Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@haver-governance-mcp Check permission for intake assistant to read labs"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Identity, permission, audit, and recall for healthcare AI agents, delivered over the Model Context Protocol (MCP).
As organizations deploy more AI agents into clinical and operational workflows, the missing layer is governance: knowing which agent is acting, whether it is allowed to, having a tamper-evident record of what it did, and being able to revoke it. Haver Governance MCP gives any MCP-compatible client (such as Claude) a small set of tools to enforce and record that governance at runtime.
This is an open-source reference implementation from Haver AI, the governance layer for healthcare AI.
Tool | Pillar | What it does |
| Identity | Registers an agent with a stable id, owner, role, and permission scopes. |
| Permission | Decides whether an agent may take an action on a resource. Denies unknown or recalled agents. Logs the decision. |
| Audit | Appends a tamper-evident, hash-chained record of an agent action. |
| Audit | Returns recent audit entries, filterable by agent or resource. |
| Audit | Recomputes the hash chain and reports whether the log was tampered with. |
| Recall | Revokes an agent so every future permission check denies it. |
| Safety | Heuristically flags and redacts common PHI (SSN, MRN, email, phone, dates). |
Scopes use a simple action:resource form, for example read:labs or write:notes, and support * wildcards (read:*, *:*).
Related MCP server: AgentVeil Protocol
Run it directly with npx (no global install needed):
npx -y haver-governance-mcpAdd this to your claude_desktop_config.json:
{
"mcpServers": {
"haver-governance": {
"command": "npx",
"args": ["-y", "haver-governance-mcp"]
}
}
}Restart Claude, and the seven governance tools appear.
register_agent an intake assistant with scopes: ["read:labs"].
check_permission for read on labs returns allow; write on notes returns deny.
record_action logs each real action it takes, flagging contains_phi when relevant.
If the agent misbehaves, recall_agent revokes it; future checks deny.
verify_audit_integrity proves the log has not been altered.
All state is stored locally as plain files: agent records in agents.json and the audit log in audit.log, under ~/.haver-governance by default (override with the HAVER_GOV_DIR environment variable). Nothing is transmitted anywhere. The audit log is append-only and hash-chained for tamper evidence. See PRIVACY.md.
The scan_phi tool is a heuristic guardrail to catch obvious leaks. It is not a certified de-identification tool and should not be relied on as one.
npm install
npm run build
node dist/index.js # runs on stdioRequires Node.js 18 or later. Built with the official @modelcontextprotocol/sdk and Zod.
This package is published to npm and listed in the official MCP Registry. See PUBLISHING.md for the exact steps.
Haver AI is the governance layer for healthcare AI: identity, permission, audit, and recall for every agent your organization deploys. Learn more at haver.ai.
MIT. See LICENSE.
Decide whether a registered agent may perform an action on a resource, based on its scopes and status. Recalled or unknown agents are always denied. The decision is written to the audit log.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | The action being attempted, e.g. 'read' | |
| agent_id | Yes | ||
| resource | Yes | The resource being acted on, e.g. 'labs' |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses key behaviors: denial for recalled/unknown agents and audit log writing. However, it does not detail failure modes or behavior when scopes mismatch.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states purpose, second adds important behavioral caveats. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, denial conditions, and audit logging. Lacks description of return value (e.g., boolean or status), which would be helpful without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% (one param missing description). The description adds no parameter-specific info beyond what's in schema, leaving agent_id's purpose implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('decide'), the resource ('permission for agent on action'), and distinguishes from sibling tools like recall_agent, register_agent, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use (to check agent permission) and provides specific behaviors (recalled/unknown agents denied, audit logging), but does not explicitly state when not to use or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return recent audit entries, optionally filtered by agent or resource.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| agent_id | No | ||
| resource | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It indicates a read operation but lacks details on ordering, pagination, cost, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words, but underspecifies important aspects. Acceptable conciseness but at the cost of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and only 3 unrequired parameters. Description does not explain return format, default behavior, or any edge cases, making it insufficient for confident use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%. Description loosely maps agent_id and resource to filters but does not explain semantics, limits, or formatting. The limit parameter is not mentioned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns recent audit entries and can filter by agent or resource. It distinguishes from sibling tools like record_action or check_permission, but 'recent' is not quantified.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like check_permission or verify_audit_integrity. No mention of prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Revoke an agent so all future permission checks deny it. Use when an agent misbehaves or is decommissioned. The recall is audited.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | Yes | Why the agent is being recalled | |
| agent_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full responsibility for behavioral disclosure. It explains the core effect (denying future permission checks) and the audit trait, but it does not address reversibility or side effects (e.g., ongoing sessions). This is a minor gap for a destructive action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at three sentences, with the action and effect first, followed by usage guidance, then a notable behavioral trait. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (2 parameters, no output schema, no annotations), the description covers purpose and effect but omits parameter details and output information. It is adequate but leaves gaps for a fully informed invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50% (agent_id lacks a description), and the tool description adds no detail about either parameter. The description does not help an agent understand what values to provide for agent_id or reason beyond what the schema already offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Revoke an agent') and its effect ('so all future permission checks deny it'). It also provides usage context ('when an agent misbehaves or is decommissioned'), distinguishing it from sibling tools like register_agent or check_permission.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly specifies when to use the tool: 'Use when an agent misbehaves or is decommissioned.' This gives clear guidance, and since siblings cover other operations (e.g., register_agent, check_permission), the intended use case is well-differentiated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Append a tamper-evident audit record for something an agent did. Entries are hash-chained, so any later modification is detectable.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| outcome | Yes | What happened, e.g. 'success' or 'error' | |
