feat(govern): one tool implementation of Govern

README.md

@@ -177,8 +177,8 @@ Each profile requires `instance_type`: `design`, `automation`, `deployer`, `gove
 `agent-management`. Existing stdio profiles missing this field are automatically
 assigned `design` and rewritten on disk before loading. This temporary migration
 is scheduled for deprecation by 0.9.0; existing values are preserved and validated.
-The type metadata does not change client selection or tool availability.
-Selecting Govern records its type; Govern-specific API tools are not yet implemented.
+The type metadata does not change tool availability. Only the `govern` tool reads
+it: that tool runs only when the active instance has type `govern`.
 
 **Environment override.** To select an explicit target, including inside a Code
 Studio, set these three variables in your environment or copy

dataiku_mcp/__init__.py

@@ -35,6 +35,7 @@
     evaluation_stores,
     flow,
     general_settings,
+    govern,
     groups,
     insights,
     instances,

dataiku_mcp/auth.py

@@ -57,6 +57,36 @@ def get_dss_client() -> dataikuapi.DSSClient:
     return client
 
 
+def get_govern_client() -> dataikuapi.GovernClient:
+    """Get a Govern API client for the active instance of type `govern`."""
+    if request.is_http_request():
+        raise ValueError(
+            "The govern tool is available only in local stdio mode. A Govern "
+            "node accepts only API keys, not the delegated tokens that HTTP mode "
+            "uses."
+        )
+    current_instance = request.get_pinned_instance()
+    if current_instance.instance_type != "govern":
+        raise ValueError(
+            f"The active instance '{current_instance.name}' has type "
+            f"'{current_instance.instance_type}'. The govern tool needs an instance "
+            "of type 'govern': run switch_instance to one, or configure_instance "
+            "to add one."
+        )
+    client = dataikuapi.GovernClient(
+        current_instance.url,
+        api_key=current_instance.api_key,
+        internal_ticket=current_instance.api_ticket,
+        extra_headers={"X-DKU-Client-Application": "dataiku-headless"},
+    )
+    client._session.verify = (
+        False
+        if current_instance.no_check_certificate
+        else current_instance.encrypted_rpc_cert_path or True
+    )
+    return client
+
+
 def get_dataiku_version(client: dataikuapi.DSSClient) -> str:
     """Return the instance's Dataiku version, or an empty string if unavailable."""
     try: