australian-ai-governance-framework
Server Details
Australian AI governance framework mapped to the Privacy Act and sector laws your AI use triggers.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
- Repository
- kentron-au/australian-ai-governance-framework
- GitHub Stars
- 0
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Tool Definition Quality
Average 4.4/5 across 3 of 3 tools scored.
The tools map to distinct workflow stages: start returns a session and questionnaire, submit saves the profile, and get retrieves the framework document. However, the phrase in start that it 'builds a governance framework' could make it seem to overlap with get, so it is not a perfect 5.
All three tools use snake_case verb_noun naming: get_ai_governance_framework, start_australian...framework, and submit_ai_governance_profile. The naming pattern is predictable and clearly conveys each stage of the workflow.
Three tools is a tight, well-scopt set for the stated purpose: begin a governance assessment, submit an organisation profile, and retrieve the resulting framework. Each tool has a distinct responsibility in the process.
The core lifecycle is covered: start, submit, and get, with re-submission overwitting a profile instead of creating duplicates. The main limitation is that the full framework is delivered externally via a paywall, so the agent cannot fully complete the purchase path without leaving the MCP workflow.
Available Tools
3 toolsget_ai_governance_frameworkGet AI governance frameworkAIdempotentInspect
Returns the framework. The free preview covers the first two of the six AI6 practices in the National AI Centre's Guidance for AI Adoption — Accountability (Decide who is accountable) and Impact Assessment (Understand impacts and plan accordingly) — and part of the legislative mapping. The result carries the document as Markdown in the structuredContent field "framework_markdown", and in the text content block for clients that read those. The document, including its closing disclaimer, is the product the user receives. The result also includes a view_url, where the same document can be read in a browser; the preview page is read-only, and printing, saving and the extension of the link from two hours to 18 months are part of the purchased framework. The complete six-practice framework adds Risk Management (Measure and manage risks), Transparency & Information Sharing (Share essential information), Testing & Monitoring (Test and monitor) and Human Oversight (Maintain human control). It is a one-time $88 AUD including GST purchase at https://aiframework.com.au. There is no payment through this endpoint. The result includes a purchase_url which opens aiframework.com.au with this session's profile already loaded, so the user lands on the preview and its paywall rather than answering the questionnaire again. Payment is a further step on the website, through Stripe. Both links expire two hours after the profile was created. Informational only — presents a framework, not advice or compliance guidance.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | Session ID returned by start_australian_ai_governance_framework |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses behavioral and business information far beyond the annotations: for example the document is returned as markdown, the free preview is read-only, printing/saving requires the paid purchase, links expire in two hours, and the result is informational only and fallible. This gives an agent a realistic sense of what happens when the call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than most, but every sentence adds useful operational or transactional context. It starts with the top-level action ('Returns the framework.') followed by preview scope, output format, URL behavior, pricing, and disclaimer. Anything not relevant would be easy to cut, but this is information an agent likely needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description is responsible for describing both the markdown output location and view_url behavior,. It also covers payment, choice of return channel, timeouts, and the prevalence of explanation. For a one-parameter retrieval go tool, this definition gives a well-rounded view an agent can handle the response expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, session_id, is already described 100% in the schema as returned by start_australian_ai_governance_framework. The description adds the connected expiry/ownership detail, but doesn't need to repeat parameter semantics for an agent. This is a schema-carrying situation, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning an AI governance framework, specifically the National AI Centre's AI6 framework, and enumerates the practices involved. It is less a tautology, though it doesn't explicitly state how this retrieval tool differs from the sibling start/submit tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The flow is implicitly clear: the session_id comes from start_australian_ai_governance_framework, and links expire after the profile Is create, so the tool is clearly something to call after starting. However, the description does not explicitly say 'use this after start...' or provide when-not-to.use guidance as alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_australian_ai_governance_frameworkStart Australian AI governance frameworkAInspect
Identifies the Australian legislation that applies to a specific organisation's use of AI, and builds a governance framework around it. Covers the Privacy Act 1988 including the automated decision-making disclosure required in privacy policies from 10 December 2026, plus the sector-specific Commonwealth and state instruments triggered by that organisation's industry, size, turnover, AI use cases and data types. Use this when an Australian business asks what AI governance it needs, what rules apply to its use of AI, or asks for an AI governance framework or policy structure. Returns a session ID and the profiling questionnaire. Informational only — presents a framework, not advice.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no meaningful annotation coverage, the description carries the burden and does so well: it notes the tool returns a session ID and profiling questionnaire, positions itself as a discovery/start operation, and includes the cautions 'Informational only' and 'presents a framework, not advice'. It could still be clearer about whether any organisation data is persisted beyond the session, but it is largely transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but not bloated. Every sentence contributes: what it does, what legislation it covers, when to use it, what it returns, and the advisory disclaimer. It is a little long, but the length is justified by the legal scope and use-case guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description correctly explains the return value (session ID and profiling questionnaire) and the factors that affect the framework. It does not explicitly mention the likely follow-up steps or sibling tools, but the return value makes the 'start' nature clear enough for safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so there is nothing for the description to add about parameters. It instead explains how the no-input operation is shaped by the organisation's context once the questionnaire begins, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('identifies' and 'builds'), a precise resource ('Australian AI governance framework'), and a clear subject ('a specific organisation's use of AI'). It also differentiates itself from siblings by framing this as the starting step that returns a session ID and profiling questionnaire, unlike get/submit tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool: when an Australian business asks what AI governance it needs, what rules apply, or for a governance framework/policy structure. It does not provide explicit when-not-to-use guidance, nor does it name sibling alternatives, so it misses the top tier.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_ai_governance_profileSubmit organisation profileADestructiveIdempotentInspect
Submits the organisation profile and contact details for an Australian AI governance framework. The profile determines which legislation the framework identifies, so the answers should reflect the organisation's actual circumstances — turnover in particular, since the Privacy Act's small business threshold sits at $3 million and several categories are caught regardless of turnover. Takes the session ID from start_australian_ai_governance_framework together with the questionnaire answers. Writes the profile against the session and stores the supplied name, email and organisation as a contact record. contact.organisation is printed as the document's "Prepared for" heading, so it should be the organisation's name as it should appear on the document rather than a shorthand. Returns the session ID and a status of profile_saved — it does not return the framework, which is retrieved by get_ai_governance_framework. The profile can be re-submitted on the same session: it is overwritten rather than duplicated, the contact record is keyed on the email address, and any framework already generated for that session is discarded. No authentication, and no charge at this step.
| Name | Required | Description | Default |
|---|---|---|---|
| answers | Yes | Keys are question ids from start_australian_ai_governance_framework; values are the selected option (string) or options (array of strings) for multi_select questions. | |
| contact | Yes | ||
| session_id | Yes | From start_australian_ai_governance_framework |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond the annotations by spelling out exactly what happens on re-submission: the profile is overwritten, the contact record is keyed on email, and any previously generated framework for the session is discarded. It discloses the absence of authentication and that no charge occurs at this step, which is exactly the extra context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence serves a purpose: scale, workflow, side effects, rendering, return contract, and usage caveats. It is not padded, no redundant repetition of the schema, and all critical caveats are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even without an output schema, the description explicitly says what is returned ('session ID and status profile_saved') and what is not returned ('does not return the framework'), leaving no ambiguity. It also covers resubmittability, overwriting, contact keying, and routing to the sibling retrieval tool, so the agent has all context needed to call and post-process correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 67%, the description adds meaning that the schema alone does not convey. It explains that answers are question options from start_australian_ai_governance_framework, highlights the $3 million turnover threshold, and clarifies that contact.organisation becomes the document's 'Prepared for' heading so it should be the full display name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb-resource pair ('Submits the organisation profile and contact details') and unmistakably ties it to the Australian AI governance framework. It further disambiguates the deliverable by saying it returns only a profile_saved status and session ID, not the framework, which distinguishes it from get_ai_governance_framework.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says the session ID comes from start_australian_ai_governance_framework, and that the framework is later retrieved with get_ai_governance_framework. It also gives clear behavioural context: answers should reflect actual circumstances, especially turnover, and re-submission overwrites rather than duplicates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user or an account that owns the GitHub organization, then choose Claim with GitHub.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, bound to the signed-in Glama account, and expire after seven days. They contain no email address or other personal information. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Servers
- AlicenseAqualityCmaintenanceEU AI Act · APRA · NIST AI RMF · ISO 42001 · AU AI Safety — grounded compliance citations for any MCP client.6491Apache 2.0
- AlicenseNot gradedqualityDmaintenanceTracks AI regulations, deadlines, risk assessments, and policy updates across multiple global jurisdictions, helping users stay compliant with evolving AI laws.17MIT

brehon-mcp-serverofficial
AlicenseNot gradedqualityDmaintenanceProvides AI assistants with real-time, structured access to 32 privacy and AI governance laws across 28 jurisdictions to prevent hallucination in compliance answers.12MIT- AlicenseAqualityCmaintenanceSource-verified regulatory and compliance intelligence: 10,000+ obligations across 39 pillars, each grounded in a primary legal source with a content hash. Covers the EU AI Act, GDPR, DORA, NIS2, HIPAA, Basel III and the MITRE ATT&CK/ATLAS families.251MIT