PromptSpeak Governance MCP server

by chrbailey·io.github.chrbailey/promptspeak·v0.4.1·1 stars

No reviews yet

Pre-execution governance for AI agents. Validates tool calls before they execute.

A92/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A92/100

full report

Adoption

New

1 stars

Reviews

Write one

Nobody has reviewed PromptSpeak Governance yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

PromptSpeak Governance tools (56, 7 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

ps_audit_get
Get audit log entries.
ps_capability_get
Report this server's PromptSpeak capabilities (version, verb count, namespaces).
ps_confidence_bulk_set
Set multiple confidence thresholds at once.
ps_confidence_get
Get all confidence thresholds.
ps_confidence_set
Set a confidence threshold. This is the hidden knob for operators.
ps_config_activate
Activate a registered policy overlay.
ps_config_export
Export current configuration for backup.
ps_config_get
Get current configuration including active overlay and thresholds.
ps_config_import
Import configuration from backup.
ps_config_set
Register a new policy overlay.
ps_delegate
Delegate a task from parent agent to child agent. Enforces inheritance rules and constraint propagation.
ps_delegate_list
List delegations for an agent.
ps_delegate_revoke
Revoke an active delegation.
ps_executewrite action
Execute an action under PromptSpeak frame governance. The gatekeeper validates and enforces constraints.
ps_execute_batchwrite action
Execute multiple actions under a single frame. Supports sequential or parallel execution with optional stop-on-failure.
ps_execute_dry_runwrite action
Check if an action would succeed without executing. Returns decision and coverage analysis.
ps_expand
Expand a PromptSpeak expression to natural English. Used by safety filters for human-readable action descriptions.
ps_feature_get
Get all feature flags.
ps_feature_set
Set a feature flag.
ps_handshake_initiate
Start a PromptSpeak verification handshake. Returns probe expression to send to remote agent.
ps_handshake_respond
Handle an incoming PromptSpeak handshake probe. Parses, validates, and echoes confirmation.
ps_hold_approve
Approve a held execution request. The operation will proceed with optional modifications.
ps_hold_config
Configure hold behavior and thresholds. Controls when operations are held for human review.
ps_hold_list
List all pending holds awaiting human approval. Returns holds for risky operations that were blocked pending review.
ps_hold_reject
Reject a held execution request. The operation will not proceed.
ps_hold_stats
Get hold statistics and history.
ps_parse
Parse a PromptSpeak EBNF expression into an AST. Returns AST tree and metadata (verb count, pipes, branches).
ps_registry_audit
Get full change history for a verb (registrations, transitions, updates).
ps_registry_lookup
Resolve a verb symbol to its full definition, including aliases.
ps_registry_namespace
List all verbs registered in a namespace.
ps_registry_proposewrite action
Submit a new verb for review. Created with status: proposed.
ps_registry_status
Check the lifecycle state and safety classification of a verb.
ps_registry_version
Get current spec version, verb count, and registry statistics.
ps_security_config
Configure security detection patterns. List, enable, disable, or change severity of patterns.
ps_security_gate
Scan code and enforce security policy. Blocks on critical findings, holds high-severity for review, warns on medium, logs low/info.
ps_security_scan
Scan code content for security vulnerabilities. Returns findings classified by severity (critical, high, medium, low, info).
ps_state_drift_history
Get drift history for an agent.
ps_state_get
Get current state of an agent including drift metrics and circuit breaker status.
ps_state_halt
Immediately halt an agent by opening its circuit breaker.
ps_state_recalibrate
Recalibrate agent drift baseline. Optionally provide a new baseline configuration.
ps_state_reset
Reset agent state. Can reset circuit breaker, drift metrics, and/or baseline.
ps_state_resume
Resume a halted agent.
ps_state_system
Get overall system state including all agents, operations, and drift alerts.
ps_symbol_add_alternative
Add an alternative explanation to a symbol's findings. CRITICAL for preventing false positives: When a pattern-based finding could have multiple explanations, document them here. Adding high-likelihood alternatives automatically reduces confidence in the original claim. Examples: - "9 identical payments" → Alternative: "Monthly insurance premium financing" - "Large round numbers" → Alternative: "N
ps_symbol_createwrite action
Create a new directive symbol in the registry. Symbol IDs follow the pattern: - Public companies: Ξ.{TICKER}.{PERIOD} (e.g., Ξ.NVDA.Q3FY25) - People: Ξ.I.{NAME}.{CONTEXT} (e.g., Ξ.I.JENSEN_HUANG.BIO) - Events: Ξ.E.{TYPE}.{ID} (e.g., Ξ.E.EARNINGS.NVDA.20241120) - Sectors: Ξ.S.{SECTOR}.{CONTEXT} (e.g., Ξ.S.SEMICONDUCTORS.2024) - Tasks: Ξ.T.{PROJECT}.{ID} (e.g., Ξ.T.PORTFOLIO_REVIEW.001) - Knowledge:
ps_symbol_deletewrite action
Delete a symbol from the registry.
ps_symbol_format
Format a symbol for inclusion in a prompt. Returns LLM-ready text.
ps_symbol_get
Retrieve a directive symbol by ID. Returns the full symbol with all grounding context.
ps_symbol_import
Bulk import symbols from external data (HuggingFace, JSON, etc.).
ps_symbol_list
List symbols with optional filtering.
ps_symbol_list_unverified
List symbols that require human review. Returns symbols flagged for review due to: - Accusatory claims without sufficient evidence - Missing alternative explanations - High-stakes claims (fraud, violations, diagnoses) - Low confidence scores Use this to find claims that need human validation before action.
ps_symbol_stats
Get statistics about the symbol registry.
ps_symbol_updatewrite action
Update an existing symbol. Creates a new version with updated hash.
ps_symbol_verify
Record human verification of a symbol claim. Use this tool to upgrade or dispute claims based on human review: - VERIFIED: Human expert has confirmed the claim is accurate - CORROBORATED: Additional evidence supports the claim - DISPUTED: Human reviewer found the claim to be incorrect or misleading Important: Accusatory claims (fraud, violations) should be DISPUTED if they lack evidence or have pl
ps_validate
Validate a PromptSpeak frame. Returns validation report with errors, warnings, and suggestions.
ps_validate_batch
Validate multiple frames at once. Useful for validating delegation chains.

