# @connexum/ai-governance

> Enterprise governance for AI agents. Enforcement, not monitoring.
> The runtime layer of the [My Compliance Center](https://my-cc.io) trust citadel.

[![tests](https://img.shields.io/badge/tests-1615%20passing-brightgreen)]()
[![license](https://img.shields.io/badge/license-SEE%20LICENSE-blue)](LICENSE.md)

```bash
npx @connexum/ai-governance@latest init --vendor-code <YOUR_CODE>
```

That single command installs the runtime into the current project, exchanges your vendor code for a 1-year service token bound to your tenant, and wires 14 hook scripts into `.claude/hooks/` so every tool call your AI agent makes is intercepted before execution.

## The Problem

Your AI agents can read files, execute code, and access sensitive data. Without governance, a single misconfigured agent is a compliance violation waiting to happen. Regulators do not accept "we told the AI not to" as a control.

## What This Package Does

@connexum/ai-governance intercepts every tool call your AI agents make and enforces policy **before execution**. Unauthorized actions are blocked, not logged after the fact. The SDK wraps any LLM platform (Claude, OpenAI, Gemini, DeepSeek, Microsoft, Amazon, Meta) or orchestrator (Paperclip, CrewAI, AutoGen, LangGraph) with rule-based governance, compliance pack validation, and tamper-proof audit trails. Default-deny enforcement means nothing runs without an explicit allow rule.

## Installation

Public on the npm registry — no `.npmrc` auth, no GitHub token. Node.js 18 or higher is required.

The runtime is harmless without a vendor code; what binds it to your tenant is the one-time vendor code from the [signup wizard](https://app.my-cc.io/start).

```bash
# Option A — install + initialize in one command (recommended for new projects)
npx @connexum/ai-governance@latest init --vendor-code cxni_v1_XXXXXXXXXXXXXX

# Option B — let your AI assistant install it for you (no-terminal path)
# Open the /onboarding wizard at https://app.my-cc.io and click
# "Let your AI assistant install it" — paste the generated prompt into
# Claude Code / Cursor / Copilot Chat / ChatGPT.

# Option C — explicit two-step
npm install @connexum/ai-governance
npx @connexum/ai-governance init --vendor-code cxni_v1_XXXXXXXXXXXXXX
```

## Quick Start (SDK usage)

If you would rather call the SDK directly instead of running the hook installer:

```typescript
import { createGovernedAgent, createActionContext } from '@connexum/ai-governance';

const agent = createGovernedAgent({
  name: 'research-assistant',
  platform: 'claude', // or 'openai' (pending platform testing)
  packs: ['soc2', 'hipaa'],
  rules: [
    { tool: 'Read', decision: 'allow', reason: 'File reads permitted' },
    { tool: 'Bash', decision: 'deny', reason: 'Shell access prohibited' },
    { tool: 'Write', decision: 'require_approval', reason: 'Writes need review' },
  ],
});

const decision = await agent.execute(
  createActionContext('Bash', { command: 'rm -rf /' }, { name: 'research-assistant' })
);

console.log(decision); // { type: 'DENY', reason: 'Shell access prohibited' }
```

## Setup

**Single canonical entry point for all setup: [`docs/SETUP.md`](./docs/SETUP.md).** It covers customer integration (SDK + connector + hosted proxy + browser extension + endpoint scanner), Claude Code setup (hooks + Tier 8.7 sub-agents), claude.ai / remote MCP setup, IDE setup (VS Code / JetBrains / Cursor), and building the application from source.

For production deployment: [`docs/RAILWAY_DEPLOYMENT_PLAN.md`](./docs/RAILWAY_DEPLOYMENT_PLAN.md).

