One address. Every client you already use.
Claude, ChatGPT, Cursor, your own agents, a CLI, a desktop app — every one reaches the same governed endpoint. Each client uses its own authenticated session and grant, approved before it can use tools.
{
"mcpServers": {
"govna": {
"url": "https://agw.govna.io/mcp"
}
}
} An ordered OAuth and consent sequence
Every client completes the same six-step flow for its own session and grant before a single tool can be used.
- 01 Finding the sign-in details The client looks up how to sign in to Govna.
- 02 Starting sign-in A standard OAuth sign-in begins, in the browser, as a person.
- 03 Protecting the exchange PKCE secures the handoff so it cannot be intercepted in transit.
- 04 Checking the address We confirm the request is for this exact service before showing anyone an approval screen.
- 05 Picking what to allow A person sees the request and chooses the logins, the tools and the time limit.
- 06 Opening the session Their decision opens one session, limited to exactly what they picked.
Connect a client
Setup is per client. Governance is not — apps, logins, permission sets and rules are configured once and apply to every client below.
Any MCP client
Point any standards-compliant MCP client — CLI, desktop app, agent framework — at the same address.
Read guideChatGPT
Publish Govna as a workspace app in ChatGPT.
Read guideClaude
Add Govna as a custom connector in Claude.
Read guideCursor
Add Govna to Cursor’s mcp.json.
Read guideYour own agent
A custom agent speaks MCP over Streamable HTTP and inherits every rule.
Read guideCLI tools
Command-line assistants connect with the same OAuth flow.
Read guideDesktop apps
Desktop MCP clients get the same session boundary and receipts.
Read guideAnything else MCP-compatible
If it speaks MCP, the governed endpoint is all it needs.
Read guideEvery governed call becomes a signed event
Send governance events where you already watch. Each receipted call is delivered as a signed CloudEvents webhook, in order, with bounded retries until your endpoint acknowledges it.
{
"specversion": "1.0",
"id": "01J9WZ4N8QK7",
"type": "io.govna.call.receipted",
"source": "govna/audit",
"subject": "session-2214",
"time": "2026-08-25T14:03:07Z",
"datacontenttype": "application/json",
"data": {
"tool": "search_records",
"outcome": "allowed",
"receipt": "receipt-1041"
}
} Where to go next
Two readers, two different next steps.