{"name":"moltline-govern","description":"Moltline Agent Governance & MCP Auditor: inventory and audit your agent fleet. Free: audit_mcp_config (scope/secret/version risks in an MCP config), scope_check (over-privileged tools by blast radius), audit_skill_file (injection/secret/concealment smells), injection_scan, inventory_report,...","url":"https://mcp.moltlinestudio.com/govern","transport":"streamable-http","homepage":"https://moltlinestudio.com/servers.html","serverInfo":{"name":"moltline-govern","version":"1.1.0"},"toolCounts":{"total":8,"free":6,"premium":2},"protocolVersion":"2025-11-25","protocolVersions":["2024-11-05","2025-03-26","2025-06-18","2025-11-25"],"pricing":{"freeTier":{"tools":6,"price":"0","currency":"USD","description":"Free forever. No account, no registration and no credentials are required to call them."},"details":"https://moltlinestudio.com/.well-known/pricing","terms":"https://moltlinestudio.com/terms.html","agentPayment":{"protocol":"x402","resource":"https://moltlinestudio.com/api","network":"eip155:8453","asset":"USDC","amount":"19000000","discovery":"https://moltlinestudio.com/.well-known/x402","description":"GET or POST the resource to receive an HTTP 402 carrying a machine-readable payment demand; retry with the transaction hash in the X-PAYMENT header and the licence key is returned in the response."},"premium":{"tools":2,"plan":"All-Access","price":"19.00","currency":"USD","period":"month","description":"One licence key unlocks the premium tools on every Moltline server. Billed monthly, cancellable at any time.","purchaseUrl":"https://moltlinestudio.com/#allaccess"}},"authentication":{"required":false},"tools":[{"name":"audit_mcp_config","description":"Audit an MCP server config for risk-ranked posture findings. FREE.\n\nFlags exposed machine credentials in the config, required inputs that\naren't gated/optional, unpinned versions, over-broad env access, and\ndangerous auto-run flags. It never echoes any matched secret value back.\nTypical input {\"config\": \"<mcpize.yaml, mcp.json, or a Claude/Cursor\nservers block>\"} returns {\"posture_score\": 0-100, \"verdict\": \"...\",\n\"findings\": [{\"line\": N, \"severity\": 1-5, \"issue\": \"...\", \"fix\": \"...\"}],\n\"note\": \"...\"}.\n\nUse on a server configuration document. Not for a skill or instruction\nfile (audit_skill_file) and not for untrusted content an agent is about to\nread (injection_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"config":{"type":"string","description":"The MCP config to audit, pasted as text or JSON —\nmcpize.yaml, mcp.json, or a Claude/Cursor servers block."}},"required":["config"],"type":"object"}},{"name":"scope_check","description":"Score the blast radius of every tool in a permission manifest. FREE.\n\nRanks each tool by capability risk (command exec > money/delete >\nfile-write/messaging > read > network) and flags the over-privileged\nones that need approval gates. Typical input {\"tools\": \"[\\\"run_shell\\\",\n\\\"read_docs\\\"]\"} returns {\"tools_scored\": N, \"high_risk_tools\": N,\n\"ranking\": [{\"tool\": ..., \"blast_radius\": 0-5, \"capabilities\": [...]}],\n\"recommendation\": [\"...\"], \"note\": \"...\"}.\n\nUse on a permission manifest to rank tools by blast radius. Not for the\nconfiguration that mounts them (audit_mcp_config). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"tools":{"type":"string","description":"The manifest as a string — a JSON array of tool names or\n{name, description} objects, a JSON object of name->description,\nor plain newline-separated names."}},"required":["tools"],"type":"object"}},{"name":"audit_skill_file","description":"Audit an agent skill or instruction file before you trust it. FREE.\n\nChecks for governance smells: prompt-injection and guardrail-bypass\nphrasing, concealment instructions ('don't tell the user'), exfiltration\nlanguage, and exposed credential material. Typical input {\"content\":\n\"<SKILL.md, system prompt, or tool description text>\"} returns\n{\"verdict\": \"reject — do not install\" | \"no governance red flags on a\npattern pass\", \"findings\": [{\"severity\": 1-5, \"issue\": \"...\"}],\n\"note\": \"...\"}.\n\nUse before trusting a skill or instruction file that came from outside\nyour own repository. Not for arbitrary untrusted input at run time\n(injection_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"content":{"type":"string","description":"Full text of the skill file, system prompt, or tool\ndescription to audit."}},"required":["content"],"type":"object"}},{"name":"injection_scan","description":"Scan untrusted text for prompt-injection patterns before ingestion. FREE.