MCP Server for Z.AI - A Model Context Protocol server that provides AI capabilities
Nothing to run from here
arifOS — Constitutional AI Governance is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
8
tools declared
—
trust score
remote
at its publisher
—
calls last 7d
What it does
Constitutional AI governance: 11 mega-tools, 13 floors, VAULT999 ledger. Human-in-loop by design.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http arifos-constitutional-ai-governance-mcp https://arifosmcp.arif-fazil.com/mcp
# 2 — ask your agent for something these tools do
# arif_init, arif_observe, arif_think and 5 more
arifOS — Constitutional AI Governance costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
ARAll 3 servers
ariffazil3 servers
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http arifos-constitutional-ai-governance-mcp https://arifosmcp.arif-fazil.com/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
8 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
KERNEL 000 · Ignite a governed kernel session: binds actor identity, constitutional floors F1–F13, and the audit chain. Returns the session_id + session_token that every other arif_* verb requires. Use mode=preflight to inspect an existing session without re-igniting, mode=resume to continue one. Modes: init, preflight, resume, validate, canary, triage, epoch_open, epoch_seal, light, opt_out.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | What to do: 'init' (default) starts a new governed session; 'preflight' checks an existing session's state without creating one; 'resume' re-attaches to the session in session_id; 'validate' re-checks |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you. | |
| ack_irreversible | boolean | no | Set true to acknowledge that session records are permanent audit artifacts and cannot be deleted afterwards. |
| session_id | no | Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session. | |
| epoch_id | no | Optional id grouping related sessions into one long-running epoch, e.g. '2026-H2-ops'. | |
| previous_session_hash | no | Hash string returned when your previous session closed; supplying it chains this session to that one, proving continuity. | |
| declared_model_key | no | The model you run on, e.g. 'zai-coding-plan/glm-5.3'. Informational only — the kernel records but never trusts it. | |
| actor_signature | no | Cryptographic signature over the request, if your agent holds a key — proves the call genuinely came from actor_id. Omit if you have no key. | |
| nonce | no | One-time random string (e.g. a UUID) making this request unique; protects against replay of the same call. | |
| counterparty | no | JSON describing the other party in a two-agent exchange, e.g. {"agent_id": "hermes/1", "role": "verifier"}. | |
| context | no | JSON object of background facts to bind into the session, e.g. {"repo": "arifOS", "task": "fix-tests"}. | |
| evidence | no | JSON list of facts you have already verified, e.g. [{"fact": "pytest 299 passed", "source": "CI run"}] — carried into the session record. Also accepts a single object. | |
| tooling | no | JSON list of the tools you can use, e.g. ["Bash", "Read"] — lets the kernel scope what it will permit you. Also accepts an object like {"requested_capabilities": [...]}. | |
| agent_policy | no | JSON constraints on your own behavior, e.g. {"autonomy": "reversible_only", "forbidden": ["git push"]}. | |
| intent | string | yes | Required. Plain-language statement of what this session is for, e.g. 'repair the failing MCP tests'. A session without a stated purpose is refused (F1 Amanah). Recorded for audit. |
| requested_authority | string | no | The highest class of action you may take: 'OBSERVE_ONLY' (read-only, default) or a higher governed class granted by your policy. |
| verbose | no | Legacy on/off verbosity ('true'/'false'); prefer verbosity. | |
| verbosity | string | no | How detailed responses should be: 'minimal' (default), 'standard', or 'full'. |
| idempotency_key | no | Client-chosen key (e.g. 'job-42-attempt-1'). Retrying with the same key will not repeat the effect — safe retries on flaky networks. | |
| trace_id | no | Correlation id of your choosing (e.g. 'req-8f3a') — lets you find this call later across kernel logs and organ systems. |
KERNEL 111 · Collect evidence — facts and sources with epistemic tags (OBS) and uncertainty bounds, never conclusions. mode=search queries the open web/literature; mode=fetch retrieves a URL and records its provenance; mode=vitals reads kernel machine telemetry. Reason over what you gathered with arif_think; delegate domain analysis to an organ with arif_route. Modes: search, fetch, hybrid_discove
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | 'search' (default) — web/literature query; 'fetch' — retrieve one URL with provenance; 'hybrid_discovery' — combine sources; 'ingest' — absorb a document; 'compass'/'atlas' — guided navigation; 'entro |
