drupal-mcp-connector 2.3.0 → 2.4.0

package/.claude/commands/drupal-governance-status.md

@@ -0,0 +1,16 @@
+---
+description: "Report each configured site's source-governance condition: whether governance is required, whether the source contract verifies, and the failed condition when it does not. Callable even while governed paths are denied — this is the diagnostic for that denial."
+argument-hint: "[site]"
+allowed-tools: mcp__drupal__drupal_governance_status
+---
+
+Call the `mcp__drupal__drupal_governance_status` MCP tool.
+
+Report each configured site's source-governance condition: whether governance is required, whether the source contract verifies, and the failed condition when it does not. Callable even while governed paths are denied — this is the diagnostic for that denial.
+
+Parse the request in `$ARGUMENTS` into this tool's parameters:
+
+**Optional:**
+- `site` (string): omit for the default site
+
+If a required parameter is missing from `$ARGUMENTS`, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.0] - 2026-08-14
+
+### Added
+
+- **Source governance is now enforceable on every governed product path
+  (#176).** A site with `requireGovernance: true` requires the Drupal
+  source's governance contract to verify before any tool call runs against
+  it: the connector probes `GET /drupal-mcp/readiness` as its own principal
+  (mcp_sentinel ≥ 2.4.0), caches a passing verdict for 60 seconds, and
+  re-proves it after that. A failed, stale, or unreachable verification
+  denies tool discovery and execution with the source's own stable reason —
+  it never falls back to a plain JSON:API or GraphQL path, on any backend or
+  bridge. The new `drupal_governance_status` tool stays callable while
+  governance is failing and reports which required condition failed, without
+  credentials. Ungoverned sites are untouched.
+
+### Changed
+
+- The security middleware and tools/call dispatch moved from the entry point
+  into `src/lib/dispatch.js` (side-effect-free, testable per backend); the
+  entry point now only boots transports. Tool discovery accepts a per-request
+  `list` hook so governance can gate what is discoverable.
+
 ## [2.3.0] - 2026-08-13
 
 ### Added

package/config/config.example.json

@@ -7,7 +7,7 @@
   },
 
   "_security_options": {
-    "_comment": "All optional. apiTokenEnv: read the Bearer token from this env var instead of apiToken (keeps secrets out of the config file). requireSecureAuth: reject anon/basic, require HTTPS+Bearer (recommended for production). Env overrides: MCP_CLIENT_ID overrides or disables the outbound identity header; MCP_AUTH_TOKEN requires bearer auth on the HTTPS /mcp endpoint; MCP_BIND_HOST restricts the listen interface (with TLS). See docs/security-hardening.md."
+    "_comment": "All optional. apiTokenEnv: read the Bearer token from this env var instead of apiToken (keeps secrets out of the config file). requireSecureAuth: reject anon/basic, require HTTPS+Bearer (recommended for production). requireGovernance: deny every governed path unless the source governance contract (GET /drupal-mcp/readiness, mcp_sentinel >= 2.4.0) verifies — no ungoverned JSON:API/GraphQL fallback; recommended wherever mcp_sentinel governs the site. Env overrides: MCP_CLIENT_ID overrides or disables the outbound identity header; MCP_AUTH_TOKEN requires bearer auth on the HTTPS /mcp endpoint; MCP_BIND_HOST restricts the listen interface (with TLS). See docs/security-hardening.md."
   },
 
   "_governance_tiers": {
@@ -28,6 +28,7 @@
       "_comment": "Content tier. Content/media/term CRUD; config read-only; cannot publish (server-side editorial gate). No drushSsh.",
       "baseUrl":           "https://api.int.wilkesliberty.com",
       "requireSecureAuth": true,
+      "requireGovernance": true,
       "api":               "jsonapi",
       "oauth": {
         "tokenUrl":        "/oauth/token",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -36,69 +36,12 @@ import { makeBearerCheck } from "./lib/http-auth.js";
 import { createLegacySessionHandler, createMcpRequestHandler } from "./lib/http-handler.js";
 import { createConnectorServerFactory } from "./lib/mcp-server.js";
 import { createRateLimiter } from "./lib/rate-limit.js";
-import { resolveSecurityConfig, assertNotReadOnly,
-  assertDestructiveAllowed, assertGraphqlMutationAllowed,
-  SecurityError }            from "./lib/security.js";
-import { toolError, toolResult }    from "./lib/errors.js";
-import { BackendCapabilityError, BackendResolutionError } from "./lib/backends/errors.js";
+import { callTool } from "./lib/dispatch.js";
+import { filterDiscoverableTools } from "./lib/governance.js";
 