| agent_id | Yes | ||
| resource | Yes | ||
| rationale | Yes | Why the agent took this action | |
| contains_phi | No | Whether this action touched protected health information |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so description carries full burden. Mentions hash-chaining for tamper evidence, but lacks details on authentication requirements, side effects, or concurrency behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no wasted words. Key information front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters, 5 required, no output schema, and no annotations, description is incomplete. Does not explain return value, error conditions, or operational context like ordering or idempotency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 50% (only outcome and rationale have descriptions). The description does not clarify the undocumented parameters (action, agent_id, resource) and adds no extra meaning to the described ones.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'append', the resource 'audit record', and unique behavioral trait 'tamper-evident, hash-chained'. It distinguishes from siblings like get_audit_trail and verify_audit_integrity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use vs alternatives like check_permission or recall_agent. No prerequisites or exclusions mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Register an AI agent with a stable identity, owner, role, and permission scopes. Scopes use the form 'action:resource' (e.g. 'read:labs'), and '*' wildcards are allowed.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human-readable agent name | |
| role | Yes | The agent's role, e.g. 'care-coordination-assistant' | |
| owner | Yes | Person or team accountable for this agent | |
| scopes | Yes | Permission scopes, e.g. ['read:labs','write:notes'] | |
| agent_id | Yes | Unique, stable identifier for the agent |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It states the action but does not disclose side effects (e.g., whether registering an existing agent overwrites or errors), authorization needs, or idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences. First front-loads the core purpose. Second adds a critical parameter formatting detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a registration tool with 5 required params and no output schema, the description covers the basics but lacks information on duplication behavior, error handling, or return confirmation. Sibling tools don't clarify these gaps either.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds the format for scopes ('action:resource' and wildcard allowance), which extends beyond the schema's example list. This is valuable additional context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies a clear verb (register) and resource (AI agent with identity, owner, role, scopes). It distinguishes from siblings like recall_agent (which likely deregisters) and check_permission.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use or not use this tool versus alternatives. The context implies registration vs. recall, but no prerequisites or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Heuristically scan text for common protected health information (SSN, MRN, email, phone, dates) and return findings plus a redacted copy. A guardrail, not a certified de-identification tool.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The text to scan |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It discloses heuristic scanning and mentions return of findings and a redacted copy, but does not detail the scanning algorithm or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the core function, no redundant information. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description completely covers what the tool does, what it detects, what it returns, and its limitation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers the single 'text' parameter (100% coverage). The description adds value by listing specific PHI types scanned, going beyond the schema's minimal description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans text for PHI (SSN, MRN, email, phone, dates) and returns findings plus a redacted copy, distinguishing it from siblings by noting it's a guardrail, not certified de-identification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it is a guardrail, not a certified de-identification tool, guiding when to use it. However, it does not reference specific sibling tools or provide explicit when-not-to-use guidance beyond the de-identification caveat.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recompute the audit hash chain and report whether the log is intact or has been tampered with.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It states the tool recomputes and reports, implying a read-only operation, but does not disclose authorization needs or potential side effects. It partially meets transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no unnecessary words. It is front-loaded and gets straight to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description fully explains what it does and what it returns (report intact or tampered). It is complete for an agent to understand and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, and schema coverage is 100%. The description adds no parameter information, which is acceptable given the baseline of 4 for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it recomputes the audit hash chain and reports integrity, using specific verbs and resources. It distinguishes itself from sibling tools like get_audit_trail (retrieval) and check_permission (permissions) by focusing on integrity verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, nor any conditions for use. The description does not mention when not to use it or any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0check_permissionget_audit_trailrecall_agentrecord_actionregister_agentscan_phiverify_audit_integrityEach tool has a unique purpose: permission checking, audit trail retrieval, agent recall, action recording, agent registration, PHI scanning, and integrity verification. No two tools overlap or could be confused.
All tools follow a consistent verb_noun pattern (e.g., check_permission, register_agent, scan_phi) with imperative verbs and descriptive nouns. No mixing of styles or vague names.
Seven tools is well-scoped for a governance server covering agent lifecycle, permissions, audit, and integrity. Each tool earns its place without being excessive or insufficient.
The tool surface covers core CRUD-like operations for agents (register, recall), permissions (check), audit (record, get, verify integrity), and adds a guardrail (scan_phi). No obvious gaps for the domain.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Register every AI agent, log every action, prove it. EU AI Act compliance built in.
Identity, authorization, audit trails, and revocable permissions for AI agents accessing MCP tools.
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
Command your AI agents: verifiable passports, credential injection, full audit, revoke in 60s.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/haverAI/haver-governance-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
