │ │ MCP Server │ │\n│ │ SHA-256 cert │ │ 6 probes+CI │ │ Federated │ │ 30 tools/HTTP │ │\n│ └──────────────┘ └─────────────┘ └──────────────┘ └──────────────────┘ │\n│ ┌──────────────────────────────────────────────────────────────────────────┐ │\n│ │ Governance Dashboard — FastAPI · Per-org rate limit · Alembic · OTEL │ │\n│ └──────────────────────────────────────────────────────────────────────────┘ │\n└──────────────────────────────────────────────────────────────────────────────┘\n```\n\n---\n\n## What this solves\n\nEvery team deploying AI in production faces the same gap: **no unified way to\nprove a model — or an autonomous agent's actions — is safe, fair, compliant,\nand accountable.** Audits are manual, bias is discovered in production,\ncompliance is a spreadsheet, an agent's tool calls go ungoverned, and nobody\nknows what the LLM bill will be next month.\n\nWhitePact gives you one platform — a REST API, a Python SDK, an MCP server,\nand a live dashboard — that covers the full governance lifecycle:\n\n| Problem | Module | Output |\n|---|---|---|\n| Should this agent action be allowed, redacted, held for approval, denied, or quarantined? | `WhitePactRuntimeGateway` (governance core) | A five-way `GovernanceDecision`, deterministic, no LLM call in the decision path |\n| Is this model trustworthy? | `TrustScoreEngine` | 0–100 score, A–F grade, risk level |\n| Does it comply with regulations? | `ComplianceEngine` | NIST AI RMF, EU AI Act tier, ISO 42001 |\n| Is it exposing PII? | `GuardrailsEngine` | Block / redact with audit log |\n| Is it hallucinating? | `HallucinationDetector` | Risk score, unsupported claims |\n| Can it be attacked? | `RedTeamSimulator` | 10 vectors, CVE IDs, safe-refusal rate |\n| How much is it costing? | `CostTracker` + `ModelRouter` | Per-model USD, routing to cheapest viable model |\n| Is it getting worse over time? | `TrustDriftMonitor` | 7/30-day trend, severity alerts |\n| Is it biased? | `BiasBuster` | 6 demographic probes, CI gate |\n| Is this data labeled privately? | `PrivacyLabel` | Federated DP labels, never leaves device |\n| Is this media real? | `DeepfakeDetector` | Ensemble confidence, method detected |\n| Can I trust a third-party MCP server before connecting to it? | `SupplyChainScanner` | VERIFIED_FACT / INFERRED_SIGNAL / UNKNOWN verdicts — typosquat, description-content, known-incident checks |\n| Is there a tamper-evident record of every governance decision? | `EvidenceRepository` | Hash-chained `EvidenceRecord`, per-org, `verify_chain()` |\n| Does a risky action get a human in the loop? | `ApprovalRepository` | Race-safe `PENDING → APPROVED/DENIED` workflow |\n| How does this model rank against others, independently? | `Public Leaderboard` | Cross-model trust ranking from actually calling each model's API, not self-reported |\n| Can I cite and verify a trust score anywhere? | `Trust Index` | Free self-assessed or human-reviewed certified passport, verifiable at `/verify/{id}`, embeddable badge |\n| Has this AI system failed publicly before? | `AI Incident Database` | Crowd-reported, moderator-reviewed, hash-chained public registry |\n| Should my agent trust this third-party tool before calling it? | `rai_check_trust` + LangChain/LangGraph/ADK integrations | Free lookup, plus a real block/pause gate in-agent |\n| Can any MCP client govern every AI call? | `MCP Server` | 27 governance tools over stdio, Streamable HTTP, or legacy HTTP+SSE |\n\n---\n\n## Install\n\n```bash\n# Governance platform + REST API\npip install \"rai-governance-platform[dashboard]\"\n\n# With PostgreSQL support\npip install \"rai-governance-platform[dashboard,postgres]\"\n\n# With Redis + OpenTelemetry\npip install \"rai-governance-platform[dashboard,redis,telemetry]\"\n\n# With LLM providers\npip install \"rai-governance-platform[dashboard,openai,anthropic]\"\n\n# Everything\npip install \"rai-governance-platform[all]\"\n```\n\nThe published PyPI package name (`rai-governance-platform`) and the import\nname (`responsibleai`) predate the WhitePact rename and are kept as-is —\nsee `MIGRATION_WHITEPACT_V2.md` Section 3 for why an alias package\n(`whitepact`) was added instead of renaming the published package outright.\n\n---\n\n## 30-second quickstart\n\n```bash\n# Start the governance dashboard\npip install \"rai-governance-platform[dashboard]\"\nuvicorn responsibleai.dashboard.app:app --port 8765\n\n# Evaluate a model (no LLM key needed — supply your own scores)\ncurl -X POST http://localhost:8765/api/evaluate \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"model_name\": \"gpt-4o\",\n \"provider\": \"openai\",\n \"fairness\": 0.80,\n \"privacy\": 0.85,\n \"security\": 0.82,\n \"robustness\": 0.78,\n \"compliance\": 0.90,\n \"authenticity\": 0.88\n }'\n```\n\n```json\n{\n \"trust_score\": { \"trust_score\": 83.65, \"grade\": \"B\", \"risk\": \"LOW\" },\n \"compliance\": { \"overall_score\": 80.5, \"eu_ai_act_tier\": \"limited_risk\", \"violations\": 0 },\n \"passport_id\": \"rai-a3f7c2b1\",\n \"passport_hash\": \"4d8e1f2a9c3b7e6d...