ai-safe2-framework

Summary

ai-safe2-framework is an open-source GRC framework, dual-licensed under MIT and CC BY-SA 4.0, that defines controls for governing agentic AI systems and mapping them to compliance standards such as ISO 42001, NIST AI RMF, and the EU AI Act. It ships as a set of specification documents, control mappings, and enforcement scripts you drop into a project or agent workspace, with a CLI for generating compliance reports and setting failure thresholds by tier, rather than a hosted service. It targets compliance and AI governance teams working with agentic or multi-agent ("swarm") systems who need audit evidence rather than a code library. Its README frames it as a comparison point for existing GRC standards rather than naming a specific competing tool, positioning itself as a universal mapping layer across 32 frameworks.

The Universal Governance, Risk, Compliance (GRC) Operating System with Integrated Security for Agentic AI, Non-Human Identities, and Swarm Governance. AI SAFE² + AI Sovereignty Maturity Model (AISM), NEXUS-A2A Protocol, FORGE-Act, Marshal Plan for AI [Dual License: MIT + CC-BY-SA]

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v3.1 Aug 29, 2026 · issue 011

   AI SAFE² v3.1 adds 6 new MCP controls, three enforcement planes, protocol-independent persistence vocabulary, 12 new scanner rules, and a machine-readable manifest entry point for agents and bots.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v3.1 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
   # already have the repo? check out this version:
   $ git checkout v3.1

   • ›Adds ai-safe2.manifest.json and AGENTS.md as first-class machine entry points, exposing framework version, component versions, normative paths, control counts, enforcement planes, persistence vocabulary, conformance boundaries, and machine-readable datasets so agents and compliance bots can consume the framework without scraping prose.
   • ›Adds skills/mcp/data/mcp-profile-v3.1.json as a machine-readable MCP profile covering all 19 CP.5.MCP controls.
   • ›Adds skills/mcp/data/ai-safe2-controls-v3.0.json as the 161-control core dataset for automated consumption.
   • ›Adds six new CP.5.MCP controls: MCP-14 (Extension Capability Negotiation), MCP-15 (Header and Body Assertion Integrity), MCP-16 (State Handle Binding and Lifecycle), MCP-17 (MRTR Round-Trip Integrity and Replay Resistance), MCP-18 (Catalog Cache Integrity and Provenance Revalidation), and MCP-19 (Authorization Chain Integrity, intended-resource/audience binding, and SSRF boundaries), bringing the MCP profile to 19 controls.
   • ›Formalizes a protocol-independent persistence vocabulary with four canonical values — request, handle_scoped, durable, and swarm_shared — replacing protocol-owned session language at the governance boundary.
   +7 moreshow less

   • ›Expands the scanner rule registry to 64 rules by adding 12 new grouped CP.5.MCP v3.1 rules covering the new and re-anchored MCP controls.
   • ›Re-anchors MCP-4, MCP-7, MCP-8, MCP-11, and MCP-13 from protocol session state to framework-owned governance state (verified principals, capability grants, provenance baselines, delegation chains, governed state handles) so controls survive protocol changes such as MCP 2026-07-28.
   • ›Establishes three explicit enforcement planes — north-south (agent to model provider), east-west (agent to agent), and agent-to-tool (agent to MCP server or tool) — with the rule that a successful control result on one plane does not automatically establish coverage on another.
   • ›Introduces an explicit MCP-19 conformance boundary: a deployment must evidence intended-resource, audience, or equivalent binding before protected dispatch; opaque bearer-token possession alone does not satisfy the control.
   • ›Adds MCP 2026-07-28 as the primary binding for CP.5.MCP, with a twelve-month legacy compatibility window for MCP 2025-11-25; server/discover is optional under the primary binding and its absence is not treated as a scanner failure.
   • ›Scopes the Challenge Lab by enforcement plane — maturity, framework/profile conformance, the plane exercised, and required evidence — adding v3.1 MCP cases covering header/body desynchronization, catalog/schema drift, replay, audience/resource confusion, endpoint impersonation, SSRF, and legacy state-handle misuse.
   • ›Adds a dedicated Agent Discovery and Manifest Integrity CI gate that verifies manifest claims against the repository, failing on incorrect claims and broken paths.
   └──▷ BREAKING ON UPGRADE

   • !Controls MCP-4, MCP-7, MCP-8, MCP-11, and MCP-13 now bind to framework-owned governance state rather than protocol session state; implementations that anchored those controls to MCP session constructs must be re-implemented against the new bindings.