Adoption

Agent Skills are supported by leading AI development tools.

VS Code Gemini CLI GitHub Goose Amp Cursor Claude Code Letta OpenCode Claude OpenAI Codex Factory VS Code Gemini CLI GitHub Goose Amp Cursor Claude Code Letta OpenCode Claude OpenAI Codex Factory

ariffazil/arif-mcp-governor

Name: arif-mcp-governor
Author: ariffazil

skills/arif-mcp-governor/SKILL.md

npx skillsauth add ariffazil/openclaw-workspace arif-mcp-governor

Clean

TrivyContainer and dependency vulnerability scanner

Clean

SemgrepStatic code analysis for vulnerabilities

Clean

mcp-scan (Snyk)Model Context Protocol security validation

Skipped

Snyk (dep)Open source security scanning

Skipped

Socket.devSupply chain security analysis

Skipped

VirusTotalMulti-engine malware detection

Skipped

CrowdStrikeAdvanced threat intelligence

Skipped

OSV-ScannerOpen Source Vulnerability database check

Skipped

OWASP Dep-Check

arif-mcp-governor

Governed MCP routing via arifOS F1-F13. Routes organ calls through arifOS kernel for C2+/IRREVERSIBLE tools.

Architecture

OpenClaw → arifOS MCP (8080) → arifOS F1-F13 judgment
                ↓ (on SEAL)
           GEOX (8081) / WEALTH (8082) / WELL (8083)

Risk Tiers

| Tier | Action | |------|--------| | readonly | Execute directly, log to VAULT999 | | c1 | arifOS pre-check, execute anyway | | c2 | arifOS SEAL required | | irreversible | arifOS SEAL + ack_irreversible required |

Tool Discovery

# List all registered organ tools
mcporter list --config /root/arifOS/CONFIG/mcporter.json

# List GEOX tools
mcporter list geox --schema

# List WEALTH tools
mcporter list wealth-organ --schema

Making Calls

Direct (for READONLY/C1 tools)

mcporter call geox.geox_well_analyze_sequence source=/data/well.las zone_top:=1000 zone_base:=2000 --config /root/arifOS/CONFIG/mcporter.json --output json

Governed (for C2/IRREVERSIBLE tools)

C2+ tools MUST be called via arifOS MCP first to get SEAL:

Call arif_judge on arifOS MCP (port 8080)
If verdict = SEAL → call the organ tool via mcporter
If verdict = HOLD → return HOLD to caller
If verdict = VOID → reject

Example flow for geox_prospect_judge_seal:

# Step 1: Get arifOS SEAL
curl -X POST http://localhost:8080/mcp -H "Content-Type: application/json" -d '{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "arif_judge",
    "arguments": {
      "mode": "judge",
      "candidate": "{\"action\":\"GEOX_ORGAN:geox_prospect_judge_seal\",\"description\":\"GEOX irreversible prospect judgment\"}",
      "actor_id": "openclaw"
    }
  }
}'

# Step 2: If verdict=SEAL → call organ
mcporter call geox.geox_prospect_judge_seal prospect_ref:=MY_PROSPECT ac_risk_score:=0.3 ack_irreversible:=true --config /root/arifOS/CONFIG/mcporter.json

Organ Endpoints

| Organ | URL | Risk Profile | |-------|-----|-------------| | geox | http://geox_eic:8081 | 30 tools, C2+ requires SEAL | | wealth-organ | http://wealth-organ:8082 | 33 tools, C2+ requires SEAL | | well | http://well:8083 | 14 tools, C1+ advisory |

Registered Servers (mcporter.json)

Located at: /root/arifOS/CONFIG/mcporter.json

Contains: context7, codegraphcontext, arifos, geox, wealth-organ, well

ariffazil/arif-mcp-governor

skills/arif-mcp-governor/SKILL.md

Governed MCP routing via arifOS F1-F13. All calls to GEOX, WEALTH, WELL organs must route through arifOS kernel for C2+/IRREVERSIBLE tools. Uses mcporter for stdio/HTTP bridging.

2 stars

tools

Updated Jul 10, 2026

$ install --global

skillsauth

npx skillsauth add ariffazil/openclaw-workspace arif-mcp-governor

Install this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.

Security Scan Results

3 of 9 scanners reported clean

Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.

