MCP

Put the policy gate inside the agent's tool loop.

@decionis/mcp is a local stdio MCP server: an agent reads the repository's DECIONIS_POLICY.md and evaluates a candidate action with the real Decionis evaluator before it commits, deploys or migrates anything. Native PreToolUse hooks enforce the same decision outside the model's discretion. The hosted Protocol MCP does it for an organization's agents and records signed Decision Dossiers.

npm: 0.3.0
License: Apache-2.0
Source: not public
Checked: 2026-09-26

Install

Point any MCP client at npx. Each client keeps its own config; the server is the same.

Claude Code

claude mcp add decionis -- npx -y @decionis/mcp

Or, for one repository, in .mcp.json at its root:

{
  "mcpServers": {
    "decionis": {
      "command": "npx",
      "args": ["-y", "@decionis/mcp"]
    }
  }
}

Codex

In ~/.codex/config.toml, or a trusted project's .codex/config.toml:

[mcp_servers.decionis]
command = "npx"
args = ["-y", "@decionis/mcp"]
required = true

Cursor

The same block as Claude Code, in .cursor/mcp.json.

Hook executables

Install it globally so the hook command is on PATH for the templates below.

npm install -g @decionis/mcp

Tools

Five core tools are read-only and local: no credentials, no network, nothing recorded. Two Presence tools appear only with a Presence tenant key. Six Shield tools are always listed and work once the assistant is paired with the user's Shield; they call the Shield service, and four of them change state there.

Core

decionis_read_policy: The repository's DECIONIS_POLICY.md: its path, SHA-256, and the compiled rules or the compile errors.
decionis_evaluate: Evaluates a candidate action against that policy, or a named policy pack, with the real evaluator: the verdict, the matched rule, the evaluation id and the exact policy version. An unavailable version fails closed; it is never substituted.
decionis_list_policy_packs: The policy packs the evaluator ships, each with its key, decision domain and bundle version.
decionis_demo: Four canned intents through the real evaluator with a built-in sample policy, one per outcome. No account, key or policy file.
decionis_verdict_help: The verdict vocabulary, the rules grammar, and how an agent should act on each verdict.

The policy file resolves from the tool's path argument, then $DECIONIS_POLICY_PATH, then ./DECIONIS_POLICY.md. With a policy pack, its bundle is seeded into the local evaluator once and its exact version is pinned on every evaluation.

Presence, with DECIONIS_PRESENCE_API_KEY

decionis_request_presence_verification: Asks a named person to approve a held ESCALATE on their own device. The action stays held; a BLOCK cannot be bypassed, and Shadow Mode evaluations are refused.
decionis_get_presence_verification_status: Verifies the signed Presence record and re-evaluates the held action; only the new Decionis verdict can release it.

They call presence.decionis.com with your tenant key, reusing the hosted handlers, so the loop is the hosted loop. Presence

Shield

shield.pairchanges state: Binds the assistant to the user's Shield with the six-character code shown in the Shield app.
shield.request_purchasechanges state: Asks the user's Shield for ALLOW, ASK or BLOCK before a purchase; execute only on ALLOW.
shield.check_spending_authoritychanges state: Checks spending authority for an app or agent before the consequential action.
shield.get_permission: Reads the spender identity and the user-owned limits bound to the credential.
shield.request_approvalchanges state: Starts or polls Presence approval for an ASK decision; nothing executes while it stays ASK.
shield.get_decision: The current ALLOW, ASK or BLOCK decision and its evidence identifiers.

Pair with the code from the Shield app, or set DECIONIS_SHIELD_API_KEY and DECIONIS_SHIELD_APP_ID. Shield answers in its own vocabulary: ALLOW, ASK, BLOCK.

Native PreToolUse hooks

An MCP tool runs only when the model chooses to ask. The hook intercepts every supported tool call regardless: Codex, GitHub Copilot and Claude Code are normalized into one tool-call contract.

decionis-agent-hook <codex|copilot|claude>

Host	Template in the package	Where it goes
Codex	templates/CodexHooks.json	.codex/hooks.json
Claude Code	templates/ClaudeSettings.json	.claude/settings.json
GitHub Copilot (CLI, cloud agent, VS Code)	templates/CopilotHooks.json	.github/hooks/Decionis.json

Local mode, the default

The hook loads DECIONIS_POLICY.md into the real in-process evaluator and enforces the result with no network and no credentials.

Remote mode

Evaluate through your organization's policy graph and signed decision pipeline. Set all four; a partial remote configuration is refused.

DECIONIS_AGENT_GATE_MODE=remote
DECIONIS_AGENT_GATE_URL=https://protocol.decionis.com/v1/protocol/evaluate-decision
DECIONIS_API_KEY=<org-scoped key>
DECIONIS_ORG_ID=<organization id>

APPROVE: No permission override is returned; the host's own sandbox and approval flow still apply.
REJECT: The tool call stops with the host's native deny response.
REVIEW or ESCALATE: The tool call stops and stays blocked until a person resolves it through the policy workflow.
Failure: Network errors, invalid hook input, a policy file that cannot be read or compiled, and evaluator failures all deny. A repository with no policy file is denied by a per-repository hook; the Claude Code plugin, which runs in every repository you open, reports it as not governed (UNGOVERNED_REPOSITORY) and lets the call through.

The hosted Protocol MCP

For agents connected to an organization, when the decision has to be recorded. Connect with OAuth or an organization API key and ask in plain language; evaluations create evidence but never execute the downstream action.

What it is

Streamable HTTP at https://protocol.decionis.com/v1/protocol/mcp
The organization's full policy graph, not a repository file
Every governed decision is a signed Decision Dossier

What a client sees

Directory clients that connect with OAuth get seven conversational capabilities: get started, evaluate, explain, requirements, request Presence, Presence status and the dossier. Clients with an organization API key get the full tool catalog.

To gate the tools of an MCP server you run, inside your own service, see MCP execution interception in AgentSafe. A local evaluation mints no Decision Dossier. For the verifiable record, use the hosted surface, or decionis/govern in CI. Contracts: evaluate-decision · protocol hooks · policy encoding