## Repository Structure

```
@connexum/ai-governance (monorepo)
|
+-- src/                          Core governance SDK
|   +-- governance/               Runtime, bias monitor, policy tuning, partner manager
|   +-- adapters/                 Platform + orchestrator adapters
|   +-- security/                 Encryption, data classification, tamper detection
|   +-- packs/                    Compliance pack definitions (75 packs; full catalog: docs/PACK_CATALOG.md)
|   +-- audit-bots/               Automated audit scheduling
|   +-- reporting/                Governance event reporter (SaaS streaming)
|   +-- cli/                      npx @connexum/ai-governance init
|
+-- packages/
|   +-- governance-server/        REST API sidecar (HTTP + WebSocket)
|   |   +-- src/                  60+ route modules, event store, RBAC, rate limiting
|   |   +-- tests/                278+ tests (TAP format, node:test)
|   |
|   +-- auth/                     JWT auth service (register, login, RBAC, MFA/TOTP)
|   +-- connector-sdk/            Three-line integration SDK (LangChain/CrewAI/AutoGen/OpenAI Agents)
|   +-- database/                 Prisma schema + PostgreSQL storage adapter
|   +-- governance-proxy/         LLM-call proxy with HTTP evaluator
|   +-- license-server/           License key validation and management
|   +-- mcp-server-trust/         MCP transport for cross-org passport lookup
|   +-- python-sdk/               Python client for LangGraph, CrewAI, AutoGen
|   +-- scoring/                  Python statistical scoring service (advisory, Invariant 2)
|   +-- trust-api/                Trust & Sovereignty API (passport issuance + cross-org lookup)
|   +-- typescript-sdk/           TypeScript SDK with adapter wrappers
|
+-- apps/
|   +-- dashboard/                Next.js web dashboard (My Compliance Center)
|       +-- src/app/(dashboard)/  20 customer routes (agents, compliance, trust-score, etc.)
|       +-- src/components/       Sidebar, command palette, ThreeAxisCard, TrustSignatureBadge
|       +-- src/lib/              API client, auth context, scoring-api, audit-chain SSE
|
+-- tests/                        1,025 core SDK tests
+-- docs/                         Architecture docs, build plans, strategy
+-- examples/                     Demo enforcement scripts
```

## Features

**Enforcement**
- Default-deny governance. Every tool call requires an explicit allow rule.
- Pre-action blocking. Unauthorized actions never execute.
- Circuit breaker with automatic agent suspension on anomaly detection.
- Human-in-the-loop approval queue with timeout and HMAC-verified decisions.
- Session timeout enforcement with HIPAA/PCI presets.
- Agent lifecycle management (registered, shadow testing, active, suspended, under review, decommissioned).

**Compliance Packs (75 packs across 24 jurisdictions)**

The runtime registry exports 75 compliance packs out of the box. Activate any subset via `packs: ['hipaa', 'soc2', ...]` when constructing your governed agent. Each pack ships pre-built classifiers, retention policies, incident workflows, and validators for its framework.

<details>
<summary><b>Click to expand: full 75-pack catalog (24 jurisdictions)</b></summary>

#### AU (13 packs)

| Pack ID | Name |
|---|---|
| `au-aiethics-framework` | Australia AI Ethics Framework + Voluntary AI Safety Standard |
| `au-aml-ctf` | AML/CTF Act 2006 + 2024 DNFBP Amendments |
| `au-asic-rg-271` | ASIC RG 271 Internal Dispute Resolution |
| `au-asic-rg-274` | ASIC Design and Distribution Obligations (DDO) |
| `au-cdr` | Consumer Data Right (CDR) Act 2019 |
| `au-cps230` | APRA CPS 230 Operational Risk Management |
| `au-cps234` | APRA CPS 234 Information Security |
| `au-mandatory-ai-guardrails` | DISR Mandatory AI Guardrails (Proposals Paper Sep 2024) |
| `au-online-safety` | Online Safety Act 2021 (Cth) |
| `au-privacy-act` | Australian Privacy Act 1988 (Cth) — APPs + NDB |
| `au-soci-act` | Security of Critical Infrastructure Act 2018 |
| `au-spam-act` | Spam Act 2003 (Cth) |
| `au-tga-saimd` | TGA Software as a Medical Device (SaMD) |

#### AU-ACT (1 pack)

| Pack ID | Name |
|---|---|
| `au-act-hrpaa` | ACT Health Records (Privacy and Access) Act 1997 (HRPAA) |

#### AU-NSW (1 pack)

| Pack ID | Name |
|---|---|
| `au-nsw-hripa` | NSW Health Records and Information Privacy Act 2002 (HRIPA) |

#### AU-VIC (1 pack)

| Pack ID | Name |
|---|---|
| `au-vic-hra` | VIC Health Records Act 2001 (HRA) |

#### Brazil (1 pack)

| Pack ID | Name |
|---|---|
| `lgpd` | LGPD (Brazil) |

#### Canada (1 pack)

| Pack ID | Name |
|---|---|
| `ca-pipeda` | PIPEDA (Canada — Federal) |

#### Canada (Quebec) (1 pack)

| Pack ID | Name |
|---|---|
| `ca-qc-law25` | Quebec Law 25 |

#### China (1 pack)

| Pack ID | Name |
|---|---|
| `pipl` | PIPL (China) |

#### EU (5 packs)

| Pack ID | Name |
|---|---|
| `dora` | Digital Operational Resilience Act |
| `eu-ai-act` | EU AI Act |
| `eu-ai-liability` | EU AI Liability (PLD 2024) |
| `gdpr` | General Data Protection Regulation |
| `mifid2` | MiFID II / MiFIR |