\n\nUse on any web page, email, or document an agent is about to ingest to\ncatch prompt-injection and data-exfiltration patterns before they reach\nthe agent's context. Typical input {\"text\": \"<untrusted content>\"}\nreturns {\"injection_suspected\": bool, \"count\": N, \"hits\": [{\"line\": N,\n\"pattern\": \"...\", \"text\": \"<flagged line>\"}], \"note\": \"...\"}.\n\nNot for reviewing a skill file you control (audit_skill_file), and a clean\nresult is not a guarantee of safety - it reports pattern matches only. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"text":{"type":"string","description":"The untrusted content to scan, pasted as a single string."}},"required":["text"],"type":"object"}},{"name":"inventory_report","description":"Build a governance inventory with risk tiers from a raw agent list. FREE.\n\nTurns a list of agents / MCP servers / skills into an audit-ready\nsummary with critical/elevated/standard tiers and unowned-agent flags.\nTypical input {\"items\": \"[{\\\"name\\\": \\\"deploy-bot\\\", \\\"owner\\\":\n\\\"ana\\\"}]\"} returns {\"total\": N, \"tiers\": {\"critical\": N, ...},\n\"unowned_agents\": [...], \"inventory\": [{\"name\": ..., \"owner\": ...,\n\"tier\": ..., \"orphaned\": bool}], \"reading\": \"...\", \"note\": \"...\"}.\n\nUse to turn a raw agent list into risk tiers. Not for auditing any single\nagent in depth (audit_mcp_config, scope_check). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"items":{"type":"string","description":"The fleet as a string — a JSON array of {name, owner?,\ncapabilities?, last_seen?} objects, or plain newline-separated\nagent names."}},"required":["items"],"type":"object"}},{"name":"governance_policy","description":"Generate an audit-ready agent-governance policy for a fleet. PREMIUM (license).\n\nCovers inventory cadence, ownership rules, least-privilege approval\ngates, injection defense, logging/retention, and decommissioning\ntriggers. Typical input {\"fleet_context\": \"20 agents, 3 with shell\naccess, one finance bot\"} returns {\"policy\": ..., \"sections\": {...},\n\"context_note\": ..., \"audit_checklist\": [\"...\", ...]}.\n\nUse when a fleet needs a written policy document. Not for assessing what\nthe fleet currently does (inventory_report, audit_mcp_config). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"premium","inputSchema":{"additionalProperties":false,"properties":{"fleet_context":{"default":"","type":"string","description":"Optional plain-language description of the fleet\n(size, capabilities, sensitive systems) used to tailor the\npolicy; empty returns the generic baseline."}},"type":"object"}},{"name":"get_auditor_persona","description":"Load the Governance Auditor persona for consistent fleet audits. PREMIUM (license).\n\nThe persona is methodical, evidence-driven, and allergic to 'it's\nprobably fine'. Takes no arguments. Returns {\"persona\": ...,\n\"identity\": ..., \"rules\": [\"...\", ...], \"opening_move\": \"...\"} ready to\nadopt as a system prompt.\n\nUse to keep repeated audits consistent in voice and rigor. Not for running\nan audit - the audit tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"premium","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"}},{"name":"agent_readiness_scan","description":"Score a public domain against 21 agent-readiness checks. FREE.\n\nUse when you need to know whether an autonomous agent can discover, read,\nuse or pay a website - your own, or a vendor you are evaluating before\nrecommending it. Typical input {\"domain\": \"example.com\"} returns\n{\"score\": 8, \"total\": 21, \"grade\": \"F\", \"passed\": [...], \"failed\":\n[{\"title\": \"...\", \"detail\": \"...\", \"fix\": \"...\"}], \"report_url\": \"...\"}\nwhere report_url is a permanent shareable page for the same result.\n\nNot for auditing an MCP client configuration (audit_mcp_config) and not\nfor scanning text for injection (injection_scan) - this one reaches out\nover the network and fetches public URLs on a live domain. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {\"error\": \"<what is wrong and how to fix it>\"} (for example {\"error\": \"The readiness scanner is not reachable right now.\"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.","tier":"free","inputSchema":{"additionalProperties":false,"properties":{"domain":{"type":"string","description":"A public hostname such as example.com. A full URL is accepted\nand reduced to its host. Hostnames that resolve to private or\ninternal addresses are refused."}},"required":["domain"],"type":"object"}}],"resources":[],"prompts":[]}