\",\n \"drift_alert\": null\n}\n```\n\nOpen `http://localhost:8765` for the live dashboard and\n`http://localhost:8765/api/docs` for interactive API docs.\n\n---\n\n## Governance core — five-way decisions, not a binary block/allow\n\n`src/responsibleai/governance/` (see `SPEC.md` Sections 4-8 for the full\narchitecture contract) is a deterministic runtime authority sitting in front\nof agent tool calls:\n\n```python\nfrom responsibleai.governance import WhitePactRuntimeGateway, ActionRequest, AuthorityContext\n\ngateway = WhitePactRuntimeGateway()\nresult = gateway.evaluate(\n action=ActionRequest(tool_name=\"rai_scan\", arguments={\"text\": \"...\"}),\n authority=AuthorityContext(org_id=\"acme\", agent_id=\"agent-1\"),\n)\nprint(result.decision) # GovernanceDecision.ALLOW | ALLOW_WITH_REDACTION | REQUIRE_APPROVAL | DENY | QUARANTINE\n```\n\n- **Risk tiering** (`governance/risk.py`) — every MCP tool is classified\n against a hardcoded, drift-tested table, not inferred at call time.\n- **Policy engine** (`governance/policy.py`) — first-match-wins rules with\n `ALLOW` / `DENY` / `REQUIRE_APPROVAL` effects.\n- **Evidence** (`governance/evidence.py`) — every decision is written to a\n per-org, hash-chained `EvidenceRecord`; `verify_chain()` detects tampering.\n Raw argument values are never stored, only field-name keys.\n- **Approval workflow** (`governance/approval.py`) — `REQUIRE_APPROVAL`\n decisions queue a real, race-safe `ApprovalRequest` with a resolution API,\n not just a log line.\n- **Supply-chain scanner** (`src/responsibleai/supplychain/`) — before an\n agent trusts a third-party MCP server or tool, `SupplyChainScanner` returns\n one of three explicit verdicts (`VERIFIED_FACT` / `INFERRED_SIGNAL` /\n `UNKNOWN`) — never a single opaque trust score — from typosquat detection,\n tool-description scanning, and known-incident cross-reference.\n- **Identity Bridge** (`integrations/identity_bridge.py`) — maps Entra ID,\n Google Workspace, Okta, and AWS (Cognito / IAM Identity Center) ID token\n claims into `IdentityContext`, plus `map_groups_to_authority()` to turn\n IdP group membership into a granted-action-types `AuthorityContext`. See\n `MACHINE_AUTHORITY_V1.md`'s Identity Bridge section for exactly what's\n verified (claim-shape correctness against each provider's public docs)\n versus not (live-tenant testing, Graph/Admin-SDK group-name resolution,\n AWS's non-JWT SigV4 path).\n\nNo governance decision is LLM-based; see\n`DETERMINISTIC_VS_PROBABILISTIC.md` for why.\n\n**See it end-to-end**: `examples/08_whitepact_enterprise_scenario.py` runs a\nfull scenario (an org onboarding an autonomous finance agent) through all\neight machine-authority invariants — ceiling, delegation, attenuation,\napproval quorum, workflow composition, autonomy budget, memory firewall,\nevidence bundle — against real code, no API keys required:\n\n```bash\npython examples/08_whitepact_enterprise_scenario.py\n```\n\n---\n\n## MCP Server — govern every AI call from Claude Code, Claude Desktop, or any MCP client\n\nThe MCP (Model Context Protocol) server exposes WhitePact as **30 tools and\n20 resources** (10 canonical resource URIs, dual-advertised under both\n`whitepact://` and `rai://` schemes — see `MIGRATION_WHITEPACT_V2.md`) to any\nMCP-compatible client — Claude Code, Claude Desktop, Cursor, Windsurf, or your\nown agent runtime. Three transports are supported: stdio, Streamable HTTP\n(`/mcp`, current MCP spec), and legacy HTTP+SSE (`/sse` + `/messages/`, kept\nfor older clients). When a team's client points at this server, every AI\ninteraction is automatically governed — five-way governance decisions, trust\nscoring, guardrails, compliance checks (NIST AI RMF / EU AI Act / ISO 42001),\nbias evaluation, drift detection, cost tracking, and hash-chained audit\nevidence run on any call without code changes.\n\n### Setup\n\n```bash\n# Install\npip install \"rai-governance-platform[dashboard,mcp]\"\n\n# Start the REST API (MCP tools call it internally)\nRAI_DB_PATH=/var/lib/rai/governance.db \\\nRAI_API_KEYS=your-key-here \\\nuvicorn responsibleai.dashboard.app:app --host 127.0.0.1 --port 8765 &\n\n# Add to Claude Code (~/.claude/claude_desktop_config.json or via /mcp)\n```\n\n```json\n{\n \"mcpServers\": {\n \"whitepact\": {\n \"command\": \"whitepact-mcp\",\n \"env\": {\n \"RAI_API_URL\": \"http://localhost:8765\",\n \"RAI_API_KEY\": \"your-key-here\"\n }\n }\n }\n}\n```\n\n`whitepact-mcp` and `responsibleai-mcp` are the same entry point — see\n`pyproject.toml`'s `[project.scripts]`; both will keep working, use whichever\nname you prefer.