Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.
Enforce compliance policies on AI generated code in your GitHub workflows.
72 policy packs. 532 rules. 13 languages. Violations appear as GitHub Code Scanning annotations on pull requests.
Add this to .github/workflows/korext.yml:
name: Korext Enforcement
on: [push, pull_request]
permissions:
contents: read
security-events: write
jobs:
enforce:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: Korext/enforce-action@v3
with:
api-token: ${{ secrets.KOREXT_API_TOKEN }}
Korext scans your code on every push and PR using the default web policy pack.
korext enforce against your codebase with the selected policy packViolations appear as annotations directly on the PR diff, powered by GitHub Code Scanning.
| Input | Description | Required | Default |
|---|---|---|---|
directory | Directory to scan for policy violations | No | . |
pack | Policy Pack ID to enforce | No | web |
api-token | Korext API token for authenticated mode | No | (anonymous) |
fail-on-violations | Fail workflow on critical/high violations | No | true |
sarif-upload | Upload SARIF to GitHub Code Scanning | No | true |
region | Data processing region (us, eu, apac) | No | (default) |
sign-bundles | Request signed proof bundles | No | true |
| Output | Description |
|---|---|
violations | Total number of policy violations found |
sarif-file | Path to the generated SARIF results file |
bundle-count | Number of proof bundles generated |
bundles-signed | Number of signed proof bundles |
bundle-ids | Comma separated list of proof bundle IDs |
- uses: Korext/enforce-action@v3
with:
pack: web,pci-dss-v1,owasp-v1
api-token: ${{ secrets.KOREXT_API_TOKEN }}
- uses: Korext/enforce-action@v3
with:
pack: gdpr-v1
region: eu
api-token: ${{ secrets.KOREXT_API_TOKEN }}
- uses: Korext/enforce-action@v3
with:
directory: src/
pack: hipaa-v1
api-token: ${{ secrets.KOREXT_API_TOKEN }}
- uses: Korext/enforce-action@v3
with:
pack: web
fail-on-violations: 'false'
For full access to all policy packs and signed proof bundles, create an API token in your KOREXT dashboard and add it as a GitHub secret:
KOREXT_API_TOKEN in your repo's Settings > Secrets and variables > ActionsWithout a token, the action runs in anonymous mode (20 requests per hour, limited packs).
Proprietary. See Terms of Service.
Source-derived launch command. Check the maintainer’s required arguments and credentials before running:
npx -y korextMerge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.
{
"mcpServers": {
"io-github-korext-governance": {
"command": "npx",
"args": [
"-y",
"korext"
]
}
}
}Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.
Claude Desktop setup referencekorextnpmKorext: AI Code Governance works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.
~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.~/.cursor/mcp.jsonRestart Cursor for changes to take effect..vscode/mcp.jsonReload VS Code window for changes to take effect.~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect..mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.