#### Global (4 packs)

| Pack ID | Name |
|---|---|
| `iso_42001` | ISO/IEC 42001 |
| `iso-23894` | ISO/IEC 23894 (AI Risk Management) |
| `iso27001` | ISO/IEC 27001 |
| `pci-dss` | Payment Card Industry Data Security Standard |

#### Global (FDA, EMA, ICH) (1 pack)

| Pack ID | Name |
|---|---|
| `gxp` | GxP (GMP/GLP/GCP) |

#### Global (HK/UK primary) (1 pack)

| Pack ID | Name |
|---|---|
| `lpo2024` | LPO 2024 AI Disclosure (Legal Practitioners) |

#### Japan (1 pack)

| Pack ID | Name |
|---|---|
| `appi` | APPI (Japan) |

#### US (33 packs)

| Pack ID | Name |
|---|---|
| `bsa-aml` | BSA / AML |
| `cfpb-2023-03` | CFPB Circular 2023-03 |
| `cjis` | CJIS Security Policy v5.9.5 |
| `cmmc2` | CMMC 2.0 (Level 2) |
| `common-rule` | Common Rule (Human Subjects Research Protection) |
| `coppa` | COPPA (Children's Online Privacy Protection Act) |
| `ecoa` | ECOA / Regulation B (Equal Credit Opportunity Act) |
| `fcra` | Fair Credit Reporting Act |
| `fda-samd` | FDA SaMD (AI/ML) |
| `fedramp` | FedRAMP (Rev 5) |
| `ferpa` | FERPA (Student Privacy) |
| `foia` | FOIA (5 USC 552) |
| `frcp26` | FRCP Rule 26 (E-Discovery) |
| `ftc5` | FTC Act §5 |
| `glba` | Gramm-Leach-Bliley Act |
| `hipaa` | Health Insurance Portability and Accountability Act |
| `hitech` | HITECH Act |
| `hmda` | Home Mortgage Disclosure Act |
| `naic-mdl` | NAIC MDL-668 (Insurance Data Security) |
| `nist_ai_rmf` | NIST AI Risk Management Framework |
| `part2` | 42 CFR Part 2 (SUD Records) |
| `soc2` | SOC 2 Type II |
| `sox404` | SOX 404 |
| `sr11-7` | SR 11-7 Model Risk Management |
| `title-ix` | Title IX (Sex Discrimination in Federally-Funded Education) |
| `us-fda-21cfr56` | FDA 21 CFR Part 56 (IRB Regulations) |
| `us-nih-coc` | NIH Certificate of Confidentiality Policy |
| `us-nih-dms` | NIH Data Management and Sharing Policy (2023) |
| `us-nih-gds` | NIH Genomic Data Sharing Policy |
| `us-nih-it-security` | NIH IT Security Policy (FISMA Moderate) |
| `us-respa` | Real Estate Settlement Procedures Act |
| `us-tila` | TILA / Regulation Z (Non-TRID Provisions) |
| `us-trid` | TRID (TILA-RESPA Integrated Disclosure) |

#### US (California) (1 pack)

| Pack ID | Name |
|---|---|
| `ccpa` | CCPA / CPRA |

#### US (Colorado) (1 pack)

| Pack ID | Name |
|---|---|
| `colorado-ai` | Colorado AI Act |

#### US (FDA); EU Annex 11 equivalent (1 pack)

| Pack ID | Name |
|---|---|
| `part11` | 21 CFR Part 11 |

#### US (Florida) (1 pack)

| Pack ID | Name |
|---|---|
| `florida-student-privacy` | Florida Student Privacy (State Overlay) |

#### US (ISAE 3402 international equivalent) (1 pack)

| Pack ID | Name |
|---|---|
| `soc1` | SOC 1 / SSAE 18 |

#### US (Illinois, extraterritorial) (1 pack)

| Pack ID | Name |
|---|---|
| `bipa` | Illinois BIPA |

#### US (New York City) (1 pack)

| Pack ID | Name |
|---|---|
| `nyc-ll-144` | NYC LL 144 (AEDT Bias Audit) |

#### US (New York) (1 pack)

| Pack ID | Name |
|---|---|
| `nydfs500` | NY DFS 23 NYCRR Part 500 |

#### US (state bar adoption varies) (1 pack)

| Pack ID | Name |
|---|---|
| `aba` | ABA Model Rules (Opinion 512) |

#### US (state) (1 pack)

| Pack ID | Name |
|---|---|
| `stateramp` | StateRAMP |

</details>

Pack registry capabilities: activation, composition, shadow mode (test new policies without blocking), scoring, policy history timeline, automated JSON compliance report generation.

