MCP Observatory
47s ago Tracked 52,799 Last 47s ago 24h 2,818
github Python analyzed 71aaef2

KswitchDev/kswitch-devkit

github

SDKs and local Developer Edition for governed AI agents, policy checks, audit, kill-switch flows, and workload identity.

maintainer
KswitchDev
license
NOASSERTION
first seen
2026-06-25
last seen
2026-07-06
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 37 tools
transport stdio counts 37 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • analyze_boundaries
  • approve_agent
  • assess_risk
  • brain_bootstrap
  • brain_graph_context
  • brain_recall
  • brain_review_queue
  • brain_status
  • brain_time_context
  • brain_write_candidate
  • create_spiffe_identity
  • detect_anomalies
  • enforce_mcp_call
  • evaluate_all_toxic_combos
  • evaluate_authzen
  • evaluate_policy
  • evaluate_toxic_combos
  • fetch
  • get_agent
  • get_audit_trail
  • get_blast_radius
  • get_compliance_dashboard
  • get_dashboard
  • get_identity
  • get_kill_switch_history
  • get_policy
  • get_system_status
  • health
  • kill_switch
  • list_agents
  • list_expiring_identities
  • list_policies
  • policy_check
  • register_agent
  • rotate_identity
  • search
  • suspend_agent
code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 218

filesystem 23

  • fs KswitchDev-kswitch-devkit-71aaef2/devkit/cli/pkce.py :19 from pathlib import Path
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/devkit/scripts/verify-public-images.py :25 from pathlib import Path
  • fs KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/client.py :137 with opener.open(req, timeout=timeout or self.timeout) as resp:
  • fs KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/local_audit.py :15 from pathlib import Path
  • fs KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/policy_cache.py :25 from pathlib import Path
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_b005_managed_profiles.py :6 from pathlib import Path
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_local_pdp.py :44 from pathlib import Path
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_proxy.py :152 from pathlib import Path
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_service_mcp.py :88 with open(pyproject, "rb") as fh:
  • fs KswitchDev-kswitch-devkit-71aaef2/python/kswitch/audit/emitter.py :73 with open(path, "a", encoding="utf-8") as f:
  • fs KswitchDev-kswitch-devkit-71aaef2/python/kswitch/bundle/local_cache.py :90 with open(self._bundle_path, encoding="utf-8") as f:
  • fs KswitchDev-kswitch-devkit-71aaef2/python/kswitch/context/local_cache.py :81 with open(path, encoding="utf-8") as f:
  • fs KswitchDev-kswitch-devkit-71aaef2/python/kswitch/revocation/cache.py :48 with open(path, encoding="utf-8") as f:
  • fs KswitchDev-kswitch-devkit-71aaef2/python/kswitch/tokens/validator.py :25 from pathlib import Path
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_audit_emitter.py :27 with open(events_path) as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_audit_sender.py :192 with open(events_path) as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_backcompat.py :52 import pathlib
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_context_invalidation_sync.py :39 with open(filename, "w", encoding="utf-8") as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_local_bundle.py :43 with open(bundle_path, "w") as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_local_context.py :38 with open(path, "w") as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_python_sdk_event_flow.py :65 with open(events_path) as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_revocation_sync.py :154 with open(disk_path) as f:
  • fs (weak) KswitchDev-kswitch-devkit-71aaef2/scripts/validate_legal_boundary.py :17 from pathlib import Path

shell / exec 1

  • shell (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_live_local_vs_server_parity.py :49 import subprocess

network 19

  • net KswitchDev-kswitch-devkit-71aaef2/devkit/cli/pkce.py :20 from urllib.parse import parse_qs, urlparse, urlencode
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/devkit/scripts/verify-public-images.py :21 import urllib.error
  • net KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/client.py :7 import urllib.error
  • net KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/client.py :14 import httpx
  • net KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/enforcement_client.py :17 import httpx
  • net KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/policy_cache.py :20 import urllib.error
  • net KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/service_server.py :313 from urllib.parse import urlparse
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_local_pdp.py :15 - urllib.request.urlopen is the only network call made by PolicyCache.pull()
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_proxy.py :7 - httpx.AsyncClient.post returns an object with .status_code (int) and .json() (callable).
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/mcp-server/tests/test_proxy_descriptor_hash.py :7 - ``httpx.AsyncClient.post`` accepts a ``timeout=`` keyword override per
  • net KswitchDev-kswitch-devkit-71aaef2/python/kswitch/auth.py :19 import httpx
  • net KswitchDev-kswitch-devkit-71aaef2/python/kswitch/client.py :29 from urllib.parse import quote
  • net KswitchDev-kswitch-devkit-71aaef2/python/kswitch/revocation/sync.py :61 http_client: Any, # httpx.Client or compatible — any object with .get(url, **kwargs)
  • net KswitchDev-kswitch-devkit-71aaef2/python/kswitch/tokens/validator.py :28 import httpx
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_async_no_network_decision.py :4 Patches httpx.AsyncClient.send to raise on any call.
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_client.py :6 import httpx
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_governance.py :6 import httpx
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_live_local_vs_server_parity.py :50 import socket
  • net (weak) KswitchDev-kswitch-devkit-71aaef2/python/tests/test_python_no_network_decision.py :72 with patch("httpx.Client.send", side_effect=_network_should_never_be_called):

secrets 6

  • secrets KswitchDev-kswitch-devkit-71aaef2/devkit/cli/pkce.py :25 import keyring
  • secrets KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/client.py :113 self.access_key = access_key or os.environ.get("KSWITCH_DEV_MEMORY_ACCESS_KEY") or DEFAULT_ACCESS_KEY
  • secrets KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/remote.py :325 return os.environ.get("KSWITCH_BRAIN_REMOTE_READ_TOKEN", REMOTE_READ_DEV_TOKEN)
  • secrets KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/client.py :21 TOKEN = os.environ.get("KSWITCH_TOKEN", "")
  • secrets KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/proxy.py :514 token = os.environ.get("KSWITCH_TOKEN", "")
  • secrets KswitchDev-kswitch-devkit-71aaef2/python/kswitch/tokens/issuer.py :68 key = os.environ.get("KSWITCH_EXECUTION_TOKEN_SIGNING_KEY", "")

tool registrations 38

  • brain_status KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :132
  • brain_time_context KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :145
  • brain_recall KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :170
  • brain_graph_context KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :198
  • brain_bootstrap KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :245
  • brain_write_candidate KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :324
  • brain_review_queue KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_brain_mcp/server.py :411
  • register_agent KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :44
  • list_agents KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :87
  • get_agent KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :116
  • approve_agent KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :129
  • suspend_agent KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :146
  • get_dashboard KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :163
  • evaluate_toxic_combos KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :181
  • evaluate_all_toxic_combos KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :196
  • analyze_boundaries KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :207
  • assess_risk KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :222
  • get_compliance_dashboard KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :282
  • enforce_mcp_call KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :301
  • evaluate_authzen KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :335
  • create_spiffe_identity KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :369
  • get_identity KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :383
  • rotate_identity KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :396
  • list_expiring_identities KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :409
  • kill_switch KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :429
  • get_kill_switch_history KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :447
  • get_blast_radius KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :460
  • list_policies KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :485
  • evaluate_policy KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :511
  • get_policy KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :529
  • get_system_status KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :551
  • get_audit_trail KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :570
  • detect_anomalies KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/server.py :584
  • fetch KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/service_server.py :62
  • search KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/service_server.py :103
  • policy_check KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/service_server.py :141
  • get_policy KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/service_server.py :178
  • health KswitchDev-kswitch-devkit-71aaef2/mcp-server/kswitch_mcp/service_server.py :199

declared dependencies 8

  • mcp@~=1.27.0
  • httpx@~=0.28.1
  • python-multipart@~=0.0.31
  • pydantic-settings@~=2.14.2
  • s@JWT transitive dependency.
  • github.com/cedar-policy/cedar-go@v0.3.2
  • github.com/google/uuid@v1.6.0
  • golang.org/x/exp@v0.0.0-20240222234643-814bf88cf225