Governance that installs like a dev tool.
One command into the editor you already use. No account, no cluster, no bytes leaving your machine.
python scripts/install_claude_mcp.py
The SDK packages are not published yet, so the documented install paths are the local ones. Nothing on this site can be purchased yet.
One command. Then your agent is governed.
$ python scripts/install_claude_mcp.py Writing MCP server entry… Registering tools… Installed. Restart Claude Code to load the server. $ python scripts/install_cursor_mcp.py Installed. # nothing else. no signup, no key, no daemon.
- 1 cmd
- Per editor. The script writes an MCP server entry into the editor’s own config.
- 0 acct
- No sign-up to install, and no sign-up to run an assessment.
- 0 deps
- Added to your project. The entry lands in the editor’s own config, not in your lockfile.
- 0 queue
- The evaluation resolves inside the tool call that started it. There is no worker, no job and no progress bar, because there is nothing to wait for.
Nothing about how you work. Everything about what survives it.
ev_bf6442d03d1d4… envelope writtenrcpt_711e51de6f0… receipt sealedThe evaluation is synchronous and in-process, so the same input reaches the same outcome every time. It resolves inside the tool call. There is nothing to await and nothing to poll.
Your prompt, your agent, your keybindings and your review habits are unchanged. Your CI, your linters and your review process keep doing exactly what they do; nothing here replaces them or asks to run before them. The runtime is beside the work, not in front of it.
A protocol your editor already speaks.
- Claude Code
- Cursor
- any MCP client
- evaluate
- record
- verify
- A decision
- A receipt
- A timeline entry
One server, not one extension per editor. A new MCP client works without new code on our side.
The server sees the operation the agent is about to perform, not a log of what it already did.
The server evaluates against adopted policy. It does not ask a model what to think.
Two install paths today, and no list of the ones we have not built.
Claude Code
python scripts/install_claude_mcp.py
Cursor
python scripts/install_cursor_mcp.py
The runtime is not built for a particular editor.
It speaks MCP. The editors are clients. Claude Code and Cursor are the first two we install for and test against, not the two it depends on.
An editor, agent or development environment that speaks the protocol reaches the same runtime with no new code on our side. That is why this list names surfaces we have verified rather than surfaces that are theoretically reachable. The architecture is open; the claims are not.
AVAILABLE means an install path exists in this repository and this page can name the file. There is no list of PLANNED editors here, because PLANNED means declared and not built, and nothing in the repository declares one. Three surfaces install today across the whole product: the MCP server, the vai command line and the browser extension. There is no packaged installer, and the download page says so rather than offering a button that downloads nothing.
Start at the shallowest level that answers your question.
RECEIPT_ONLY- The receipt, and nothing that produced it. The disclosed body is empty by construction.
SUMMARY- The result, the finding counts, the risk categories and the coverage figures. No excerpt, no claim, no reference.
REVIEW- Findings, claims and evidence references, every excerpt and locator redacted before it leaves.
DETAILED- Everything above, in full. Gated on the
sentinel_advancedplan feature, and refused without it.
Nothing is disclosed until you choose a level, and the default is the one that discloses an empty body.
Level 4 is not the goal. Most questions are answered at level 1 and never move.
A level you never enabled produces no record, and that is returned as such, never as a pass.
Files you can diff, hash and check offline.
evidence-envelope.json- The operation, as it was evaluated.
receipt.json- The seal over that envelope.
provenance.json- Where the operation came from.
trust.json- The posture derived from it.
Five more from the same operation
api-passport.json- The credential that cites it.
compliance.json- Control coverage read from it.
quality.json- Quality signal derived from it.
risk.json- Risk signal derived from it.
signal-export.json- The export that carries it outward.
proof/provenance.json
- We published
- f042bf6c191f12bd…41c16ff061febb25
- Your browser computed
- not checked not checked
Recomputed in your browser from the bytes you received. Nothing was sent anywhere.
Records are identified by the digest of their own bytes. Change one character and the identifier no longer resolves, which is what makes tampering visible instead of arguable.
Nowhere. That is the whole answer.
Bytes of egress
No hosted service is in the path of an evaluation.
Accounts required
Install and first run need no identity.
External assets
No CDN, no webfont, no remote call to render a surface.
Machine
Runtime, record and verification all sit on it.
This is not a privacy setting that can be toggled off. It is where the code runs. An air-gapped machine behaves identically to a connected one, because there was never a call to lose.
11 typed services. Same runtime underneath.
Each service declares the authorization boundary it routes to, so a call cannot land on the wrong one by omission.
receiptsresolutiongovernancesentinelzkzk2marketplaceintegrationspassportcertificationsla
- Not a second engine
- Not business logic
- Not a new auth model
- Not remote execution
- Not code generation
- Not billing
- Not an LLM
client.info() returns those seven refusals as fields rather than leaving them to a page like this one.The absent fields are the ones worth knowing about.
no score- Coverage returns
covered / total. There is no composite, and no percentage anywhere in the response. no severity- Findings come back in engine order. Nothing ranks one above another, because nothing in the platform computes a ranking.
no trend- Nothing is written to a time series, so no field claims improvement or decline over a period.
empty- Everything that could look, looked, and nothing matched. A real answer.
unknown- Nothing could look. A different answer, with a different glyph and a stated reason.
8 states- The full vocabulary. Import-time validation refuses a table where two of them share a glyph or a word.
More governance.
More evidence.
More protection.Without more setup.
That combination is architectural, not a claim about effort. There is one runtime, so there is no cluster to provision, no pipeline to maintain and no separate store to reconcile.
Governance stops being a discipline somebody owns and becomes a property of the loop you already work in. Nothing about that makes the governance lighter. It makes the operating cost of it smaller.
Install it on one agent. Decide afterwards.
Nothing to provision, nothing to migrate, nothing to undo. Delete the config entry and the machine is exactly as it was.