Full per-pack descriptions: [`docs/PACK_CATALOG.md`](./docs/PACK_CATALOG.md).

**Multi-LLM Adapter Architecture**
- Claude adapter is production-verified today. OpenAI, Gemini, DeepSeek, Microsoft, Amazon, and Meta adapters are interface-level and pending platform testing (see ROADMAP).
- Orchestrator adapters for Paperclip, CrewAI, AutoGen, and LangGraph.
- Python SDK (`connexum-governance`) with native integrations.
- Agent identity verification via HMAC-SHA256 tokens.

**Dashboard (19 Routes)**
- Fleet overview with real-time WebSocket event streaming.
- Agent profiles with health metrics, drift detection, and lifecycle controls.
- Risk heat map with drill-into detail panels.
- Compliance center with pack validation, evidence bundles, and report generation.
- BAA tracker for HIPAA Business Associate Agreement management.
- Vendor/provider compliance aggregation across platforms.
- Bias monitor (EU AI Act Art. 9) with OOD detection.
- State-level regulatory tracker (8 US state AI laws seeded).
- Governance maturity self-assessment scorecard (5 dimensions, 20 questions).
- Scheduled report delivery (daily/weekly/monthly/quarterly).
- Budget management with threshold-based alerts and projections.
- Audit log with full-text search, filtering, and pagination.
- Approval queue with real-time notifications.
- Settings (org, users, webhooks, notifications).
- Global search (Cmd+K) across agents and routes.
- Dynamic breadcrumbs and status bar.

**Audit**
- Tamper-proof audit chains with SHA-256 hash-linked entries.
- Chain verification endpoint for integrity checks.
- Evidence bundle generation with cryptographic proof.
- SIEM integration via webhooks (Splunk HEC, Datadog, Elastic, syslog RFC 5424).
- Event bus with typed event streaming.

**Security**
- AES-256-GCM encryption at rest with key versioning and rotation.
- SHA-256 tamper detection on governance configuration.
- SSRF guard on all outbound requests.
- Rate limiting on auth and governance endpoints.
- Input validation on all API payloads.
- CORS scoped to configured origins (not wildcard).
- JWT auth with refresh tokens and RBAC (viewer, operator, org_admin, super_admin).
- Cross-agent anomaly correlation.

**EU AI Act**
- Art. 5 prohibited practices detection.
- Art. 9 bias monitoring with chi-square analysis and out-of-distribution detection.
- Art. 13/50 transparency injection and content labeling.
- Art. 72 post-market performance monitoring and drift alerts.

## Compliance Packs

| Pack | Framework | Coverage |
|------|-----------|----------|
| `hipaa` | HIPAA | PHI detection, access audit trails, encryption requirements, BAA tracking, breach notification (60-day) |
| `soc2` | SOC 2 Type II | Access controls, audit logging, change management, incident response |
| `gdpr` | GDPR | Data subject rights (Art. 15-22), PII classification, retention policies, 72-hour breach notification |
| `pci-dss` | PCI DSS | PAN detection, encryption validation, access restrictions, transaction audit |
| `eu-ai-act` | EU AI Act | Risk classification, prohibited practices, transparency obligations, post-market monitoring |
| `iso27001` | ISO 27001 | Information security controls, risk assessment, access management, incident handling |
| `dora` | DORA | ICT risk management, incident reporting (4-hour), resilience testing, third-party oversight |
| `nist_ai_rmf` | NIST AI RMF | AI risk management, governance, mapping, measurement, management functions |
| `iso_42001` | ISO 42001 | AI management systems, responsible AI, organizational AI governance |