\n\n### Available tools (27)\n\n| Tool | What it does |\n|---|---|\n| `rai_scan` | Detect and redact PII + harmful content before it reaches a log |\n| `rai_trust_score` | Composite AI Trust Score (0-100) across 6 governance dimensions |\n| `rai_compliance` | NIST AI RMF / EU AI Act / ISO 42001 compliance evaluation |\n| `rai_hallucination` | Hallucination risk from hedging, consistency, unsupported claims |\n| `rai_cost_estimate` | USD cost of a model API call from token counts |\n| `rai_redteam_payloads` | Adversarial attack payloads (prompt injection, jailbreak, etc.) |\n| `rai_redteam_analyze` | Security report from model responses to red team payloads |\n| `rai_compare_models` | Compare two models across all 6 trust dimensions |\n| `rai_audit_summary` | Governance capability summary (tools, frameworks, attack vectors) |\n| `rai_health` | Status and module availability of the governance engine |\n| `rai_bias_evaluate` | Demographic bias across 6 probe dimensions with confidence intervals |\n| `rai_drift_check` | Trust score drift between a baseline and current evaluation |\n| `rai_passport_generate` | Verifiable, tamper-evident AI Passport for vendor risk assessment |\n| `rai_budget_check` | Spend vs. budget, per-team/model breakdown, month-end projection |\n| `rai_policy_check` | Text/response against a governance policy (blocklists, disclaimers) |\n| `rai_stream_scan` | PII/harm scan across streaming LLM output chunks |\n| `rai_benchmark` | Score responses against truthfulqa / bbq / hellaswag suites |\n| `rai_benchmark_prompts` | Question set for a benchmark suite |\n| `rai_model_route` | Cheapest model that can handle a task, with cost/quality tradeoff |\n| `rai_pii_report` | PII audit report by category with GDPR/CCPA remediation guidance |\n| `rai_incident_log` | Structured governance incident record for audit/SIEM |\n| `rai_eu_ai_act_classify` | EU AI Act risk tier classification with compliance roadmap |\n| `rai_iso42001_gap` | ISO/IEC 42001:2023 AI Management System gap analysis |\n| `rai_executive_summary` | Board-ready governance summary with RAG status indicators |\n| `rai_org_status` | Governance status snapshot: models, grades, compliance, risk |\n| `rai_webhook_status` | Webhook delivery health, failure analysis, remediation actions |\n| `rai_check_trust` | Free public Trust Index lookup for a **third-party** model/tool, before an agent invokes it — unlike every other tool above, which evaluates output the caller itself produced |\n\n### Agent-framework integrations — LangChain, LangGraph, Google ADK\n\n`src/responsibleai/integrations/` wires `rai_check_trust` directly into three\nagent frameworks so an agent can be gated on a tool's public trust score\nbefore invoking it, not just log the call after the fact:\n\n- **LangChain** (`langchain_middleware.py`) — `TrustGateMiddleware`, a\n `wrap_tool_call` middleware that blocks a call outright when its score is\n below threshold. Requires `pip install \"rai-governance-platform[langchain]\"`.\n- **LangGraph** (`langgraph_gate.py`) — `make_trust_gate_node()`, a node that\n pauses the graph with `interrupt()` for a human approve/reject decision on\n a below-threshold call, instead of a hard block. Requires\n `pip install \"rai-governance-platform[langgraph]\"`.\n- **Google ADK** (`adk_toolset.py`) — `build_stdio_toolset()` /\n `build_http_toolset()`, thin factories over ADK's `McpToolset`, which\n auto-discovers this project's MCP server's tools with no custom glue code.\n Requires `pip install \"rai-governance-platform[adk]\"`.\n\nAll three, or any subset, install via `pip install \"rai-governance-platform[agent-frameworks]\"`.\nSee `GAME_CHANGER_BUILD_PLAN.md` Phase B for the reasoning behind each.\n\n### Available resources (20)\n\n10 canonical resources, each advertised under both the `whitepact://` and\n`rai://` URI schemes (dual scheme is additive — see\n`MIGRATION_WHITEPACT_V2.md`; the table below shows the canonical URI):\n\n| Resource | URI | Contents |\n|---|---|---|\n| Health | `whitepact://health` | Current health status of the governance service |\n| Model pricing catalog | `whitepact://models/catalog` | Supported models with per-token pricing |\n| Compliance frameworks | `whitepact://compliance/frameworks` | NIST AI RMF, EU AI Act, ISO 42001 |\n| Red team categories | `whitepact://redteam/categories` | Adversarial attack categories |\n| Trust dimensions | `whitepact://trust/dimensions` | The 6 dimensions behind the Trust Score |\n| Bias probe catalog | `whitepact://bias/probes` | Available bias probes and scoring interpretation |\n| Governance policy template | `whitepact://governance/policy` | Default policy template for `rai_policy_check` |\n| Trust grade reference | `whitepact://trust/grades` | Grade thresholds, risk tiers, deployment guidance |\n| NIST AI RMF checklist | `whitepact://compliance/checklist/nist` | Actionable NIST implementation checklist |\n| EU AI Act checklist | `whitepact://compliance/checklist/eu-ai-act` | Compliance checklist for high-risk operators |\n\n### MCP directory listings\n\nWhitePact is listed and queryable today on real MCP directories — not\naspirational, all verified live:\n\n- **Official MCP Registry** — `server.json` at the repository root\n (schema `2025-12-11`, listing version `1.2.3`) is published as\n `io.github.Guruprasath-Annadurai/whitepact`, confirmed queryable at\n [registry.modelcontextprotocol.io](https://registry.modelcontextprotocol.io).\n Advertises both the PyPI/stdio package (`whitepact-mcp`, self-hosted,\n free, unrestricted) and a `remotes` entry pointing at the hosted\n Streamable HTTP and SSE transports (`whitepact-mcp-http.onrender.com`)\n — a one-click remote connector, not just an installable package.