 // Tools — aggregated (single source of truth, side-effect-free) and per-tool prompts
 import { allDefinitions, allHandlers, definitionsByName } from "./tools/index.js";
 import { buildToolPrompts, getToolPromptMessages } from "./lib/tool-prompts.js";
-import { inferOperation } from "./lib/operations.js";
-
-// ---------------------------------------------------------------------------
-// Security middleware — runs BEFORE every tool handler
-//
-// Operation intent (read/write/delete/graphql) is inferred from the tool name
-// prefix rather than trusting per-tool metadata, so a new tool that follows the
-// naming convention is gated automatically. The matched operation drives which
-// assertions from lib/security.js run against the resolved per-site policy.
-// ---------------------------------------------------------------------------
-
-/**
- * Derive the entity type a tool acts on, for destructive-allow assertions.
- *
- * @param {string} toolName - The MCP tool name.
- * @param {object} args     - The tool arguments.
- * @returns {string} Explicit args.entityType when present, else the suffix
- *   parsed from the tool name (e.g. "node" from "drupal_delete_node"),
- *   falling back to "entity".
- */
-function extractEntityType(toolName, args) {
-  if (args?.entityType) return args.entityType;
-  const m = toolName.match(/^drupal_(?:delete|create|update|get|list)_(.+)$/);
-  return m ? m[1] : "entity";
-}
-
-/**
- * Apply per-site security assertions before dispatching to a tool handler.
- *
- * @param {string}   toolName - The MCP tool name.
- * @param {object}   args     - Tool arguments (may carry `site`, `id`, etc.).
- * @param {Function} handler  - The resolved tool handler.
- * @returns {Promise<*>} The handler's result.
- * @throws {SecurityError} If the resolved policy forbids the inferred operation.
- */
-async function securityMiddleware(toolName, args, handler) {
-  // Tools with no site context skip per-site checks
-  if (toolName === "drupal_list_sites") return handler(args);
-
-  const site = getSiteConfig(args?.site);
-  const sec  = resolveSecurityConfig(site);
-  const op   = inferOperation(toolName);
-
-  if (op === "delete") {
-    assertDestructiveAllowed(sec, extractEntityType(toolName, args), args?.id ?? "?");
-    assertNotReadOnly(sec, toolName);
-  } else if (op === "write") {
-    assertNotReadOnly(sec, toolName);
-  } else if (op === "graphql" && args?.query) {
-    assertGraphqlMutationAllowed(sec, args.query);
-  }
-
-  return handler(args);
-}
 
 // ---------------------------------------------------------------------------
 // MCP Resources — browsable, always-fresh site context
@@ -286,41 +229,16 @@ function getPromptMessages(name, args) {
 }
 
 // ---------------------------------------------------------------------------
-// MCP Server surface
+// MCP Server surface — dispatch (middleware + callTool) lives in lib/dispatch.js
 // ---------------------------------------------------------------------------
 
-async function callTool(name, args) {
-  // eslint-disable-next-line security/detect-object-injection -- name is an MCP tool name from validated schema; allHandlers is a closed dispatch table built at startup
-  const handler = allHandlers[name];
-
-  if (!handler) {
-    return toolError(new Error(
-      `Unknown tool "${name}". Call drupal_list_entity_types to discover available resources.`
-    ));
-  }
-
-  try {
-    const result = await securityMiddleware(name, args ?? {}, handler);
-    return toolResult(result);
-  } catch (err) {
-    // Translate known error classes into clear, non-leaky isError responses;
-    // anything else falls through to toolError for a generic envelope.
-    if (err instanceof SecurityError) {
-      return { content: [{ type: "text", text: `Access denied: ${err.message}` }], isError: true };
-    }
-    if (err instanceof BackendCapabilityError) {
-      return { content: [{ type: "text", text: `Not supported by this site's backend: ${err.message}` }], isError: true };
-    }
-    if (err instanceof BackendResolutionError) {
-      return { content: [{ type: "text", text: `Backend resolution failed: ${err.message}` }], isError: true };
-    }
-    return toolError(err);
-  }
-}
-
 const buildConnectorServer = createConnectorServerFactory({
   serverInfo: { name: "drupal-mcp-connector", version: CLIENT_VERSION },
-  tools: { definitions: allDefinitions, call: callTool },
+  tools: {
+    definitions: allDefinitions,
+    list: () => filterDiscoverableTools(allDefinitions, listSiteNames().map((n) => getSiteConfig(n))),
+    call: callTool,
+  },
   resources: { definitions: RESOURCES, read: readResource },
   prompts: {
     definitions: ALL_PROMPTS,

