Governance MCP tools — br_get_governance_artifact + br_list_policy_packs land the two agent-facing follow-ups

2026-07-24

mcpsecuritygovernancedecision-lineage

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["none (MCP-only; reuse existing REST assembly + in-memory pack library)"] sdk_methods_updated: ["none (no REST surface change; openapi/llms-full/routes.json unchanged)"] mcp_tools_updated: ["br_get_governance_artifact", "br_list_policy_packs"] ---

What We Built

The two agent-facing follow-ups flagged in the 2026-07-21 governance-artifact and policy-pack-library ship logs:

br_get_governance_artifact — given a request_id, returns the signed,

control-mapped Governance Artifact (audit-chain proof + coverage + policy/grant context + exercised framework controls, optionally HMAC-signed).

br_list_policy_packs — lists the framework-tagged Policy Pack Library

(prod-safety, pii-protection, eu-ai-act-high-risk, nist-ai-rmf); pass pack_id for one pack's full OGP ruleset.

Why It Matters

These put BR's two Credo-differentiating surfaces — verifiable per-request evidence and inline-enforcing framework packs — directly in the hands of the agents that drive traffic, over the same MCP door they already use for br_why. An agent can now, mid-incident, pull the signed artifact for a decision and see which packs are governing it, without leaving the tool surface.

How It Works

No parallel system. br_get_governance_artifact routes through a new getGovernanceArtifact MCP dep in mcp-adapters/lineage.ts that calls the exact same assembleLineageWhy → buildGovernanceArtifact primitives the REST artifact route uses — so the MCP door and the auditor door are byte-identical by construction, and both degrade to "not available" when Postgres is unconfigured. br_list_policy_packs reads the in-memory listPolicyPacks/getPolicyPack library directly (no DB, no dep). Both are read-only, so both are added to MCP_GOVERNANCE_TOOLS (kill-switch-exempt) — an operator needs them precisely during an incident.

Lockstep Checklist

[x] API Routes: none — MCP-only; no REST surface change (openapi/llms-full/routes.json unchanged).
[x] TS/Py SDK: n/a (no REST surface).
[x] MCP Schemas: both tools in tool-manifest.ts (permissions audit.read / security.read), agents.json regenerated (121 tools), kill-switch allowlist updated.
[x] Master Record: closes the br_get_governance_artifact and br_list_policy_packs follow-ups from the 2026-07-21 entries.

Verification & caveats

Verified: 6 new unit tests in governance-artifact-tools.test.ts drive both

tools end-to-end through a real in-memory MCP client/server pair (dep forwarding, Postgres-off fail-safe, pack catalog + single-pack + unknown-id); manifest exhaustiveness + kill-switch-set size tests updated (22 → 24); pnpm check + pnpm build green; full suite 9,142 passing.

Caveat (inherited): br_get_governance_artifact returns real evidence only

against a live Postgres — the artifact _assembly_ is unit-verified, but an end-to-end pull against committed audit + lineage rows still needs a staging run before GA, same as the REST route it wraps.