\n- **Antigravity CLI plugin** — `plugins/whitepact/` at the repository\n root follows the [official Antigravity plugin manifest\n format](https://antigravity.google/docs/plugins), connecting to the\n same hosted Streamable HTTP transport via `serverUrl`. No official\n Antigravity plugin directory exists yet, so this is distributed\n directly from the repo — see `plugins/whitepact/README.md`.\n- **Smithery** — listed as\n [`guruprasathannadurai-official/whitepact`](https://smithery.ai/server/guruprasathannadurai-official/whitepact),\n 30 tools and 20 resources discovered against the hosted Streamable\n HTTP transport (`whitepact-mcp-http.onrender.com/mcp`, a separate\n Render service from the main dashboard). This deployment has no\n OAuth authorization server configured — only static Bearer API\n keys — so a public, unauthenticated\n `/.well-known/mcp/server-card.json` serves the same live\n `TOOL_DEFS`/`RESOURCE_DEFS` the server itself advertises, for\n directories whose scanners can't complete a live authenticated\n crawl.\n\nSee `compliance/MCP_DISTRIBUTION_GUIDE.md` for the full distribution\nplan, including directories not yet submitted to.\n\n### Platform integrations\n\nWhitePact connects to the major AI platforms as one MCP server through\nstandards-compliant clients — no per-platform forks, no per-platform\ngovernance logic. See [`docs/integrations/`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/docs/integrations/) for the\ncanonical compatibility matrix (`PLATFORM_COMPATIBILITY.md`), per-platform\nsetup docs (GitHub Copilot, Microsoft Copilot, Claude, Grok, Gemini,\nAmazon Q, AWS Bedrock AgentCore, Mistral Le Chat, Cursor), and\n`FOUNDER_ACTIONS.md` for what still needs a human. Run\n`python scripts/integration_smoke.py` for a live protocol-level preflight\nagainst the hosted endpoint.\n\n---\n\n## Python SDK\n\n### Trust scoring\n\n```python\nfrom responsibleai import TrustScoreEngine, PassportGenerator\n\nengine = TrustScoreEngine()\nscore = engine.compute(\n fairness=0.80, privacy=0.85, security=0.82,\n robustness=0.78, compliance=0.90, authenticity=0.88,\n)\nprint(f\"{score.overall:.1f} / 100 Grade: {score.grade} Risk: {score.risk_level}\")\n# → 83.7 / 100 Grade: B Risk: LOW\n\npassport = PassportGenerator().generate(\n model_name=\"gpt-4o\", provider=\"openai\", trust_score=score,\n compliance_summary={\"overall\": 80.5},\n)\nprint(passport.passport_id)\npassport.export_html(\"passport.html\")\n```\n\n### Guardrails — block PII before it reaches a log\n\n```python\nfrom responsibleai import GuardrailsEngine\n\nguardrails = GuardrailsEngine()\nresult = guardrails.scan(\"Customer SSN is 123-45-6789, email: alice@company.com\")\n\nprint(result.is_blocked) # True\nprint(result.pii_count) # 2\nprint(result.redacted_text) # \"Customer SSN is [SSN], email: [EMAIL]\"\n```\n\n### Hallucination detection\n\n```python\nfrom responsibleai import HallucinationDetector\n\ndetector = HallucinationDetector()\nresult = detector.analyze(\n \"AI will replace all human jobs by 2025.\",\n candidates=[\n \"AI will automate some repetitive tasks.\",\n \"AI creates new job categories alongside displacing others.\",\n ],\n)\nprint(f\"Risk: {result.hallucination_risk:.2f} Level: {result.risk_level}\")\n```\n\n### Compliance — NIST AI RMF, EU AI Act, ISO 42001\n\n```python\nfrom responsibleai import ComplianceEngine\n\nengine = ComplianceEngine()\nreport = engine.evaluate(\n fairness_score=0.80, privacy_score=0.85,\n security_score=0.82, robustness_score=0.78,\n compliance_maturity=0.90, use_case=\"credit_scoring\",\n)\nprint(f\"Score: {report.compliance_score * 100:.1f}%\")\nprint(f\"EU AI Act tier: {report.eu_ai_act_tier.value}\") # high_risk\n```\n\n### Red team simulation\n\n```python\nfrom responsibleai import RedTeamSimulator\n\nsimulator = RedTeamSimulator()\nreport = simulator.run_all()\n\nprint(f\"Security score: {report.security_score:.1f}/100\")\nprint(f\"Vulnerabilities: {len(report.vulnerabilities)}\")\nfor v in report.critical_vulnerabilities:\n print(f\" [{v['cwe_id']}] {v['name']}\")\n```\n\n### Cost intelligence\n\n```python\nfrom responsibleai import CostTracker, ModelRouter, TokenUsage, BudgetPolicy\n\ntracker = CostTracker(db_path=\"~/.responsibleai/data.db\",\n policy=BudgetPolicy(monthly_limit_usd=500.0))\nusage = TokenUsage.create(\n provider=\"openai\", model=\"gpt-4o\",\n input_tokens=2000, output_tokens=800, team=\"product\",\n)\nrecord = tracker.record(usage)\nprint(f\"This call: ${record.total_cost:.4f}\")\nprint(f\"Month to date: ${tracker.total_cost(30):.2f}\")\n\nrouter = ModelRouter()\ndecision = router.route(\"Classify this email as spam or not spam\", \"balanced\")\nprint(f\"Recommended: {decision.recommended_model} ${decision.estimated_cost_per_1k:.4f}/1k tokens\")\n```\n\n### Trust drift monitoring\n\n```python\nfrom responsibleai import TrustScoreEngine, TrustDriftMonitor\n\nmonitor = TrustDriftMonitor(db_path=\":memory:\", alert_threshold=5.0)\nengine = TrustScoreEngine()\n\nfor fairness in [0.90, 0.88, 0.85, 0.72]:\n score = engine.compute(fairness=fairness, privacy=0.85, security=0.80,\n robustness=0.80, compliance=0.85, authenticity=0.85)\n alert = monitor.record(\"gpt-4o\", \"openai\", score)\n if alert:\n print(f\"Drift alert! {alert.severity}: {alert.delta:.1f} pt drop\")\n```\n\n---\n\n## Governance Dashboard\n\nA production FastAPI application with a dark-mode SPA. A live instance is\nhosted at **[whitepact.com](https://whitepact.com)**.\n\n```bash\n# Development (auth off, SQLite in-memory)\nRAI_AUTH_ENABLED=false uvicorn responsibleai.dashboard.app:app --port 8765\n\n# Production (auth + persistent DB)\nRAI_API_KEYS=your-key-here \\\nRAI_DB_PATH=/data/responsibleai.db \\\nuvicorn responsibleai.dashboard.app:app --host 0.0.0.0 --port 8765 --workers 4\n\n# Docker\ndocker compose up -d\n```\n\n### REST API endpoints\n\n| Method | Path | Description |\n|---|---|---|\n| `GET` | `/api/health` | Health — DB, auth, OTEL, version |\n| `GET` | `/api/metrics` | Uptime, request count, error rate, monthly spend |\n| `POST` | `/api/evaluate` | Full evaluation → trust + compliance + passport |\n| `GET` | `/api/trust-score/{model}/{provider}` | Score history + drift trend |\n| `GET` | `/api/models` | All evaluated models |\n| `POST` | `/api/scan` | Guardrails — PII detection + redaction |\n| `POST` | `/api/hallucination` | Hallucination risk analysis |\n| `POST` | `/api/cost/record` | Record token usage |\n| `GET` | `/api/cost/summary` | Cost breakdown by model / team / day |\n| `POST` | `/api/cost/analyze` | Prompt efficiency — detect bloat |\n| `POST` | `/api/cost/route` | Route task to cheapest viable model |\n| `GET` | `/api/cost/models` | Full model pricing catalogue |\n| `GET` | `/api/drift/{model}/{provider}` | Drift trend + history |\n| `GET` | `/api/audit` | Paginated audit log (org-scoped) |\n| `GET` | `/api/audit/export` | Export audit log as JSONL or CSV |\n| `GET` | `/api/audit/summary` | Audit counts grouped by endpoint |\n| `GET` | `/api/redteam/payloads` | Red team payload library (10 vectors) |\n| `POST` | `/api/redteam/analyze` | Analyze model responses for vulnerabilities |\n| `GET` | `/api/billing/usage` | Token spend and budget status |\n| `GET` | `/api/leaderboard` | Public cross-model trust leaderboard (no auth) |\n| `GET` | `/api/leaderboard/{model}/{provider}/history` | Trend over time for one model (no auth) |\n| `GET` | `/api/leaderboard/{model}/{provider}/diagnostic` | Per-prompt findings — PRO plan required |\n| `POST` | `/api/trust-index/assess` | Free, public self-assessment against the open Trust Index standard |\n| `GET` | `/api/trust-index/verify/{passport_id}` | Verify a cited Trust Index score (no auth) |\n| `GET` | `/api/trust-index/check` | Free, public — trust score + incident count for a named model/tool, by exact name (no auth); what `rai_check_trust` and the LangChain/LangGraph/ADK integrations call |\n| `GET` | `/api/trust-index/registry` | Every assessed model/tool, certified and self-reported, newest first (no auth) — data source for the public `/registry` page |\n| `GET` | `/api/trust-index/certified` | Directory of certified passports (no auth) |\n| `POST` | `/api/trust-index/certify/{passport_id}` | Certify a passport — super-admin only |\n| `GET` | `/api/trust-index/badge/{passport_id}.svg` | Embeddable trust badge (Self-Assessed / Certified), no auth |\n| `POST` | `/api/incident-db/report` | Report a publicly observed AI incident (no auth, rate-limited) |\n| `GET` | `/api/incident-db` | Browse published incidents — filter by model, provider, severity, type (no auth) |\n| `GET` | `/api/incident-db/check` | Pre-deployment exact-match incident check for a model/provider — PRO/ENTERPRISE |\n| `GET` | `/api/incident-db/verify` | Recompute the hash chain over every published entry (no auth) |\n| `POST` | `/api/orgs/{org_id}/keys/{key_id}/mfa/enroll` | Enroll an API key in TOTP MFA |\n| `POST` | `/api/orgs/{org_id}/keys/{key_id}/mfa/verify` | Verify a TOTP code / backup code |\n| `GET`/`POST` | `/api/governance/evidence` | Read/write hash-chained governance evidence records |\n| `GET`/`POST` | `/api/governance/approvals` | Queue and resolve `REQUIRE_APPROVAL` decisions |\n\nInteractive docs at `/api/docs`. Public leaderboard page at `/leaderboard` —\nsee `compliance/LEADERBOARD_METHODOLOGY.md` for the published scoring\nmethodology and `scripts/run_leaderboard_eval.py` to run evaluations. Open\nTrust Index standard and passport verification at `/verify/{id}` — see\n`compliance/TRUST_INDEX_SPEC.md`. Free, zero-signup self-assessment at\n`/assess`; browse every assessed model/tool at `/registry`. `/llms.txt`\npoints AI crawlers/answer engines at these as canonical sources — see\n`GAME_CHANGER_STRATEGY.md` for why.