# Constellation MCP: Xavani drives the Enternovate stack

> One MCP server, 37 tools, three products. Xavani Agent connects once and
> can run a POPIA assessment, query a knowledge graph, and audit a website,
> all as native tools.

![MIT](https://img.shields.io/badge/license-MIT-blue.svg)
![Python](https://img.shields.io/badge/python-3.11%2B-blue.svg)
![MCP](https://img.shields.io/badge/MCP-server-7C5CFF.svg)

The [Enternovate constellation](https://github.com/enternovate) is a family of
local-first security and compliance tools. This bundle exposes every one of
them through the [Model Context Protocol](https://modelcontextprotocol.io),
so any MCP-capable agent, Xavani first among them, can drive them from a
single connection.

## Tools

| Group | Tools | Backing CLI |
|---|---|---|
| **Gavaza** (POPIA) | `gavaza_assess`, `gavaza_generate`, `gavaza_breach_add`, `gavaza_breach_list`, `gavaza_report`, `gavaza_conditions`, `gavaza_sections`, `gavaza_gdpr_map`, `gavaza_requests_new`, `gavaza_requests_list`, `gavaza_requests_status`, `gavaza_evidence_add`, `gavaza_evidence_list`, `gavaza_evidence_remove` | `gavaza` |
| **Nyarhi** (graph) | `nyarhi_add_node`, `nyarhi_add_edge`, `nyarhi_find`, `nyarhi_neighbors`, `nyarhi_path`, `nyarhi_search`, `nyarhi_timeline`, `nyarhi_undo`, `nyarhi_schema_show`, `nyarhi_xavani_import`, `nyarhi_stats` | `nyarhi` |
| **Mhangani** (audit) | `mhangani_audit`, `mhangani_authorize`, `mhangani_authorizations_list`, `mhangani_authorizations_remove`, `mhangani_report`, `mhangani_history`, `mhangani_baseline_set`, `mhangani_baseline_show`, `mhangani_baseline_diff`, `mhangani_trend`, `mhangani_checklist`, `mhangani_clear` | `mhangani` |

Each tool shells out to the product's CLI and returns its output. JSON
passthrough for report commands, plain text otherwise. If the CLI is not
installed, the tool returns a clear `ERROR:` string.

## Install

```bash
pip install .        # from a checkout
# or directly from GitHub:
pip install git+https://github.com/enternovate/constellation-mcp.git
```

The three backing CLIs must also be installed and on PATH:

```bash
pip install nyarhi gavaza mhangani
```

## Connect Xavani

Add the server to `~/.xavani/config.yaml`:

```yaml
mcp_servers:
  constellation:
    command: constellation-mcp
    args: []
    env: {}
```

Restart the gateway. Xavani then discovers every `gavaza_`, `nyarhi_`, and
`mhangani_` tool. The `xavani constellation` command installs, updates, and
verifies the whole constellation:

```bash
xavani constellation install
xavani constellation status
xavani constellation doctor
```

## Transports

- `stdio` (default): `constellation-mcp`
- `sse`: `constellation-mcp --transport sse --host 127.0.0.1 --port 8000`
- `streamable-http`: `constellation-mcp --transport streamable-http`
- Single-group servers: `gavaza-mcp`, `nyarhi-mcp`, `mhangani-mcp`

## Hardening

- CLI output is capped at 200,000 characters.
- Subprocesses receive a minimal environment allow-list; parent secrets
  never leak into child processes.
- Secret-shaped strings (`sk-...`, `Bearer ...`, API keys) are redacted
  from tool output.
- Every invocation has a timeout; a hung CLI degrades to a clear error.

## Testing

```bash
python -m pytest tests/ -q          # unit suite, 0 fail / 0 skip expected
python -m pytest tests/e2e -q       # Xavani wiring test (needs xavani-agent checkout)
```

The end-to-end test points a temp XAVANI_HOME at this server and runs
Xavani's own MCP discovery, asserting all three products register.

## Security & privacy

Zero telemetry. The server only runs local CLIs against local data. All
three products keep their data on the machine, and the MCP layer adds
output caps, env isolation, and redaction on top.

## License

MIT. See [LICENSE](LICENSE). (c) 2026 Enternovate (Pty) Ltd. Built in
South Africa.

## The constellation

[Xavani](https://github.com/enternovate/xavani-agent) ·
[Nyarhi](https://github.com/enternovate/nyarhi) ·
[Gavaza](https://github.com/enternovate/gavaza) ·
[Mhangani](https://github.com/enternovate/mhangani)