MCP Fusion/Security and governance/Governance
Governance
Prove your connector stayed safe across releases: the capability lockfile, blast radius analysis, contract diffing, zero trust attestation and semantic probes turn the surface into a reviewed artifact.
An AI connector changes the moment someone edits a description, adds a field or renames a tool. MCP Fusion's governance layer makes those changes visible, reviewable and revertible, so the surface your agents call is an artifact with history, not a moving target.
The capability lockfile
mcpfusion lock
mcpfusion lock --check ./dist/server.jsmcpfusion lock hashes every behavioral surface: tool names, parameters, descriptions, middleware coverage, redaction paths. The result is mcpfusion.lock, a git diffable file. In CI, fusion lock --check fails the build when behavior drifts without a reviewed lockfile update. Pair it with the test harness from Testing and every change passes two gates.
Blast radius analysis
Entitlement scanning reads your bundle and reports what it can actually reach: filesystem, network, subprocess, eval, plus evasion heuristics that catch obfuscated access. It answers the question a security reviewer asks: what does this connector have permission to do?
Contract diffing
Every change to the surface is classified:
| Verdict | Meaning |
|---|---|
| BREAKING | A tool, parameter or field the agent relies on changed or vanished |
| RISKY | Semantics changed under the same signature |
| SAFE | Additive, descriptions clarified |
| COSMETIC | No behavioral meaning |
Self healing context rides on top of this: when a contract change breaks an agent's habit, the validation error carries the delta, so the agent corrects itself on the next turn instead of failing repeatedly.
Zero trust attestation
Every deployed bundle is signed with HMAC SHA256 and verified at runtime, so what runs on the Edge is byte for byte what passed your CI. Drift between the tested artifact and the running artifact is detected, not assumed away.
Semantic probes
Descriptions drift too. A semantic probe asks a judge model whether a tool's description still means what it meant when you locked it, and fails closed on drift. It catches the quiet rewrite that contract diffing classifies as SAFE but the agents experience as RISKY.
Where the console takes over
At runtime, governance continues in the Vinkius console for every deployed connector:
- The Access tokens view shows which clients use the connector and which tokens went stale
- The Security posture view grades coverage and shows unprotected servers
- The Request failures view separates agent, upstream and Vinkius caused errors
- The Connector policy view is the settings editor, including the global emergency halt
Governance is a pipeline, not a product tier: lockfile at build time, attestation at deploy, console controls at runtime. Every layer ships free with the framework and the free hosting.