\n\n### Production features\n\n| Feature | Detail |\n|---|---|\n| Authentication | Bearer token (`RAI_API_KEYS`) with RBAC (OWNER / ADMIN / ANALYST / VIEWER) |\n| MFA | TOTP (RFC 6238) on the interactive login step, org-enforceable, single-use backup codes |\n| Field-level encryption | Opt-in (`RAI_FIELD_ENCRYPTION_KEY`) on `audit_log.ip_address`, incident reporter contact info, webhook secrets, MFA secrets — with key-rotation support (`MultiFernet`) |\n| Per-org rate limiting | Each Bearer token gets its own rate limit bucket (SHA-256 keyed) — no shared global pool |\n| CORS | Configurable origins (`RAI_ALLOWED_ORIGINS`) |\n| Security headers | CSP, X-Frame-Options, X-Content-Type-Options |\n| Structured logging | JSON via structlog + request IDs |\n| Database | SQLite (default) or PostgreSQL (`RAI_DATABASE_URL`) with Alembic migrations |\n| Observability | OpenTelemetry traces + metrics (`RAI_OTEL_ENDPOINT`) |\n| Webhooks | HMAC-signed delivery with DB-persisted retry queue (survives restarts) |\n| Exception handling | No raw stack traces reach clients |\n| Governance evidence | Hash-chained, per-org, tamper-evident (`GET /api/governance/evidence`) |\n\n---\n\n## Database migrations (Alembic)\n\nSchema changes are managed with Alembic. Run `alembic history` for the\ncurrent, authoritative migration count and table list — this number changes\nfrequently enough that a hardcoded count here goes stale fast; the command\nitself is the source of truth.\n\n```bash\n# Upgrade to latest schema\nRAI_DB_PATH=/var/lib/rai/governance.db alembic upgrade head\n\n# PostgreSQL\nRAI_DB_URL=postgresql://user:pass@host:5432/responsibleai alembic upgrade head\n\n# Show migration history\nalembic history\n\n# Generate a new migration after changing engine.py\nalembic revision --autogenerate -m \"add_new_column\"\n```\n\nAll migrations use `render_as_batch=True` so they run on both SQLite and\nPostgreSQL without changes.\n\n---\n\n## Webhook notifications\n\nRegister an endpoint and receive signed events when governance thresholds fire.\n\n```bash\n# Register a Slack webhook\ncurl -X POST http://localhost:8765/api/webhooks \\\n -H \"Authorization: Bearer your-key\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"name\": \"ops-slack\",\n \"url\": \"https://hooks.slack.com/services/...\",\n \"events\": [\"drift_alert\", \"budget_exceeded\", \"guardrail_triggered\"],\n \"provider\": \"slack\",\n \"secret\": \"hmac-secret-for-signature-verification\",\n \"max_retries\": 5\n }'\n```\n\nDeliveries are persisted to the database. If the server restarts during a\nretry cycle, the background worker picks up where it left off on next boot.\nRetry schedule: 1 s → 5 s → 30 s → 2 min → 10 min.\n\nVerify payloads with the `X-RAI-Signature-256: sha256=` header.\n\n---\n\n## Docker\n\n```bash\ngit clone https://github.com/Guruprasath-Annadurai/Whitepact.git\ncd Whitepact\n\npython3 -c \"import secrets; print(secrets.token_urlsafe(32))\"\n\ncp .env.example .env\n# Edit .env — set RAI_API_KEYS\n\ndocker compose up -d\n# Dashboard: http://localhost:8765\n# API docs: http://localhost:8765/api/docs\n```\n\n---\n\n## PostgreSQL + Redis (horizontal scaling)\n\n```bash\n# .env\nRAI_DATABASE_URL=postgresql://rai:secret@db-host:5432/responsibleai\nRAI_REDIS_URL=redis://redis-host:6379/0\nRAI_OTEL_ENDPOINT=http://otel-collector:4318\n\npip install \"rai-governance-platform[dashboard,postgres,redis,telemetry]\"\n\n# Run migrations before first start\nRAI_DB_URL=postgresql://rai:secret@db-host:5432/responsibleai alembic upgrade head\n```\n\nThe async database layer uses SQLAlchemy with connection pooling\n(`pool_size=10`, `max_overflow=20`, `pool_pre_ping=True`). Rate limiting\nswitches to Redis-backed storage when `RAI_REDIS_URL` is set.\n\n---\n\n## BiasBuster — bias evaluation in CI\n\n```bash\n# Fail CI when demographic bias exceeds threshold\nbiasbuster run \\\n --provider openai --model gpt-4o \\\n --probes gender-bias,racial-bias,cultural-bias \\\n --threshold 0.20 \\\n --output report --format html\n```\n\n```python\nfrom biasbuster import BiasBusterRunner, GenderBiasProbe, RacialBiasProbe\nfrom biasbuster.providers import OpenAIProvider\nimport asyncio\n\nasync def main():\n provider = OpenAIProvider(api_key=\"sk-...\", model=\"gpt-4o\")\n runner = BiasBusterRunner(provider=provider)\n suite = await runner.run([\n GenderBiasProbe(threshold=0.20),\n RacialBiasProbe(threshold=0.20),\n ])\n print(f\"Score: {suite.overall_score:.4f} {'PASSED' if suite.passed else 'FAILED'}\")\n\nasyncio.run(main())\n```\n\n**Available probes:** `gender-bias`, `racial-bias`, `age-bias`, `religious-bias`, `occupational-stereotype`, `cultural-bias`\n\n**Scoring:** TF-IDF cosine divergence + length asymmetry + VADER sentiment divergence, 95% bootstrap confidence intervals, intersectional co-failure amplification (×1.15).\n\n---\n\n## PrivacyLabel — on-device federated labeling\n\n```python\nfrom privacylabel import FederatedClient, FedAvgAggregator\n\nclient = FederatedClient(\n node_id=\"hospital-node-01\",\n provider=MyProvider(),\n epsilon_per_round=0.1,\n total_epsilon=1.0,\n delta=1e-6,\n gradient_clip=1.0,\n)\n# Raw data stays on disk — only privatised gradients leave the device\nsummary = await client.train_round(\"data/local_records.jsonl\")\nprint(f\"Privacy budget used: ε={summary.privacy_spent['spent_epsilon']:.3f}\")\n```\n\nImplements Laplace, Gaussian, Exponential, and DP-SGD mechanisms. Byzantine-robust aggregation via Weiszfeld geometric median.