# bernstein

Enforces policy as code for AI agents and maintains verifiable execution records. Useful when autonomous CLI tools require strict auditing and human approvals.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1331
- Author: sipyourdrink-ltd
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sipyourdrink-ltd/bernstein
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/bernstein

## What it does

The server adds a governance layer to agent workflows through policy as code. You define permissions, required approvals, and audit rules. Scheduling runs on deterministic Python code rather than an LLM coordination loop. Because of this design, repeating an execution plan yields the exact same task graph.

Every run writes to an offline replay journal. The server supports hardware key verification via FIDO2 and PIV tokens for sensitive approvals. It also includes an air-gap install profile for restricted network environments.

The project is in beta and maintained by a single developer. Minor releases can change internal interfaces, so pinning the package version in your setup prevents unexpected breaks.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add bernstein -- uvx bernstein
```
uvx runs the command named after the package; if the README names another one, use uvx --from bernstein <command>

### Codex

**Platform CLI**
```bash
codex mcp add bernstein -- uvx bernstein
```
uvx runs the command named after the package; if the README names another one, use uvx --from bernstein <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "bernstein": {
            "command": "uvx",
            "args": [
                "bernstein"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from bernstein <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "bernstein": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "bernstein"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from bernstein <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add bernstein uvx bernstein
```
uvx runs the command named after the package; if the README names another one, use uvx --from bernstein <command>

## When to use it
- Enforce policy-as-code approval gates on CLI agents
- Replay task graphs without LLM scheduling drift
- Authorize agent actions with FIDO2 or PIV hardware keys
- Verify agent operations offline using replay journals

## Example prompts
- Run the task graph under bernstein policies and log all changes
- Verify the offline execution receipt for the latest git diff

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [browser-use](https://affpapa.org/en/nevibecode/mcp/browser-use.md) — MCP server · ★ 119160
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47392
- [mcp-server](https://affpapa.org/en/nevibecode/mcp/mcp-server.md) — MCP server · ★ 43872

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md