Constellation MCP: Xavani drives the Enternovate stack

One MCP server, 37 tools, three products. Xavani Agent connects once and can run a POPIA assessment, query a knowledge graph, and audit a website, all as native tools.

The Enternovate constellation is a family of local-first security and compliance tools. This bundle exposes every one of them through the Model Context Protocol, so any MCP-capable agent, Xavani first among them, can drive them from a single connection.

Tools

Each tool shells out to the product's CLI and returns its output. JSON passthrough for report commands, plain text otherwise. If the CLI is not installed, the tool returns a clear ERROR: string.

Related MCP server: Kali Tools MCP Server

Install

pip install .        # from a checkout
# or directly from GitHub:
pip install git+https://github.com/enternovate/constellation-mcp.git

The three backing CLIs must also be installed and on PATH:

pip install nyarhi gavaza mhangani

Connect Xavani

Add the server to ~/.xavani/config.yaml:

mcp_servers:
  constellation:
    command: constellation-mcp
    args: []
    env: {}

Restart the gateway. Xavani then discovers every gavaza_, nyarhi_, and mhangani_ tool. The xavani constellation command installs, updates, and verifies the whole constellation:

xavani constellation install
xavani constellation status
xavani constellation doctor

Transports

• stdio (default): constellation-mcp

• sse: constellation-mcp --transport sse --host 127.0.0.1 --port 8000

• streamable-http: constellation-mcp --transport streamable-http

• Single-group servers: gavaza-mcp, nyarhi-mcp, mhangani-mcp

Hardening

• CLI output is capped at 200,000 characters.

• Subprocesses receive a minimal environment allow-list; parent secrets never leak into child processes.

• Secret-shaped strings (sk-..., Bearer ..., API keys) are redacted from tool output.

• Every invocation has a timeout; a hung CLI degrades to a clear error.

Testing

python -m pytest tests/ -q          # unit suite, 0 fail / 0 skip expected
python -m pytest tests/e2e -q       # Xavani wiring test (needs xavani-agent checkout)

The end-to-end test points a temp XAVANI_HOME at this server and runs Xavani's own MCP discovery, asserting all three products register.

Security & privacy

Zero telemetry. The server only runs local CLIs against local data. All three products keep their data on the machine, and the MCP layer adds output caps, env isolation, and redaction on top.

License

MIT. See LICENSE. (c) 2026 Enternovate (Pty) Ltd. Built in South Africa.

The constellation

Xavani · Nyarhi · Gavaza · Mhangani