\n\n---\n\n## GitHub Actions — bias gate in CI\n\n```yaml\n- name: Bias evaluation\n run: |\n pip install \"rai-governance-platform[openai]\"\n biasbuster run \\\n --provider openai --model gpt-4o-mini \\\n --probes gender-bias,racial-bias,cultural-bias \\\n --threshold 0.20\n env:\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n```\n\n---\n\n## Environment variables\n\n| Variable | Default | Description |\n|---|---|---|\n| `RAI_DB_PATH` | `governance.db` | SQLite path |\n| `RAI_DB_URL` | *(unset = SQLite)* | Full SQLAlchemy URL — takes priority over `RAI_DB_PATH` |\n| `RAI_DATABASE_URL` | *(unset)* | Alias for `RAI_DB_URL` |\n| `RAI_API_KEYS` | *(empty = auth off)* | Comma-separated bearer tokens |\n| `RAI_AUTH_ENABLED` | `true` | Toggle auth enforcement |\n| `RAI_REDIS_URL` | *(unset = in-memory)* | Redis URL for distributed rate limiting |\n| `RAI_RATE_LIMIT_DEFAULT` | `100/minute` | Per-org rate limit (keyed by Bearer token) |\n| `RAI_OTEL_ENDPOINT` | *(unset = disabled)* | OTLP HTTP endpoint |\n| `RAI_OTEL_SERVICE_NAME` | `responsibleai` | Service name for traces |\n| `RAI_ALERT_THRESHOLD` | `5.0` | Trust score drop that triggers drift alert |\n| `RAI_MONTHLY_BUDGET_USD` | `10000.0` | Monthly AI spend limit |\n| `RAI_LOG_LEVEL` | `INFO` | Log level |\n| `RAI_LOG_JSON` | `true` | Structured JSON logs |\n| `RAI_HOST` | `127.0.0.1` | Bind address |\n| `RAI_PORT` | `8765` | Port |\n\nDual-prefixed `WHITEPACT_*` equivalents for these are also read where\n`MIGRATION_WHITEPACT_V2.md` documents them — the `RAI_*` names remain the\nprimary, always-supported form.\n\n---\n\n## Development\n\n```bash\ngit clone https://github.com/Guruprasath-Annadurai/Whitepact.git\ncd Whitepact\n\npython3 -m venv .venv && source .venv/bin/activate\npip install -e \".[dev]\"\n\n# Full test suite (run it to see the current test count and coverage —\n# see CONTRIBUTING.md's Running Tests section for why no number is\n# hardcoded here)\npytest\n\n# Dashboard tests only\nRAI_DB_PATH=:memory: RAI_AUTH_ENABLED=false pytest tests/test_dashboard_api.py\n\n# Webhook persistence tests\npytest tests/test_webhook_persistence.py\n\n# MCP server tests\npytest tests/test_mcp_server.py\n\n# Lint + type check\nruff check src/ tests/\nmypy src/responsibleai src/biasbuster\n```\n\n---\n\n## Roadmap\n\nSee [`ROADMAP.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/ROADMAP.md) for the canonical NOW/NEXT/LATER plan. The list below is a historical, version-by-version changelog summary kept for reference.\n\n- [x] v0.1 — BiasBuster: gender probe, 4 providers, CLI, CI integration\n- [x] v0.2 — Racial / age / religious / occupational probes, HTML reporter, PrivacyLabel federated DP\n- [x] v0.3 — Cultural bias, intersectional analysis, DeepfakeDetector ensemble\n- [x] v0.4 — Cost Intelligence (CostTracker, ModelRouter, 16-model pricing), Trust Drift Monitor\n- [x] v0.5 — Governance Dashboard (FastAPI), Trust Score, AI Passport, Guardrails, Hallucination, Compliance, Red Team, CI/CD, Docker, SLA\n- [x] v0.6 — Async PostgreSQL (SQLAlchemy), Redis rate limiting, OpenTelemetry APM, LLM integration tests\n- [x] v1.0 — WebSocket drift alerts, Prometheus endpoint, multi-tenant RBAC, org management API\n- [x] v1.1 — MCP server (10 tools, 5 resources), audit log API, red team API, billing API, Alembic migrations, per-org rate limiting, DB-persisted webhook retry queue\n- [x] v1.2 — Public Leaderboard, Trust Index/Passports + embeddable badges, AI Incident Database, TOTP MFA, expanded field encryption, DB-persisted webhooks, full dashboard UI rebuild, white-label branding, a genuinely live hosted instance — see `CHANGELOG.md` for the full list\n- [x] WhitePact migration (`1.2.0` → `1.2.2`) — governance decision core, MCP Streamable HTTP + OAuth/OIDC, risk tiering + policy engine, hash-chained evidence, approval workflow, multi-approver quorum + delegation chains, upstream MCP tool discovery, MCP trust/supply-chain scanner, HA Helm deployment, supply chain security (SBOM/provenance), release engineering, open source governance, live listings on the official MCP Registry and Smithery — see `MIGRATION_WHITEPACT_V2.md` for the full phase-by-phase log and what's still not done\n- [ ] v2.0 onward — see `VERSION_ROADMAP.md` for the phase-by-phase plan through v6.0\n- **Strategic direction** — `GAME_CHANGER_STRATEGY.md` lays out an infrastructure-first bet (free public trust registry, an agent-native trust-check primitive, AI-answer-engine citability) as an alternative to the enterprise-SaaS path, with `GAME_CHANGER_BUILD_PLAN.md` breaking it into concrete engineering phases against the current codebase\n\n---\n\n## Security & Open Source Assurance\n\nThe official [OpenSSF/OSPS BadgeApp project](https://www.bestpractices.dev/projects/14112)\ncurrently records **OpenSSF Best Practices Silver** and **OSPS Baseline Level 1**.\nThey are voluntary project evidence, not an independent audit, penetration test, SOC 2,\nor ISO certification. Current technical and claim boundaries are maintained in\n[`WHITEPACT_TRUST_STATUS.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/compliance/WHITEPACT_TRUST_STATUS.md) and\n[`PUBLIC_TRUST_CLAIMS.