package/src/lib/dispatch.js

@@ -0,0 +1,113 @@
+/**
+ * Tool dispatch — the security middleware and the tools/call entry point.
+ *
+ * Lives outside src/index.js (which boots a transport on import) so the
+ * gate order — source governance first, then per-site security assertions,
+ * then the handler — is testable per tool and per backend. Every tool call,
+ * whichever backend or bridge it ends up on, flows through here: denial in
+ * this module is denial on every path, with no ungoverned fallback below it.
+ */
+
+import { getSiteConfig } from "./config.js";
+import { resolveSecurityConfig, assertNotReadOnly,
+  assertDestructiveAllowed, assertGraphqlMutationAllowed,
+  SecurityError } from "./security.js";
+import { toolError, toolResult } from "./errors.js";
+import { BackendCapabilityError, BackendResolutionError } from "./backends/errors.js";
+import { inferOperation } from "./operations.js";
+import { assertSourceGovernance, GovernanceError, GOVERNANCE_DIAGNOSTIC_TOOLS } from "./governance.js";
+import { allHandlers } from "../tools/index.js";
+
+/**
+ * Derive the entity type a tool acts on, for destructive-allow assertions.
+ *
+ * @param {string} toolName - The MCP tool name.
+ * @param {object} args     - The tool arguments.
+ * @returns {string} Explicit args.entityType when present, else the suffix
+ *   parsed from the tool name (e.g. "node" from "drupal_delete_node"),
+ *   falling back to "entity".
+ */
+function extractEntityType(toolName, args) {
+  if (args?.entityType) return args.entityType;
+  const m = toolName.match(/^drupal_(?:delete|create|update|get|list)_(.+)$/);
+  return m ? m[1] : "entity";
+}
+
+/**
+ * Apply per-site governance and security assertions before dispatching.
+ *
+ * @param {string}   toolName - The MCP tool name.
+ * @param {object}   args     - Tool arguments (may carry `site`, `id`, etc.).
+ * @param {Function} handler  - The resolved tool handler.
+ * @returns {Promise<*>} The handler's result.
+ * @throws {GovernanceError} If the site requires source governance and the
+ *   contract is not verified — checked FIRST, so no assertion below can be
+ *   read as an ungoverned fallback verdict.
+ * @throws {SecurityError} If the resolved policy forbids the inferred operation.
+ */
+export async function securityMiddleware(toolName, args, handler) {
+  // Tools with no site context skip per-site checks
+  if (toolName === "drupal_list_sites") return handler(args);
+
+  const site = getSiteConfig(args?.site);
+
+  // Source-governance gate (#176). The diagnostic tools stay callable while
+  // governance fails — they are how an operator learns which condition failed.
+  if (!GOVERNANCE_DIAGNOSTIC_TOOLS.has(toolName)) {
+    await assertSourceGovernance(site);
+  }
+
+  const sec  = resolveSecurityConfig(site);
+  const op   = inferOperation(toolName);
+
+  if (op === "delete") {
+    assertDestructiveAllowed(sec, extractEntityType(toolName, args), args?.id ?? "?");
+    assertNotReadOnly(sec, toolName);
+  } else if (op === "write") {
+    assertNotReadOnly(sec, toolName);
+  } else if (op === "graphql" && args?.query) {
+    assertGraphqlMutationAllowed(sec, args.query);
+  }
+
+  return handler(args);
+}
+
+/**
+ * Serve one MCP tools/call request: resolve the handler, run the middleware,
+ * translate known error classes into clear, non-leaky isError envelopes.
+ *
+ * @param {string} name - The MCP tool name.
+ * @param {object} args - The tool arguments.
+ * @returns {Promise<object>} An MCP tool result payload.
+ */
+export async function callTool(name, args) {
+  // eslint-disable-next-line security/detect-object-injection -- name is an MCP tool name from validated schema; allHandlers is a closed dispatch table built at startup
+  const handler = allHandlers[name];
+
+  if (!handler) {
+    return toolError(new Error(
+      `Unknown tool "${name}". Call drupal_list_entity_types to discover available resources.`
+    ));
+  }
+
+  try {
+    const result = await securityMiddleware(name, args ?? {}, handler);
+    return toolResult(result);
+  } catch (err) {
+    // Translate known error classes into clear, non-leaky isError responses;
+    // anything else falls through to toolError for a generic envelope.
+    if (err instanceof GovernanceError) {
+      return { content: [{ type: "text", text: `Source governance unavailable: ${err.message}` }], isError: true };
+    }
+    if (err instanceof SecurityError) {
+      return { content: [{ type: "text", text: `Access denied: ${err.message}` }], isError: true };
+    }
+    if (err instanceof BackendCapabilityError) {
+      return { content: [{ type: "text", text: `Not supported by this site's backend: ${err.message}` }], isError: true };
+    }
+    if (err instanceof BackendResolutionError) {
+      return { content: [{ type: "text", text: `Backend resolution failed: ${err.message}` }], isError: true };
+    }
+    return toolError(err);
+  }
+}

package/src/lib/governance.js

@@ -0,0 +1,204 @@
+/**
+ * Source-governance verification for governed sites (#176).
+ *
+ * A site with `requireGovernance: true` declares that every product path —
+ * tool discovery and execution, on every backend — depends on the Drupal
+ * source's governance layer (MCP Sentinel) being present, applicable, and
+ * enforcing. The connector verifies that claim against the source's own
+ * readiness contract (`GET /drupal-mcp/readiness`, authenticated as the
+ * connector's principal) and DENIES instead of falling back to a plain
+ * JSON:API or GraphQL path when the contract is not ready, cannot be
+ * reached, or the verification has gone stale and cannot be refreshed.
+ *
+ * The readiness endpoint answers for the whole contract: module present,
+ * an applicable active policy/profile for the requesting principal, and the
+ * enforcement wiring active. Its `reason` values are stable, non-secret
+ * diagnostics designed to be surfaced to operators verbatim.
+ */
+
+import fetch from "node-fetch";
+import { authHeadersAsync, clientHeaders } from "./config.js";
+
+/** How long a passing verification stays fresh before it must be re-proven. */
+export const OK_TTL_MS = 60_000;
+
+/** How long a failed verification is held before the next attempt re-checks. */
+export const FAIL_TTL_MS = 5_000;
+
+/** Tools that stay discoverable and callable while governance is failing —
+ * the diagnostic surface an operator needs to see WHY it is failing. */
+export const GOVERNANCE_DIAGNOSTIC_TOOLS = new Set([
+  "drupal_list_sites",
+  "drupal_governance_status",
+]);
+
+/** Denial for a governed path whose source-governance contract is not verified. */
+export class GovernanceError extends Error {
+  /**
+   * @param {string} message Operator-facing description (no secrets).
+   * @param {string} reason  Stable machine reason (e.g. "sentinel_unreachable").
+   */
+  constructor(message, reason) {
+    super(message);
+    this.name = "GovernanceError";
+    this.reason = reason;
+  }
+}
+
+/** Per-site verification cache: name → {ok, reason, checkedAt}. */
+const cache = new Map();
+
+/** Drop all cached verifications (tests, config reloads). */
+export function clearGovernanceCache() {
+  cache.clear();
+}
+
+/**
+ * Whether a site declares the source-governance requirement.
+ * @param {object} site Resolved site config.
+ * @returns {boolean}
+ */
+export function requiresGovernance(site) {
+  return site?.requireGovernance === true;
+}
+
+/**
+ * Verify the site's source-governance contract, with a short-lived cache.
+ *
+ * Never throws: the result carries `ok` plus a stable `reason` on failure.
+ * A stale cache entry is re-verified; if the re-check cannot happen the
+ * result is a failure — staleness never extends trust.
+ *
+ * @param {object} site Resolved site config.
+ * @param {{force?: boolean}} [options] `force` bypasses the cache.
+ * @returns {Promise<{ok: boolean, reason: string|null, checkedAt: number}>}
+ */
+export async function verifySourceGovernance(site, { force = false } = {}) {
+  const key = site._name ?? site.baseUrl;
+  const cached = cache.get(key);
+  if (!force && cached) {
+    const age = Date.now() - cached.checkedAt;
+    if (age <= (cached.ok ? OK_TTL_MS : FAIL_TTL_MS)) return cached;
+  }
+
+  const result = await probeReadiness(site);
+  cache.set(key, result);
+  return result;
+}
+
+/**
+ * One authenticated readiness probe; maps every outcome to {ok, reason}.
+ * @param {object} site Resolved site config.
+ * @returns {Promise<{ok: boolean, reason: string|null, checkedAt: number}>}
+ */
+async function probeReadiness(site) {
+  const checkedAt = Date.now();
+
+  // Credential construction is its own failure class: an OAuth token the
+  // connector cannot acquire is the connector's principal failing, and must
+  // not be misreported as the source being unreachable.