| query | no | What to look for, in plain language, e.g. 'TDQS scoring rubric MCP'. | |
| session_id | no | Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session. | |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you. | |
| session_token | no | Session Continuity Token (SCT) — the credential string arif_init returned alongside session_id. Pass it back on follow-up calls to prove the session is yours; without it the kernel treats you as unaut | |
| url | no | Exact URL to retrieve when mode=fetch, e.g. 'https://example.com/report.pdf'. | |
| layers | no | Restrict where to look, e.g. ["web"] or ["canon", "memory"]; omit to search everything available. | |
| result_limit | integer | no | Maximum number of results to return in search modes; default 10. |
KERNEL 333 · Structured reasoning pass: decomposes a query and returns reasoning steps labeled OBS (observed), DER (derived), INT (interpretation), SPEC (specification) under truth floors. Produces reasoning records only — no verdicts (those come from arif_judge) and no state changes. The plan-family modes draft/review/approve execution plans; simulate and wonder explore counterfactuals. Modes: re
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | 'reason' (default) — decompose a question; 'reflect' — self-review of prior reasoning; 'verify' — check a derivation; 'axioms' — surface hidden assumptions; 'plan'/'plan_review'/'plan_approve'/'refact |
| query | no | The question, claim, or problem to reason about, in plain language. | |
| session_id | no | Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session. | |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you. | |
| session_token | no | Session Continuity Token (SCT) — the credential string arif_init returned alongside session_id. Pass it back on follow-up calls to prove the session is yours; without it the kernel treats you as unaut | |
| plan_id | no | Plan reference from an earlier plan-mode response — needed for the review/approve/refactor steps. | |
| witness_type | string | no | Who vouches for the reasoning record: 'ai' (default), 'human', or 'external' system. |
| concise | boolean | no | — |
KERNEL 444 · Intent→organ router: classifies a natural-language intent and dispatches it to the specialist organ (GEOX geoscience, WEALTH capital, WELL vitality, A-FORGE execution). Returns the routing decision only — no organ call — unless organ_tool names the target tool and arguments carries its inputs. Prefer this over guessing organs yourself; use arif_think for reasoning you keep in-kernel.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| intent | no | Natural-language description of what the user wants. e.g. "interpret this seismic section", "assess portfolio risk" | |
| mode | no | — | |
| organ | no | Optional explicit organ override. If provided, intent matching is skipped and this organ is used directly. | |
| task | no | Alias for intent (backward compat). | |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you. | |
| session_id | no | Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session. | |
| session_token | no | Session Continuity Token (SCT) — the credential string arif_init returned alongside session_id. Pass it back on follow-up calls to prove the session is yours; without it the kernel treats you as unaut | |
| organ_tool | no | The tool name on the target organ to call. If absent, returns routing decision only (no bridge call). | |
| arguments | no | Arguments to pass to organ_tool. | |
| mission_id | no | Explicit human-cockpit mission binding (investigate|interpret| decide|build|monitor|remember). When set, skips keyword classification and binds the six-mission plan. Preferred | |
| contract_c_kwargs | no | Extra keyword arguments passed through to the organ tool call, as a JSON object. |
KERNEL 555 · Governed memory of the kernel itself: six tiers (L1–L6) with per-mode gating. recall, inspect, and audit are read paths; remember, revise, promote, and forget mutate tiers — promote and forget additionally require human_approval=true. Use for cross-session lessons, canon, and memory audit; external evidence belongs to arif_observe and reasoning artifacts to arif_think. Modes: recall,
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | 'recall' (default) — semantic search of stored memories; 'inspect' — read one memory in full; 'attest' — vouch for a memory's accuracy; 'remember' — store new text; 'promote' — move a memory up a tier |
| query | no | What to search for, in plain language (mode=recall/audit), e.g. 'past deploy rollback steps'. | |
| memory_id | no | UUID of the memory entry to inspect/revise/forget — it was returned when the memory was created or last listed. | |
| content | no | The text to store (mode=remember) — write it as a self-contained lesson or fact. | |
| tier | no | Which memory tier to target, 'L1'–'L6' (L1 = hot working memory, L6 = sealed canon). | |
