io.github.levelsofself/nervous-system — Model Context Protocol (MCP) Governance Server

This MCP server provides governance for LLM agents via “7 enforced rules” and accompanying read-only reference tools. It is described as deterministic, lint-like, and safe across MCP clients, focused on validating MCP server configurations. It includes tooling to audit configuration risks and references to protected files.

🛠️ Key Features

Enforced governance rules: 7 rules
Deterministic governance lint for MCP server configurations
Read-only reference tools
Offline operation and deterministic results (no dependencies)

🚀 Use Cases

Auditing MCP server configurations for security issues
Checking for inline secrets, insecure transports, and unsafe scopes
Running preflight checks using a configured protected files list

⚡ Developer Benefits

audit_mcp_config: deterministic lint, fully offline, never throws; returns findings with severities and a 0–100 score
check_preflight: reads protected_files_list from nervous-system when configured

⚠️ Limitations

check_preflight only performs work when the server is configured
No behavior beyond reference tooling and configuration lint is described in provided material

What each tool actually does

Tool

Does real work?

audit_mcp_config

Yes. Deterministic lint, zero dependencies, fully offline, never throws. Checks inline secrets in env, shell wrappers, unpinned packages, auto-install flags, broad filesystem scopes, non-TLS remote transports, unpinned docker tags. Returns findings with severities and a 0-100 score.

check_preflight

Yes, when configured. Reads protected_files_list from nervous-system.config.json or NERVOUS_SYSTEM_PROTECTED_LIST. With no list it says so rather than guessing. If the list is unreadable it FAILS CLOSED.

get_* (everything else)

No. They return text: the framework, templates, instructions. That is why they are named get_.

2.0.0 breaking changes

emergency_kill_switch -> get_kill_switch_instructions. It never stopped anything.

verify_audit_chain -> get_audit_verification_instructions. It never verified a chain.

dispatch_to_llm -> get_dispatch_command. It never dispatched.

check_preflight no longer matches hardcoded filenames from the author's own server. It reads your list.

Hardcoded fleet counts and violation totals removed from get_origin_story. A number baked into a package is a fossil the moment it ships.

io.github.levelsofself/nervous-system