> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an agent to the Governor

> Register an agent, pick how it connects (an MCP client, the Python or TypeScript SDK, plain HTTP, or Copilot Studio, Agentforce or ServiceNow), confirm its first call, approve a held action and read the trail.

For AI agents: a documentation index is available at [https://docs.coverbase.com/llms.txt](https://docs.coverbase.com/llms.txt). This page is also available in markdown by appending .md to the URL.

> [!NOTE]
>
> This guide is part of the [User Guides](https://docs.coverbase.com/user-guides/overview.md) collection. It covers **Inspect › Governor › Agents** and the **Connect an agent** panel. For what the governor decides and why, see the [Governor](https://docs.coverbase.com/products/agent-governor.md) product page.

> [!NOTE]
>
> Your Coverbase representative turns on Agent Governor for your organization.

Every agent the governor decides for is one governor agent with its own key. You register the agent once, then connect it the way that fits how it is built.

## Pick how the agent connects

| The agent is | Connect it with | Guide |
| - | - | - |
| Claude Code, Claude Desktop, Cursor or VS Code | The governor's MCP endpoint and a config snippet, or OAuth sign-in | [MCP clients](#mcp-clients) below |
| Written in Python | The `coverbase-governor` package | [Python SDK](https://docs.coverbase.com/user-guides/agent-governor-python.md) |
| Written in TypeScript or JavaScript | The `@coverbase/governor` package | [TypeScript SDK](https://docs.coverbase.com/user-guides/agent-governor-typescript.md) |
| Written in any other language | The HTTP API | [HTTP](#plain-http) below |
| A Copilot Studio agent or a Power Automate flow | The Coverbase Agent Governor connector | [Copilot Studio](https://docs.coverbase.com/user-guides/agent-governor-copilot-studio.md) |
| An Agentforce agent | The Coverbase Agent Governor package | [Agentforce](https://docs.coverbase.com/user-guides/agent-governor-agentforce.md) |
| A Now Assist AI agent, a flow or a script in ServiceNow | The Coverbase Agent Governor app | [ServiceNow](https://docs.coverbase.com/user-guides/agent-governor-servicenow.md) |

## Register the agent

1. Open **Inspect › Governor › Agents** and select **Register agent**.
2. Enter a **Name** that matches the agent, for example `reporting-bot` or `copilot-studio-hr`.
3. Choose the **Tier** and what it **Signs in with**: a key, or a workload identity (OIDC or SPIFFE) for agents that run in CI or Kubernetes.
4. Select **Register**.

![Register agent drawer](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-register-agent.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=17b882bd8d7b7acaa0c63a889f7650dc)

Register agent.

The **Connect an agent** panel opens with the key. It is shown once: copy it before you close the panel. If you lose it, open the agent and select **Rotate key**.

![Agents list](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-agents-list.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=169ce2690a512966759565f2c2c9fc87)

Agents: every governor agent, its tier, how it signs in, its load and deny rate.

## The Connect an agent panel

Pick a group, then the client. The snippet already holds this agent's key and your Coverbase address.

| Group | Clients |
| - | - |
| **MCP client** | Claude Code, Claude Desktop, Cursor, VS Code |
| **Code** | Python SDK, TypeScript SDK, OpenAI, LangGraph, HTTP |
| **Platform** | Copilot Studio, Agentforce, ServiceNow, each with a **Setup guide** link |

> [tab] MCP client
>
> ![Connect panel with the Claude Code snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-claude-code.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=9385be417217275b164d38ed48e5ac3f)
>
> MCP client, Claude Code: one command adds the governor as an MCP server.
>
> ![Connect panel with the Cursor snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-cursor.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=7c8b2276456dc1908c566ad50f99bd0b)
>
> MCP client, Cursor: paste into .cursor/mcp.json.

> [tab] Code
>
> ![Connect panel with the Python SDK snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-python.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=9351c00e25ed29984cc06c2bcb489600)
>
> Code, Python SDK.
>
> ![Connect panel with the TypeScript SDK snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-typescript.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=75ca6b33041d4d9cda8ca19413a8dd46)
>
> Code, TypeScript SDK.
>
> ![Connect panel with the OpenAI snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-openai.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=d5930bb756d6d7924aeab900b4cde0db)
>
> Code, OpenAI Agents SDK over MCP.
>
> ![Connect panel with the LangGraph snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-langgraph.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=50e14fbcad9545aac2de2d8d2d0b5ab6)
>
> Code, LangGraph over MCP.
>
> ![Connect panel with the HTTP snippet](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-http.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=34db464a3e0a3f18efce2e35512a5528)
>
> Code, HTTP: one call per action.

> [tab] Platform
>
> ![Connect panel with Copilot Studio setup](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-copilot-studio.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=84261c4b8a959be673132c6b3931a68a)
>
> Platform, Copilot Studio.
>
> ![Connect panel with Agentforce setup](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-agentforce.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=2408a4b4daec237270d5a5090aae9022)
>
> Platform, Agentforce.
>
> ![Connect panel with ServiceNow setup](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-connect-servicenow.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=b382aff3b1b9f900d6b21b2fb3689287)
>
> Platform, ServiceNow.

At the bottom, a line waits for the agent's first call and turns green when it arrives.

## MCP clients

> [tab] Claude Code
>
> ```bash theme={null}
> claude mcp add --transport http coverbase https://api.coverbase.app/v1/governor/mcp --header "Authorization: Bearer $COVERBASE_GOVERNOR_KEY"
> ```

> [tab] Cursor
>
> ```json .cursor/mcp.json theme={null}
> {
>   "mcpServers": {
>     "coverbase": {
>       "url": "https://api.coverbase.app/v1/governor/mcp",
>       "headers": { "Authorization": "Bearer cbbk.cbbagt_xxxxxx.your-secret" }
>     }
>   }
> }
> ```

> [tab] VS Code
>
> ```json .vscode/mcp.json theme={null}
> {
>   "servers": {
>     "coverbase": {
>       "type": "http",
>       "url": "https://api.coverbase.app/v1/governor/mcp",
>       "headers": { "Authorization": "Bearer ${input:coverbase-key}" }
>     }
>   },
>   "inputs": [{ "type": "promptString", "id": "coverbase-key", "description": "Coverbase governor key", "password": true }]
> }
> ```

> [tab] Claude Desktop
>
> ```json claude_desktop_config.json theme={null}
> {
>   "mcpServers": {
>     "coverbase": {
>       "command": "npx",
>       "args": ["-y", "mcp-remote", "https://api.coverbase.app/v1/governor/mcp", "--header", "Authorization:${COVERBASE_AUTH}"],
>       "env": { "COVERBASE_AUTH": "Bearer cbbk.cbbagt_xxxxxx.your-secret" }
>     }
>   }
> }
> ```

Each target the agent can reach becomes a tool. Instead of a key, any of these clients can add `https://api.coverbase.app/v1/governor/mcp` as a remote MCP server and sign in with your Coverbase account. See [Sign in from an MCP client](https://docs.coverbase.com/products/agent-governor.md#sign-in-from-an-mcp-client).

## Plain HTTP

Any language can call the runtime API directly:

```bash theme={null}
curl -s https://api.coverbase.app/v1/governor/runtime/actions \
  -H "Authorization: Bearer $COVERBASE_GOVERNOR_KEY" -H "Content-Type: application/json" \
  -d '{"target_id": "cbbtgt_xxxxxx", "mode": "execute", "request": {"kind": "sql", "sql": "SELECT 1"}}'
```

The response has a `verdict` of `allow`, `hold` or `deny`. On `hold`, poll `GET /v1/governor/runtime/approvals/{approval_id}` until its `status` is no longer `pending`, then send the identical request again with `approval_id` set. `GET /v1/governor/runtime/whoami` lists the targets the agent can reach.

## Approve a held action

When a policy holds an action, the approvers are paged by email and Slack. Open **Inspect › Governor › Approvals**:

* **Approve once** runs that exact statement or request one time, for the person the agent acted for. A different statement waits for its own approval.
* **Approve equal actions for** a window runs any statement of the same shape until it closes.
* **Decline** refuses only the statement you saw.

Use J and K to move through the queue, A to approve once and D to decline.

![Approvals queue with a held action selected](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-approvals.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=6ec4487f3d6f6373f6947c15180e90b7)

Approvals: the held statement, its intent and risk, and the approve once and window legend.

## Read the trail

**Inspect › Governor › Activity** shows every decision. Filter by verdict, agent or target, and open a decision to see each step: who signed in, the person it acted for, the intent and risk, the rule that matched, the approval and the masked fields.

![Activity view with a decision opened](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-activity-decision.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=8558959ec0d0055347ced986aeb47b62)

Activity with a decision opened.

## Scope a rule to one agent

A rule can name the agents it applies to. A rule that names agents does not apply to any other agent, so a baseline for one agent keeps every other agent off that target and out of their tool lists. Set it in the rule editor's **Agents** field under **Inspect › Governor › Policies**.

![Rules on a target, including an agent-scoped rule](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-rules-agent-scoped.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=d7ba1e3dca2ee715af6016ee7731f1e0)

Policies: the rules on a target, including one scoped to a single agent.

![Rule editor with the Agents field set](https://mintcdn.com/coverbase/Kc1fSHSKjIckbc1V/images/user-guides/agent-governor-ui-rule-editor-agents.png?fit=max\&auto=format\&n=Kc1fSHSKjIckbc1V\&q=85\&s=1820306f093bf18cdf6b628674ceef7b)

The rule editor with Agents set to one agent, and the replay of recent decisions under the change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.