| to_tier | no | Destination tier when promoting, e.g. 'L4'. | |
| new_content | no | Replacement text for the memory (mode=revise) — must refer to the same memory_id. | |
| human_approval | boolean | no | Set true ONLY when the human owner explicitly approved this promote/forget — the gate refuses without it. |
| payload | no | Extra mode-specific fields as JSON — e.g. {"truth_class": "DERIVED", "provenance": "CI log"} for remember. | |
| session_id | no | Session id returned by arif_init; attributes this call to your governed session. | |
| session_token | no | Session Continuity Token (SCT) returned by arif_init — proves the session is yours. | |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' — recorded in the audit log. | |
| lease_id | no | Id of a short-lived permission grant (lease) authorizing this write, when one was issued to you. | |
| idempotency_key | no | Client-chosen key (e.g. 'memo-42'); retries with the same key will not store duplicates. | |
| trace_id | no | Correlation id of your choosing (e.g. 'req-8f3a') to find this call later in the logs. |
KERNEL 666 · Binding constitutional arbitration: evaluates a candidate action or claim and returns SEAL / HOLD / SABAR / VOID with the full reason chain. Weighs action class, blast radius, reversibility, entropy pathway, and cooling state; a SEAL verdict here is what arif_forge requires before it will execute anything. Judge arbitrates — it does not gather (evidence comes via arif_observe, reasoni
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | 'judge' (default) — render a verdict on candidate; 'intercept' — pre-flight gate before an action runs; 'validate' — re-check a prior verdict; 'hold' — place an action into a cooling period; 'escalate |
| candidate | no | The action or claim being judged, stated plainly, e.g. 'delete table users in prod'. | |
| session_id | no | Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session. | |
| session_token | no | Session Continuity Token (SCT) — the credential string arif_init returned alongside session_id. Pass it back on follow-up calls to prove the session is yours; without it the kernel treats you as unaut | |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you. | |
| constitutional_chain_id | no | Id of the evidence chain this call belongs to (observe→think→judge→seal). Copy it from the earlier step's response to link the steps together. | |
| vault_entry_id | no | Id of the permanent-ledger entry this verdict should attach to (from an earlier arif_seal response). | |
| cooldown_entry_id | no | Id of an existing cooling-period record to consult before this action may proceed. | |
| action_tier | string | no | How risky the action is: 'standard', 'high', or 'critical' — higher tiers demand stronger evidence. |
| heart_critique | no | JSON result of an ethics/dignity check, e.g. {"coercion": false, "dignity": 0.9} — feeds the verdict. | |
| niat_params | no | JSON intent-calibration settings, e.g. {"sincerity": 0.8, "stated_goal": "verify the claim"}. | |
| context_source | no | Where the candidate came from: 'session', 'file', or 'memory'. | |
| sovereign_receipt | no | Reference to the human owner's explicit approval, for the rare case where they have already decided directly. | |
| evidence | no | The facts the verdict should rest on — a JSON list like [{"fact": "tests pass", "source": "CI"}], or an object. | |
| actor_signature | no | Cryptographic signature over the request, if your agent holds a key — proves the call genuinely came from actor_id. Omit if you have no key. | |
| nonce | no | One-time random string (e.g. a UUID) making this request unique; protects against replay of the same call. | |
| key_id | no | Which of your registered keys produced actor_signature, e.g. 'key-1'. | |
| authority_token | no | — | |
| reversibility_level | no | How hard the action would be to undo: 'reversible', 'hard', or 'irreversible'. | |
| blast_radius | no | Who or what the action can affect: 'self', 'session', 'organ', or 'federation'. |
KERNEL 777 · Governed execution: applies a mutation through A-FORGE only when carrying a SEAL verdict (seal_verdict_id) from arif_judge and a live session. The manifest/query defines exactly what changes; mode=dry_run previews the plan without applying it. This is the only verb that executes general mutations — kernel memory writes go to arif_memory and permanent records to arif_seal.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | 'engineer' (default) — plan and apply the work; 'dry_run' — preview what would happen, nothing is applied; 'query' — read-only questions about the workspace; 'write' — write files; 'generate' — genera |
| manifest | string | no | Required for engineer (the default mode), write, and generate: the work order (usually JSON or markdown) describing exactly what to build or change — the more specific, the tighter the gate. mode=dry_ |