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/compliance/PUBLIC_TRUST_CLAIMS.md).\n\nRelease consumers can review the [signed-tag evidence](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/compliance/SIGNED_VERSION_TAGS.md),\n[release process](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/RELEASING.md), [security policy](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/SECURITY.md),\n[SLSA evidence boundary](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/compliance/SLSA_BUILD_PROVENANCE.md), and\n[consumer verification guide](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/docs/VERIFY_RELEASE.md). The reusable trusted-builder\npipeline is present on `main`. Release `v1.2.6` completed that path: its wheel and sdist\nwere reproduced, hashed, attested, independently verified in the publish job, published\nto PyPI without rebuilding, hash-matched to PyPI, and attached to the GitHub Release with\nthe CycloneDX SBOM. Independent consumer verification was repeated on 2026-08-31. The\nrelease-specific evidence is assessed as satisfying SLSA v1.2 Build L3; SLSA is a\nconformance framework, not a certification or a guarantee that an artifact is secure.\n\n---\n\n## Further reading\n\n- [`SPEC.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/SPEC.md) — the current architecture contract\n- [`MACHINE_AUTHORITY_PROBLEM.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/MACHINE_AUTHORITY_PROBLEM.md) — the problem the v3 authority-layer work answers\n- [`MACHINE_AUTHORITY_V1.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/MACHINE_AUTHORITY_V1.md) — inventory of the eight core machine-authority invariants (Delegation Graph, Autonomy Budget, Memory Firewall, Evidence Bundle, and more)\n- [`ENFORCEMENT_BOUNDARY.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/ENFORCEMENT_BOUNDARY.md) — precisely where each invariant's authority stops: inline enforcement vs. voluntary chokepoint\n- [`LEGACY_TO_MACHINE_AUTHORITY_MAP.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/LEGACY_TO_MACHINE_AUTHORITY_MAP.md) — mapping RBAC/OAuth/IAM concepts onto their WhitePact equivalents, for readers coming from traditional access control\n- [`MIGRATION_WHITEPACT_V2.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/MIGRATION_WHITEPACT_V2.md) — phase-by-phase migration log, what's done and what's explicitly not\n- [`DEFINITION_OF_DONE.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/DEFINITION_OF_DONE.md) — closing report: what's real today, what isn't, verifiable\n- [`SECURITY_THREAT_MODEL.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/SECURITY_THREAT_MODEL.md) — current security threat and attack-surface model\n- [`DETERMINISTIC_VS_PROBABILISTIC.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/DETERMINISTIC_VS_PROBABILISTIC.md) — why governance decisions are deterministic\n- [`SLA.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/SLA.md), [`ENTERPRISE_SECURITY.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/ENTERPRISE_SECURITY.md), [`SECURITY.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/SECURITY.md) — enterprise/security posture, stated honestly\n- [`compliance/SOC2_ALTERNATIVE_PATH.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/compliance/SOC2_ALTERNATIVE_PATH.md) — real, free, independently verifiable trust signals for now; the honest path to a real SOC 2 when there's budget for one\n- [`docs/ACCESSIBILITY.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/docs/ACCESSIBILITY.md), [`docs/INTERNATIONALIZATION.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/docs/INTERNATIONALIZATION.md) — WCAG2AA accessibility approach and the dashboard's i18n architecture, both with real automated CI gates\n- [`compliance/PROJECT_CONTINUITY_PLAN.md`](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/compliance/PROJECT_CONTINUITY_PLAN.md) — the access/recovery checklist a second person would need if the founder became unavailable; stated honestly as a plan, not proof of bus-factor redundancy (no second person holds this access yet)\n\n---\n\n## License\n\nMIT — see [LICENSE](https://github.com/Guruprasath-Annadurai/Whitepact/blob/main/LICENSE).\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"iconType","image","upstream",{"_110":111,"_112":113,"_114":115,"_116":117,"_118":68,"_119":120},"requiredSecrets",[],"tags",[98,99,100,101,102,103,104,105,106,107,108,109],"assets",[],"stats",{"_96":83,"_97":83},"ratingAvg","reviewCount","agentic-ai","ai-agents","ai-governance","ai-safety","ai-security","llm-security","openssf","policy-engine","responsible-ai","runtime-security","supply-chain-security","zero-trust","topics",[98,99,100,101,102,103,127,128,104,105,106,107,108,109],"license","MIT","language","Python","registryName","io.github.Guruprasath-Annadurai/whitepact","homepage","packages",[121],{"_122":123,"_124":125,"_73":126},"registryType","pypi","identifier","rai-governance-platform","1.2.2","mcp","mcp-server","ENV",{"_131":132,"_133":134,"_135":136},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]