## Governance Server API

The governance server runs as an HTTP sidecar on port 3200 (configurable). Key endpoint groups:

| Group | Endpoints | Purpose |
|-------|-----------|---------|
| Governance | `check-action`, `check-task`, `check-plan`, `check-delegation` | Real-time policy enforcement |
| Agent Registry | CRUD, transitions, risk assessment, BAA, vendor aggregation | Agent lifecycle management |
| Compliance | Pack listing, validation, shadow mode, policy history | Framework compliance |
| Events | Search, stats, batch ingestion | Audit trail and analytics |
| Reports | Evidence bundles, compliance reports, scheduled delivery | Compliance reporting |
| Bias | Sample recording, assessment, OOD detection | EU AI Act Art. 9 |
| Regulatory | State law tracking, deadlines, agent-state mappings | US state AI law compliance |
| Budgets | Configuration, status, alerts, acknowledgment | Cost governance |
| Settings | Org, users, webhooks, notifications | Platform configuration |
| Auth | Register, login, refresh, RBAC | Identity and access |

## Python SDK

```bash
pip install connexum-governance
```

```python
from connexum_governance import GovernanceClient

client = GovernanceClient(base_url="http://localhost:3200")

decision = client.check_action(
    tool_name="execute_query",
    agent_name="data-analyst",
    input_data={"query": "SELECT * FROM users"}
)

if decision.allowed:
    # proceed with tool execution
    pass
```

Integrations for LangGraph, CrewAI, and AutoGen are included. See `packages/python-sdk/README.md`.

## Architecture

Three enforcement layers run on every agent tool call.

1. **Ingress** classifies inbound data and redacts / refuses PHI, PII, or PAN per the active pack. (`src/classification/`)
2. **Verification** verifies the on-disk governance policy against a SHA-256 manifest, enforces the per-agent tool allowlist, and enforces per-cycle token / time / cost budget. (`src/governance/governance-runtime.ts`)
3. **Egress** runs the **Nine Guards** on every outbound action. See [`docs/NINE-GUARDS.md`](./docs/NINE-GUARDS.md) for the canonical guard-by-guard reference.

**The Nine Guards (egress):**

| # | Guard | Fires on | Default verdict |
|---|---|---|---|
| 1 | Data Exfiltration Scanner | PHI / PII / PAN in output | BLOCK |
| 2 | Secret Leak Scanner | API keys, tokens, credentials in output | BLOCK |
| 3 | File Boundary Guard | Path traversal, governance-file writes | BLOCK |
| 4 | Destructive Command Guard | `rm -rf`, `DROP TABLE`, force-push | BLOCK |
| 5 | Web Access Gate | Disallowed host, SSRF, private-range | BLOCK |
| 6 | Cost and Budget Guard | Token / time / USD cap exceeded | BLOCK |
| 7 | Prohibited-Practices Guard | EU AI Act Art. 5, ECOA bases, pack forbidden | BLOCK |
| 8 | Confidence Gate | Confidence below pack floor | BLOCK or ROUTE_TO_APPROVAL |
| 9 | Approval Queue (HITL T2) | Flagged or mandatory-review action | WAIT for named reviewer |

Every guard outcome, allow or block or route, writes a SHA-256-linked event to the audit chain with `guardId`, `reasonCode`, `verdict`, `packBinding`, `retentionTier`, `prevHash`, and an HMAC signature.

**Deployment view:**

```
Your Agent Code (any language)
      |
      v
Governance Server (HTTP sidecar, port 3200)
      |
      +-- GovernedAgent engine (rules, packs, audit)
      +-- Platform Adapters (Claude, OpenAI, Gemini, etc.)
      +-- Orchestrator Adapters (Paperclip, CrewAI, AutoGen, LangGraph)
      +-- WebSocket server (real-time event streaming)
      +-- Event Store (in-memory or PostgreSQL)
      |
      v
Dashboard (Next.js, port 3000)
      |
      +-- 19 routes: agents, compliance, risk, audit, approvals, settings, budgets
      +-- Real-time updates via WebSocket
      +-- All data from API (zero hardcoded mock data)
```

## Development

```bash
# Install dependencies
npm install

# Run core tests (1,025 tests)
npx tsx --test tests/*.test.ts

# Run governance server tests (590 tests, includes 11 pentest suites)
npx tsx --test packages/governance-server/tests/*.test.ts

# Run auth tests (45 tests)
npx tsx --test packages/auth/tests/*.test.ts

# Run license server tests (9 tests)
npx tsx --test packages/license-server/tests/*.test.ts

# Build dashboard
cd apps/dashboard && npx next build

# Start governance server
cd packages/governance-server && npx tsx src/index.ts

# Start dashboard dev server
cd apps/dashboard && npx next dev
```