| seal_verdict_id | no | The SEAL verdict id arif_judge returned — without it, nothing is executed. | |
| approved_action_hash | no | Hash of the exact action that was judged — execution is refused if what you submit differs from it. | |
| query | no | The task in plain language when no manifest is supplied, e.g. 'restart the gateway service'. | |
| artifact_id | no | Id of an existing artifact (from an earlier forge or judge response) that this call operates on. | |
| session_id | no | Session id returned by arif_init; scopes this execution to your governed session. | |
| session_token | no | Session Continuity Token (SCT) returned by arif_init — proves the session is yours. | |
| ack_irreversible | boolean | no | Set true to confirm you accept this execution cannot be undone, when the judged action was irreversible. |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' — recorded in the audit log. | |
| constitutional_chain_id | no | Id of the evidence chain (observe→think→judge) that led to the SEAL — copy it from the judge response. | |
| judge_state_hash | no | Hash string from the arif_judge SEAL response — proves the verdict has not been tampered with. | |
| vault_entry_id | no | Id of the permanent-ledger entry linked to this execution, when one already exists. | |
| plan_id | no | Plan id from arif_think's plan mode, when executing an approved plan. | |
| arif_ack_id | no | Acknowledgment id from a prior step, for multi-step execution chains. |
KERNEL 999 · Append an entry to VAULT999, the immutable ledger — accepted entries can never be edited or removed; there is no unseal. Use for permanent records of verified outcomes, lessons, and session closure once a verdict exists. ack_irreversible=true is the explicit acknowledgment of permanence, and judge_state_hash binds the entry to the verdict that authorized it. Reversible changes belong
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | 'seal' (default) — append a permanent entry; 'verify' — check one entry; 'ledger' — read the ledger head; 'changelog' — recent appends; 'audit' — integrity check; 'session_close' — close out a session |
| payload | string | yes | The content to store forever, as a string (usually JSON-serialized) — the outcome, lesson, or record itself. Required for the write modes (seal, session_close); pure reads (verify, ledger, changelog, |
| session_id | no | Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session. | |
| actor_id | no | Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you. | |
| session_token | no | Session Continuity Token (SCT) — the credential string arif_init returned alongside session_id. Pass it back on follow-up calls to prove the session is yours; without it the kernel treats you as unaut | |
| actor_signature | no | Cryptographic signature over the request, if your agent holds a key — proves the call genuinely came from actor_id. Omit if you have no key. | |
| nonce | no | One-time random string (e.g. a UUID) making this request unique; protects against replay of the same call. | |
| constitutional_chain_id | no | Id of the evidence chain this call belongs to (observe→think→judge→seal). Copy it from the earlier step's response to link the steps together. | |
| judge_state_hash | no | Hash string from the arif_judge SEAL response — ties this entry to the verdict that authorized it. | |
| witness_type | string | no | Who witnessed the sealed fact: 'ai', 'human', or 'external' system. |
| drift_events | no | JSON list of deviations observed, e.g. [{"what": "schema drift", "where": "tools/list"}] — stored with the record. | |
| constitutional | no | JSON block of governance metadata (floors consulted, chain references) — normally built by the kernel, not by callers. | |
| seal_purpose | no | One sentence saying why this verdict/record must exist, e.g. 'closing deployment D-17'. Stored permanently alongside the record. | |
| ack_irreversible | boolean | no | Set true to confirm you understand sealed entries are PERMANENT — they can never be edited or removed. |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install arifOS — Constitutional AI Governance or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
—Grade not published
No rule-by-rule report on file for this release
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
This listing is an address its publisher runs, and you connect to it directly — this marketplace is not in the path. The scanner reads packages and public source, and an address is neither: the repository linked on this page is where this record was collected from, not a copy of what the address serves, so it is not graded in its place. So there is no grade — not a withheld one, an unmeasured one.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 2026.03.22.
2026.03.22
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish arifOS — Constitutional AI Governance can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.