Connect an agent to the Governor

This guide is part of the User Guides collection. It covers Inspect › Governor › Agents and the Connect an agent panel. For what the governor decides and why, see the Governor product page.

Your Coverbase representative turns on Agent Governor for your organization.

Every agent the governor decides for is one governor agent with its own key. You register the agent once, then connect it the way that fits how it is built.

Pick how the agent connects

The agent is	Connect it with	Guide
Claude Code, Claude Desktop, Cursor or VS Code	The governor’s MCP endpoint and a config snippet, or OAuth sign-in	MCP clients below
Written in Python	The `coverbase-governor` package	Python SDK
Written in TypeScript or JavaScript	The `@coverbase/governor` package	TypeScript SDK
Written in any other language	The HTTP API	HTTP below
A Copilot Studio agent or a Power Automate flow	The Coverbase Agent Governor connector	Copilot Studio
An Agentforce agent	The Coverbase Agent Governor package	Agentforce
A Now Assist AI agent, a flow or a script in ServiceNow	The Coverbase Agent Governor app	ServiceNow

Register the agent

Open Inspect › Governor › Agents and select Register agent.
Enter a Name that matches the agent, for example reporting-bot or copilot-studio-hr.
Choose the Tier and what it Signs in with: a key, or a workload identity (OIDC or SPIFFE) for agents that run in CI or Kubernetes.
Select Register.

The Connect an agent panel opens with the key. It is shown once: copy it before you close the panel. If you lose it, open the agent and select Rotate key.

Agents list — Agents: every governor agent, its tier, how it signs in, its load and deny rate.

The Connect an agent panel

Pick a group, then the client. The snippet already holds this agent’s key and your Coverbase address.

Group	Clients
MCP client	Claude Code, Claude Desktop, Cursor, VS Code
Code	Python SDK, TypeScript SDK, OpenAI, LangGraph, HTTP
Platform	Copilot Studio, Agentforce, ServiceNow, each with a Setup guide link

MCP client
Code
Platform

Connect panel with the Claude Code snippet — MCP client, Claude Code: one command adds the governor as an MCP server.

Connect panel with the Cursor snippet — MCP client, Cursor: paste into .cursor/mcp.json.

At the bottom, a line waits for the agent’s first call and turns green when it arrives.

MCP clients

Claude Code
Cursor
VS Code
Claude Desktop

claude mcp add --transport http coverbase https://api.coverbase.app/v1/governor/mcp --header "Authorization: Bearer $COVERBASE_GOVERNOR_KEY"

.cursor/mcp.json

{
  "mcpServers": {
    "coverbase": {
      "url": "https://api.coverbase.app/v1/governor/mcp",
      "headers": { "Authorization": "Bearer cbbk.cbbagt_xxxxxx.your-secret" }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "coverbase": {
      "type": "http",
      "url": "https://api.coverbase.app/v1/governor/mcp",
      "headers": { "Authorization": "Bearer ${input:coverbase-key}" }
    }
  },
  "inputs": [{ "type": "promptString", "id": "coverbase-key", "description": "Coverbase governor key", "password": true }]
}

claude_desktop_config.json

{
  "mcpServers": {
    "coverbase": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.coverbase.app/v1/governor/mcp", "--header", "Authorization:${COVERBASE_AUTH}"],
      "env": { "COVERBASE_AUTH": "Bearer cbbk.cbbagt_xxxxxx.your-secret" }
    }
  }
}

Each target the agent can reach becomes a tool. Instead of a key, any of these clients can add https://api.coverbase.app/v1/governor/mcp as a remote MCP server and sign in with your Coverbase account. See Sign in from an MCP client.

Plain HTTP

Any language can call the runtime API directly:

curl -s https://api.coverbase.app/v1/governor/runtime/actions \
  -H "Authorization: Bearer $COVERBASE_GOVERNOR_KEY" -H "Content-Type: application/json" \
  -d '{"target_id": "cbbtgt_xxxxxx", "mode": "execute", "request": {"kind": "sql", "sql": "SELECT 1"}}'

The response has a verdict of allow, hold or deny. On hold, poll GET /v1/governor/runtime/approvals/{approval_id} until its status is no longer pending, then send the identical request again with approval_id set. GET /v1/governor/runtime/whoami lists the targets the agent can reach.

Approve a held action

When a policy holds an action, the approvers are paged by email and Slack. Open Inspect › Governor › Approvals:

Approve once runs that exact statement or request one time, for the person the agent acted for. A different statement waits for its own approval.
Approve equal actions for a window runs any statement of the same shape until it closes.
Decline refuses only the statement you saw.

Use J and K to move through the queue, A to approve once and D to decline.

Approvals queue with a held action selected — Approvals: the held statement, its intent and risk, and the approve once and window legend.

Read the trail

Inspect › Governor › Activity shows every decision. Filter by verdict, agent or target, and open a decision to see each step: who signed in, the person it acted for, the intent and risk, the rule that matched, the approval and the masked fields.

Activity view with a decision opened — Activity with a decision opened.

Scope a rule to one agent

A rule can name the agents it applies to. A rule that names agents does not apply to any other agent, so a baseline for one agent keeps every other agent off that target and out of their tool lists. Set it in the rule editor’s Agents field under Inspect › Governor › Policies.

Rules on a target, including an agent-scoped rule — Policies: the rules on a target, including one scoped to a single agent.

Rule editor with the Agents field set — The rule editor with Agents set to one agent, and the replay of recent decisions under the change.

Start here

Workspace setup

Vendors

Third-party lifecycle

Agent Governor

Assessments

Findings and obligations

Vendor intelligence

Monitoring

Marketing compliance

Risk

DORA Register

Contracts

E-signature

Documents

Workflows and automation

Dashboards and reporting

Sourcing

Internal controls

Coverbase AI

Connect an agent to the Governor

Pick how the agent connects

Register the agent

The Connect an agent panel

MCP clients

Plain HTTP

Approve a held action

Read the trail

Scope a rule to one agent

​Pick how the agent connects

​Register the agent

​The Connect an agent panel

​MCP clients

​Plain HTTP

​Approve a held action

​Read the trail

​Scope a rule to one agent

Pick how the agent connects

Register the agent

The Connect an agent panel

MCP clients

Plain HTTP

Approve a held action

Read the trail

Scope a rule to one agent