## Environment Variables

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `PORT` | No | `3200` | Governance server port |
| `API_TOKEN` | No | (empty) | Bearer token for API auth |
| `JWT_SECRET` | Yes (32+ chars) | (empty) | JWT signing secret. Must be distinct from all other secrets. |
| `TRUST_ANCHOR_HMAC` | Yes (32+ chars) | (empty) | HMAC key for audit-chain trust anchors. Must be distinct from all other secrets. |
| `ENCRYPTION_KEY` | Yes (32+ chars) | (empty) | AES-256-GCM master key for at-rest encryption. Must be distinct from all other secrets. |
| `APPROVAL_SECRET` | Required if any pack uses `approval-queue` | (empty) | HMAC key for HITL approval tokens. Boot fails if required but absent or under 32 chars. Must be distinct from all other secrets. |
| `LLM_LIST_REFRESH_KEY` | Yes (32+ chars) | (empty) | HMAC key for `DestinationsRefreshManager`. Boot fails if absent or under 32 chars. Must be distinct from all other secrets. |
| `DESTINATIONS_HMAC_SECRET` | Required for on-demand refresh | (empty) | HMAC key to verify incoming LLM manifest signatures. |
| `DESTINATIONS_MANIFEST_URL` | Required for on-demand refresh | (compile-time value) | URL of the signed destination manifest. Compile-time only, no runtime override. |
| `DESTINATIONS_STALE_THRESHOLD_MS` | No | `86400000` | Milliseconds before destination list is flagged stale. |
| `DATABASE_URL` | No (required for Phase 2A) | (empty) | PostgreSQL connection string. |
| `HIPAA_MODE` | No | `false` | Enforce HIPAA session timeouts (15-min). |
| `DEFAULT_DENY` | No | `true` | Block unmatched tool calls. |
| `HITL_ENABLED` | No | `true` | Enable human-in-the-loop approvals. |
| `ALLOWED_ORIGINS` | No | `localhost:3000,3100` | CORS allowed origins. |
| `NEXT_PUBLIC_API_URL` | No | `http://localhost:3200` | Dashboard API base URL. |

> **Secret distinctness rule (enforced at boot):** `JWT_SECRET`, `TRUST_ANCHOR_HMAC`, `ENCRYPTION_KEY`, `APPROVAL_SECRET`, and `LLM_LIST_REFRESH_KEY` must all be distinct values. The server refuses to start if any two of these five secrets share the same value.

## Test Summary

| Package | Tests | Status |
|---------|-------|--------|
| Core SDK (`tests/`) | 1,025 | Passing |
| Governance Server | 295 | Passing |
| Auth Service | 45 | Passing |
| License Server | 9 | Passing |
| **Total** | **1,374** | **All passing** |

## Dashboard Routes

| Route | Description |
|-------|-------------|
| `/` | Fleet overview with summary cards and event feed |
| `/agents` | Agent list with status, platform, risk tier |
| `/agents/[id]` | Agent profile with health, drift, governance, transitions |
| `/agents/registry` | Agent registration wizard |
| `/risk` | Risk heat map with drill-into panels |
| `/compliance` | Compliance center with pack scores and report generation |
| `/compliance/baa` | BAA tracker with inline status editing |
| `/compliance/bias` | Bias monitor (EU AI Act Art. 9) |
| `/compliance/vendors` | Vendor/provider compliance aggregation |
| `/compliance/maturity` | Governance maturity self-assessment |
| `/compliance/schedules` | Scheduled report delivery configuration |
| `/compliance/regulatory` | US state AI law tracker |
| `/budgets` | Budget management with alerts and projections |
| `/approvals` | Approval queue with real-time updates |
| `/audit` | Audit log with search and filtering |
| `/settings` | Org, users, webhooks, notifications |
| `/login` | Authentication |

## Pricing

| Tier | Agents | Price |
|------|--------|-------|
| Free Scanner | 0 | $0 (score only, email for full report) |
| Professional | 25 | $500-$1,000/mo |
| Enterprise | 100 | $3,000-$5,000/mo |
| Usage-Based | Custom | $50/agent/mo |
| Air-Gapped | Unlimited | $50,000+/year |

## Documentation

Full SDK reference, compliance guides, and integration tutorials at [docs.my-cc.io](https://docs.my-cc.io).

## License

SEE LICENSE IN [LICENSE.md](LICENSE.md)

Copyright 2026 Connexum Network Inc.
