Architecting an AI Governance Ledger with FastMCP

The paradigm shift brought on by Large Language Models and AI agents has unlocked enormous productivity increases. However, it also introduces massive IP risks and compliance responsibilities that are easily overlooked given the low barrier to entry. To safely scale asset generation, a matching effort in governance automation is required. We’ll dive into how we can accomplish this, and exemplify it with the open-source Governance repo used throughout Crenet Games projects.

The IP and Compliance Challenge

The legal stance, and public reception, of AI generated assets is uncertain, but what is true is that the human authorship, when and how it was done, is a critical distinction. It is easy to lose track of this if we look back at the project with the burdens of years of untracked effort, and so, it is imperative to start logging from the get go. And, like every mechanism, the lower the friction to do this, the better the adoption: Introducing MCP Asset Ledger logging.

@mcp.tool()
def log_ai_asset(
    file_name: str,
    generation_type: str = "sketch_to_ai_to_post_edit",
    base_human_sketch_ref: Optional[str] = None,
    ai_prompt_used: Optional[str] = None,
    ai_model_used: Optional[str] = None,
    ai_seed: Optional[str] = None,
    human_source_file_ref: Optional[str] = None,
    human_modification_description: Optional[str] = None,
) -> str:

This maintains a strict legal paper trail required for Steam AI disclosures, copyright defense, and hybrid human-AI authorship provenance tracking on a per-project basis in JSON format. Crucially, it distinguishes between pure AI-generated assets, and those with human sketches as input or with human post edits, and both. These distinctions are treated vastly differently by global IP frameworks, and the public eye, hence their importance.

We can see the risks of AI are such, that many industries adopt blanket wide bans on them (See: PC Gamer’s article on Videogame lawyer says it’s become ‘just boilerplate’ this year to include no-AI clauses in contracts). Mergers and acquisitions suddenly become nightmarish without this clear record of which assets were generated how.

It is part of this auditability effort that I, and Crenet Games, have the confidence to make our governance wholly public and open source.

Enforcing the Schema with FastMCP

Why MCP? At the center of AI generation is, unsurprisingly, AI. So, a mechanism that is frictionless incorporated with AI agents was needed. And MCP is both that way, while keeping the determinism, as opposed to simple “skills” or “rules”, which would fail at scale as the context window grows. Even though web games will prefer TypeScript, I went ahead with Python. It’s easy to embed in MCP, and leads to small code footprint.

  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Crenet AI Asset Ledger Schema",
  "description": "Schema for AI asset tracking, supporting hybrid img2img and human post-edit pipelines.",
  "type": "array",
  "items": {
    "type": "object",
    "required": [
      "file_name",
      "generation_type",
      "timestamp_utc"
    ],

For this ledger, the file’s name, type of generation, and date are mandatory. This at least gives the visibility to know where the assets are and where they came from and since when, which is the bare minimum needed to understand their scope, their legal stance, and come up with any improvement plans. Furthermore, we have fields for the base_human_sketch_ref path and human_post_edit_data metadata when they apply. They can be human maintained, as they would be human developed, and are meant to point to the human layered project file where the personal brushwork can be audited to show the human element.

All of this is put together by the .agents/ dotagents protocol (or .antigravity/ for Google’s Antigravity) folder structure, where rules, skills, and MCP servers can live to be integrated to the agents’ context, regardless of model. By importing the governance repo as a git submodule, the setup script handles the lifecycle (from creation to deletion) of incorporating the governance context and tooling across any updates.

#!/usr/bin/env bash
# Crenet Games Governance Submodule Setup Script
# Links governance rules, skills, and tools into the parent workspace root and manages their lifecycle.

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PARENT_DIR="$(dirname "$SCRIPT_DIR")"

# Uninstall / Clean mode

Security and Zero-Trust Network Isolation

In modern game development, studios frequently collaborate with decentralized contractors and freelance artists. Because these external partners often use personal devices and switch between various client VPNs, operating under a zero-trust architecture is mandatory. We must assume that a contractor’s local execution context could be misconfigured, potentially exposing proprietary studio assets to unauthorized network states. To guarantee strict environment boundaries and prevent data contamination during AI generation, we implemented a dedicated isolation tool:

@mcp.tool()
def verify_environment_isolation(workspace_dir: Optional[str] = None) -> str:
    """Verifies that the current workspace and execution environment comply with strict container and network isolation protocols.

    Checks:
    1. Git user email in the active workspace matches approved domains
       (default: '@crenet.games', configurable via ALLOWED_EMAIL_DOMAINS).
    2. Checks that no unauthorized external network bindings or restricted profiles are active in the system process list
       (configurable via RESTRICTED_NETWORK_PROFILES).

This tool checks for commit messages matching a given domain, your configurable indie company’s domain, and monitors for any unauthorized external network bindings. As this MCP server is meant to run locally, this keeps the data local, and never exposed to the LLM AI Agent, regardless of it being cloud-hosted.

All in all, governance is similar to security: obfuscation is not a reliable protection, and confidence is gained from public scrutiny. While also addressing a common, and rising, problem general to industries that use AI assets, and so could benefit from forking this project. This is why Crenet Games has open-sourced this governance infrastructure to enable scrutiny and empower others to benefit from it on their way to ethical AI-use.