Public scan report

scanner v0.1.10 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan193 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 2 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How PromptSpeak Governance compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 92/100; higher than 95% of 48,255 servers
Tools: 56; the typical server has 7
Tools that change things: 13%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 1; more than 65% of 28,688 servers

What its tools let an agent do: 49 read · 7 change

Install PromptSpeak Governance in Claude Code, Cursor or VS Code

Runs npx -y @chrbailey/promptspeak-mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add promptspeak -- npx -y @chrbailey/promptspeak-mcp-server

Add to Cursor

What the publisher says

From the PromptSpeak Governance repository's README, as published. We do not edit it. Read it on GitHub

promptspeak-mcp-server

Pre-execution governance for AI agents. Blocks dangerous tool calls before they execute.

AI agents call tools (file writes, API requests, shell commands) with no validation layer between intent and execution. A prompt injection, hallucinated argument, or drifting goal can trigger irreversible actions. PromptSpeak intercepts every MCP tool call, validates it against deterministic rules, and blocks or holds risky operations for human approval — in 0.1ms, before anything executes.

When to use this

You run AI agents that call tools (MCP servers, function calling, tool use) and need a governance layer between the agent and the tools.
You need human-in-the-loop approval for high-risk operations (production deployments, financial transactions, legal filings).
You want to detect behavioral drift — an agent gradually shifting away from its assigned task.
You need an audit trail of every tool call an agent attempted, whether it was allowed or blocked.
You operate in a regulated domain (legal, financial, healthcare) where agent actions must be deterministically constrained.

Install

Claude Code

Add to ~/.claude/settings.json (or project-level .claude/settings.json):

{
  "mcpServers": {
    "promptspeak": {
      "command": "npx",
      "args": ["promptspeak-mcp-server"]
    }
  }
}

Restart Claude Code. All 56 governance tools are immediately available.

Claude Desktop

Add to claudedesktopconfig.json:

{
  "mcpServers": {
    "promptspeak": {
      "command": "npx",
      "args": ["promptspeak-mcp-server"]
    }
  }
}

As a library

npm install promptspeak-mcp-server

From source

git clone https://github.com/chrbailey/promptspeak-mcp-server.git
cd promptspeak-mcp-server
npm install && npm run build
npm start

Usage examples

1. Validate a governance frame

Validate that a PromptSpeak frame is structurally and semantically correct before using it. Frames encode governance constraints as symbol sequences — mode first, then domain, action, and entity.

// Tool call: ps_validate
{
  "name": "ps_validate",
  "arguments": {
    "frame": "⊕◊▶α",
    "validationLevel": "full"
  }
}

// Response
{
  "valid": true,
  "frame": "⊕◊▶α",
  "parsedFrame": {
    "mode": { "symbol": "⊕", "meaning": "strict" },
    "domain": { "symbol": "◊", "meaning": "financial" },
    "action": { "symbol": "▶", "meaning": "execute" },
    "entity": { "symbol": "α", "meaning": "primary" }
  },
  "parseConfidence": 1.0,
  "report": {
    "valid": true,
    "errors": [],
    "warnings": [
      { "code": "ACTION_MISSING_DOMAIN", "message": "Consider adding domain context", "severity": "warning" }
    ]
  },
  "summary": { "errors": 0, "warnings": 1, "passed": 16 }
}

Invalid frames return actionable suggestions:

// Tool call: validate a frame with conflicting modes
{
  "name": "ps_validate",
  "arguments": { "frame": "⊕⊖▶", "validationLevel": "semantic" }
}

// Response: blocked — strict + flexible modes conflict
{
  "valid": false,
  "summary": { "errors": 1, "warnings": 0, "passed": 10 },
  "suggestions": ["Remove either ⊕ (strict) or ⊖ (flexible) - cannot have both"]
}

2. Hold queue workflow — human-in-the-loop approval

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

PromptSpeak Governance: common questions

Is PromptSpeak Governance MCP server safe?: Yes, by our scan: it is graded A (92/100). Read the PromptSpeak Governance safety report
How do I install PromptSpeak Governance?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does PromptSpeak Governance need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is PromptSpeak Governance maintained?: The last commit was 40 days ago (2026-09-25). The latest release is v0.4.1.
How does PromptSpeak Governance compare with other MCP servers?: safety score 92/100 (higher than 95% of 48,255 servers); tools 56 (the typical server has 7); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.