+  let headers;
+  try {
+    headers = {
+      Accept: "application/json",
+      ...clientHeaders(),
+      ...(await authHeadersAsync(site)),
+    };
+  } catch {
+    return { ok: false, reason: "credential_acquisition_failed", checkedAt };
+  }
+
+  let res;
+  try {
+    res = await fetch(`${site.baseUrl}/drupal-mcp/readiness`, { method: "GET", headers });
+  } catch {
+    // Network detail (addresses, DNS text) is deliberately not propagated.
+    return { ok: false, reason: "sentinel_unreachable", checkedAt };
+  }
+
+  if (res.status === 404) {
+    return { ok: false, reason: "sentinel_unavailable", checkedAt };
+  }
+  if (res.status === 401 || res.status === 403) {
+    return { ok: false, reason: "not_authorized_for_governance", checkedAt };
+  }
+
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+    return { ok: false, reason: "unexpected_response", checkedAt };
+  }
+
+  if (res.status === 200 && body?.contract_ready === true) {
+    return { ok: true, reason: null, checkedAt };
+  }
+  if (body?.contract_ready === false) {
+    // The server's own stable, non-secret readiness reason.
+    return { ok: false, reason: String(body.reason ?? "contract_not_ready"), checkedAt };
+  }
+  return { ok: false, reason: "unexpected_response", checkedAt };
+}
+
+/**
+ * Gate a governed product path: no-op for ungoverned sites, throws otherwise
+ * unless the source contract verifies.
+ *
+ * @param {object} site Resolved site config.
+ * @returns {Promise<void>}
+ * @throws {GovernanceError} naming the failed condition (never secrets).
+ */
+export async function assertSourceGovernance(site) {
+  if (!requiresGovernance(site)) return;
+  const result = await verifySourceGovernance(site);
+  if (result.ok) return;
+  throw new GovernanceError(
+    `Site "${site._name}" requires source governance and the contract is not verified ` +
+    `(${result.reason}). Governed paths are denied — there is no ungoverned fallback. ` +
+    "Run drupal_governance_status for per-site diagnostics.",
+    result.reason,
+  );
+}
+
+/**
+ * Per-site governance condition for operator diagnostics. No secrets: only
+ * the site name, whether governance is required, the verdict, and the reason.
+ *
+ * @param {Array<object>} sites Resolved site configs.
+ * @returns {Promise<Array<{site: string, required: boolean, ok: boolean, reason: string|null, checkedAt: number|null}>>}
+ */
+export async function governanceStatus(sites) {
+  return Promise.all(sites.map(async (site) => {
+    if (!requiresGovernance(site)) {
+      return { site: site._name, required: false, ok: true, reason: null, checkedAt: null };
+    }
+    const result = await verifySourceGovernance(site);
+    return {
+      site: site._name,
+      required: true,
+      ok: result.ok,
+      reason: result.reason,
+      checkedAt: result.checkedAt,
+    };
+  }));
+}
+
+/**
+ * Discovery gate: hide governed tools when NO configured site can serve them.
+ *
+ * A site can serve governed tools when it is either ungoverned or its source
+ * contract verifies. While at least one site qualifies the full surface stays
+ * discoverable (execution remains per-site gated); when none does, only the
+ * diagnostic tools remain, so a client sees the denial instead of a surface
+ * it cannot use.
+ *
+ * @param {Array<object>} definitions Tool definitions ({name, ...}).
+ * @param {Array<object>} sites       Resolved site configs.
+ * @returns {Promise<Array<object>>} The discoverable definitions.
+ */
+export async function filterDiscoverableTools(definitions, sites) {
+  const verdicts = await Promise.all(sites.map(async (site) =>
+    !requiresGovernance(site) || (await verifySourceGovernance(site)).ok));
+  if (verdicts.some(Boolean)) return definitions;
+  return definitions.filter((d) => GOVERNANCE_DIAGNOSTIC_TOOLS.has(d.name));
+}