Scanners Passed

Scanners in report

Clean

TrivyContainer and dependency vulnerability scanner

95%

Clean

SemgrepStatic code analysis for vulnerabilities

95%

Clean

mcp-scan (Snyk)Model Context Protocol security validation

95%

Skipped

Snyk (dep)Open source security scanning

50%

Skipped

Socket.devSupply chain security analysis

50%

Skipped

VirusTotalMulti-engine malware detection

50%

Skipped

CrowdStrikeAdvanced threat intelligence

50%

Skipped

OSV-ScannerOpen Source Vulnerability database check

50%

Skipped

OWASP Dep-Check

50%

Last scanned: Jul 10, 2026, 4:06 AM128.4s1 file scanned

SKILL.md

name:: arif-mcp-governor
description:: Governed MCP routing via arifOS F1-F13. All calls to GEOX, WEALTH, WELL organs must route through arifOS kernel for C2+/IRREVERSIBLE tools. Uses mcporter for stdio/HTTP bridging.
homepage:: https://arif-fazil.com
emoji:: 🫀
bins:: ["mcporter"]
- id:: node
kind:: node
package:: mcporter
label:: Install mcporter

arif-mcp-governor

Governed MCP routing via arifOS F1-F13. Routes organ calls through arifOS kernel for C2+/IRREVERSIBLE tools.

Architecture

OpenClaw → arifOS MCP (8080) → arifOS F1-F13 judgment
                ↓ (on SEAL)
           GEOX (8081) / WEALTH (8082) / WELL (8083)

Risk Tiers

Tool Discovery

# List all registered organ tools
mcporter list --config /root/arifOS/CONFIG/mcporter.json

# List GEOX tools
mcporter list geox --schema

# List WEALTH tools
mcporter list wealth-organ --schema

Making Calls

Direct (for READONLY/C1 tools)

mcporter call geox.geox_well_analyze_sequence source=/data/well.las zone_top:=1000 zone_base:=2000 --config /root/arifOS/CONFIG/mcporter.json --output json

Governed (for C2/IRREVERSIBLE tools)

C2+ tools MUST be called via arifOS MCP first to get SEAL:

Call arif_judge on arifOS MCP (port 8080)
If verdict = SEAL → call the organ tool via mcporter
If verdict = HOLD → return HOLD to caller
If verdict = VOID → reject

Example flow for geox_prospect_judge_seal:

# Step 1: Get arifOS SEAL
curl -X POST http://localhost:8080/mcp -H "Content-Type: application/json" -d '{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "arif_judge",
    "arguments": {
      "mode": "judge",
      "candidate": "{\"action\":\"GEOX_ORGAN:geox_prospect_judge_seal\",\"description\":\"GEOX irreversible prospect judgment\"}",
      "actor_id": "openclaw"
    }
  }
}'

# Step 2: If verdict=SEAL → call organ
mcporter call geox.geox_prospect_judge_seal prospect_ref:=MY_PROSPECT ac_risk_score:=0.3 ack_irreversible:=true --config /root/arifOS/CONFIG/mcporter.json

Organ Endpoints

Registered Servers (mcporter.json)

Located at: /root/arifOS/CONFIG/mcporter.json

Contains: context7, codegraphcontext, arifos, geox, wealth-organ, well

Related Skills

ariffazil/XAUUSD-trading-stack

development

VerifiedTrustedCommunity

Federation-wide gold (XAUUSD) trading capability. Python stack, OANDA broker, backtesting, macro signals, RSI strategy. Every organ has a role.

2SKILL.mdUpdated Jul 24, 2026

ariffazil/XAUUSD-trading-stack

ariffazil/wealth-claim-state

development

VerifiedTrustedCommunity

Capital claim state management — tracks claim lifecycle across WEALTH organ.

2SKILL.mdUpdated Jul 24, 2026

ariffazil/wealth-claim-state

ariffazil/warga-constitutional

development

VerifiedTrustedCommunity

Archived constitutional warga placeholder retained only for audit provenance. Do not use for active work; use the live arifOS governance and constitutional skills instead.

2SKILL.mdUpdated Jul 24, 2026

ariffazil/warga-constitutional

ariffazil/warga

testing

VerifiedTrustedCommunity

Warga (citizen) agent skills for AAA federation members. See subdirectories for specialized warga skills.

2SKILL.mdUpdated Jul 24, 2026

Download

For Claude Desktop. Download once, then upload the file in the app — no terminal needed.

Need help? View full Cowork setup guide →

Install manually

Choose your platform

# Clone the repo
git clone https://github.com/ariffazil/openclaw-workspace.git

# Copy into Claude Code skills folder (global)
cp -r openclaw-workspace/skills/arif-mcp-governor ~/.claude/skills/

Claude Code Skills — official skills path docs.

Repository

ariffazil/openclaw-workspace

2 stars

Compatible with

Claude Code

OpenAI Codex CLI

ChatGPT