> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.mima.works/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.mima.works/_mcp/server. # MCP Server — Governance Tools The Mima governance MCP server exposes 10 tools to Claude Code, Cursor, and any MCP-compatible AI agent. It is the primary evidence path for agent-based AI systems — any language, 4 lines of config. --- ## Install ```bash npm install -g @mima-ai/governance-mcp@0.1.13 ``` Or use `npx` without installing: ```json { "mcpServers": { "mima-governance": { "command": "npx", "args": ["-y", "@mima-ai/governance-mcp@0.1.13"], "env": { "MIMA_API_KEY": "mima_ext_...", "MIMA_SYSTEM_NAME": "my-ai-system" } } } } ``` ### Configuration | Environment variable | Required | Description | | -------------------- | -------- | --------------------------------------------------------- | | `MIMA_API_KEY` | Yes | API key from Settings → API Keys | | `MIMA_SYSTEM_NAME` | Yes | Default system name for evidence records | | `MIMA_BASE_URL` | No | Override API base URL (default: `https://api.mima.works`) | --- ## Claude Code setup Add manually to `~/.claude/settings.json`: ```json { "mcpServers": { "mima-governance": { "command": "npx", "args": ["-y", "@mima-ai/governance-mcp@0.1.13"], "env": { "MIMA_API_KEY": "mima_ext_...", "MIMA_SYSTEM_NAME": "my-ai-system" } } } } ``` --- ## Cursor setup Add to `.cursor/mcp.json` in your project root: ```json { "mcpServers": { "mima-governance": { "command": "npx", "args": ["-y", "@mima-ai/governance-mcp@0.1.13"], "env": { "MIMA_API_KEY": "mima_ext_...", "MIMA_SYSTEM_NAME": "my-ai-system" } } } } ``` --- ## The 10 tools ### `get_posture` Returns your overall governance score, per-framework breakdown, and gate status. ``` get_posture() ``` **Returns**: Overall score (0–100), scores by framework (EU AI Act, ISO 42001, SOC 2), count of open gaps, gate pass/fail. --- ### `list_systems` Lists all AI systems in the workspace — registered and unregistered. ``` list_systems(system_name?: string) ``` | Parameter | Type | Description | | ------------- | ------ | --------------------------- | | `system_name` | string | Filter to a specific system | --- ### `list_evidence` Returns evidence records filtered by system and time window. ``` list_evidence(system_name: string, days?: number, record_type?: string) ``` | Parameter | Type | Default | Description | | ------------- | ------ | -------- | ------------------------- | | `system_name` | string | required | System to query | | `days` | number | `90` | Lookback window in days | | `record_type` | string | — | Filter to one record type | --- ### `dry_run_attest` Preview which controls an attestation would earn, without writing to the ledger. ``` dry_run_attest(system_name: string, tool_name: string, model_id?: string) ``` Use this before calling `attest` to confirm what controls a record will map to. --- ### `attest` Write an attestation record to the Mima ledger. ``` attest( system_name: string, tool_name: string, input_hash: string, output_hash: string, model_id?: string, authorised_by?: { identity: string, role?: string } ) ``` --- ### `register_system` Register an AI system (Art. 9 EU AI Act). ``` register_system( system_name: string, description: string, risk_tier: "high" | "limited" | "minimal", dry_run?: boolean ) ``` When `dry_run: true`, returns what would be registered without writing. --- ### `acknowledge_policy` Record that a policy has been acknowledged. ``` acknowledge_policy( policy: string, user: string, version: string, dry_run?: boolean ) ``` When `dry_run: true`, returns what would be written without writing. --- ### `derive_controls` Returns recommended evidence record types for a given system description. ``` derive_controls(description: string, risk_tier?: string) ``` Use this to plan what records to push for a new system. --- ### `check_gates` Returns gate pass/fail status with exit codes. Useful in CI. ``` check_gates(system_name?: string) ``` **Returns**: Gate name, pass/fail, blocking status, exit code (`0` = pass, `1` = soft fail, `2` = hard fail). --- ### `suggest_gates` Returns prioritised gate recommendations. ``` suggest_gates(system_name?: string) ``` **Returns**: Gates in three tiers — `urgent` (gate will fail this week), `recommend` (close gap soon), `consider` (low priority). --- ## Claude Code skills Four skills are pre-packaged for use with `/` commands in Claude Code. ### `/mima-check-readiness` Runs a CISO-ready posture summary: 1. Calls `get_posture` to get current score. 2. Calls `list_systems` to identify unregistered systems. 3. Calls `suggest_gates` to surface the most urgent gaps. 4. Produces a structured report: overall score, framework breakdown, top 3 priority actions. ### `/mima-close-gaps` 8-step compliance copilot loop: 1. Gets current posture. 2. Identifies the highest-priority open gap. 3. Proposes the specific record to push. 4. Uses `dry_run_attest` to preview what controls would be earned. 5. Asks for approval before writing. 6. Calls `attest` or the appropriate GRC method. 7. Verifies the control was earned. 8. Reports the updated posture score. ### `/mima-register-systems` Art. 9 intake workflow: 1. Runs `list_systems` to find unregistered systems. 2. For each system, asks three Annex III grounding questions. 3. Classifies risk tier based on answers (never infers from system name alone). 4. Runs `dry_run: true` to preview the registration. 5. Asks for confirmation. 6. Calls `register_system`. ### `/mima-configure-gates` Gate configuration workflow: 1. Calls `suggest_gates` to surface recommendations. 2. Explains the business justification for each. 3. Walks through configuration options. 4. Applies the chosen gates. --- ## Dry-run pattern All three write tools support dry-run. The workflow: ``` 1. dry_run_attest(...) → "would earn: EUAIA_ART9, ISO42001_6_1" 2. 3. attest(...) → record written, controls earned ``` This is enforced by the `/mima-close-gaps` skill. Never write records without a dry-run preview in agentic contexts. --- ## Error codes | Code | Meaning | | -------------- | --------------------------------------- | | `UNAUTHORIZED` | Invalid or expired API key | | `BAD_REQUEST` | Missing required field or invalid value | | `VALIDATION` | Record failed server-side validation | | `NOT_FOUND` | System or workspace not found | | `SERVER_ERROR` | Unexpected server error | | `TIMEOUT` | Request took longer than 10 s | | `NETWORK` | Network error (no response received) |