package/src/lib/mcp-server.js

@@ -12,7 +12,9 @@ import { Server } from "@modelcontextprotocol/server";
  *
  * @param {object} surface
  * @param {{name: string, version: string}} surface.serverInfo
- * @param {{definitions: Array<object>, call: (name: string, args: object, context: object) => Promise<object>}} surface.tools
+ * @param {{definitions: Array<object>, list?: () => Promise<Array<object>>, call: (name: string, args: object, context: object) => Promise<object>}} surface.tools
+ *   `definitions` is the full static surface (schema projection); the optional
+ *   `list` hook decides what is DISCOVERABLE per request (governance gating).
  * @param {{definitions: Array<object>, read: (uri: string) => Promise<object>}} surface.resources
  * @param {{definitions: Array<object>, get: (name: string, args: object) => Array<object>}} surface.prompts
  * @returns {(context: import("@modelcontextprotocol/server").McpRequestContext) => Server}
@@ -26,7 +28,9 @@ export function createConnectorServerFactory({ serverInfo, tools, resources, pro
       { capabilities: { tools: {}, resources: {}, prompts: {} } }
     );
 
-    server.setRequestHandler("tools/list", async () => ({ tools: tools.definitions }));
+    server.setRequestHandler("tools/list", async () => ({
+      tools: tools.list ? await tools.list() : tools.definitions,
+    }));
     server.setRequestHandler("tools/call", async (request, context) => {
       const { name, arguments: args } = request.params;
       const result = await tools.call(name, args ?? {}, context);

package/src/tools/site.js

@@ -7,6 +7,7 @@
  */
 
 import { getSiteConfig, listSiteNames } from "../lib/config.js";
+import { governanceStatus } from "../lib/governance.js";
 import { resolveBackend } from "../lib/backends/index.js";
 
 // ---------------------------------------------------------------------------
@@ -49,6 +50,19 @@ async function listConfiguredSites() {
   return { sites: listSiteNames() };
 }
 
+/**
+ * Per-site source-governance condition (#176). The one governed-path
+ * diagnostic that stays callable while governance is failing, so an operator
+ * can see WHICH required condition failed. Never includes credentials.
+ *
+ * @param {object} args - { site? } (a named site narrows the report).
+ * @returns {Promise<{sites: object[]}>} required/ok/reason per site.
+ */
+async function getGovernanceStatus({ site: siteName } = {}) {
+  const names = siteName ? [siteName] : listSiteNames();
+  return { sites: await governanceStatus(names.map((n) => getSiteConfig(n))) };
+}
+
 // ---------------------------------------------------------------------------
 // Definitions
 // ---------------------------------------------------------------------------
@@ -70,6 +84,14 @@ export const definitions = [
       properties: { site: { type: "string" } },
     },
   },
+  {
+    name: "drupal_governance_status",
+    description: "Report each configured site's source-governance condition: whether governance is required, whether the source contract verifies, and the failed condition when it does not. Callable even while governed paths are denied — this is the diagnostic for that denial.",
+    inputSchema: {
+      type: "object",
+      properties: { site: { type: "string" } },
+    },
+  },
   {
     name: "drupal_list_sites",
     description: "List all named Drupal sites configured in config.json. Useful for multi-site setups.",
@@ -84,4 +106,5 @@ export const handlers = {
   drupal_site_info:          getSiteInfo,
   drupal_list_content_types: listContentTypes,
   drupal_list_sites:         listConfiguredSites,
+  drupal_governance_status:  getGovernanceStatus,
 };