Evidra

Evidra is an open-source MCP execution-evidence recorder. It wraps one upstream MCP server and records what an agent declared, what the proxy observed, and what the agent reported.

The relaunched Core line is currently an unreleased preview built from main.

Agent / MCP client -> Evidra MCP endpoint -> upstream MCP server
                              |
                              v
                  signed local MCP execution evidence

An MCP response alone does not preserve the difference between intent, activity, and the agent's account of the result. Evidra keeps those sources separate:

• Declared — the objective the agent records before it calls an upstream operational tool.
• Observed — execution start/finish boundaries, status and timing metadata, upstream tool metadata, and keyed fingerprints recorded by the proxy. The fingerprints have bounded storage; raw upstream request and response bodies are not stored as observed payloads.
• Reported — the terminal status and explanation the agent records when it closes the operation.

Evidra reconciles these records without treating any one of them as external truth. A proxy observation shows traffic at the MCP boundary; an agent declaration or report remains an agent-provided claim.

Building from source requires Go 1.26 or later.

make build
go build -o bin/evidra-fixture ./cmd/evidra-fixture
mkdir -p evidence

./bin/evidra-mcp --proxy \
  --evidence-dir ./evidence \
  --server-name fixture \
  -- ./bin/evidra-fixture

The command starts a single stdio MCP endpoint and waits for JSON-RPC input. In normal use, an MCP client owns this process and supplies the configuration. See Getting started for a complete client configuration and an end-to-end operation.

Evidra does not sandbox the wrapped command. It starts the supplied upstream process with the caller's operating-system authority, so review the command and its configuration as you would when running it directly.

Each endpoint process creates a recorder directory beneath the evidence root. Summarize all recorder directories or verify their chains with the reader CLI:

./bin/evidra summarize --dir ./evidence
./bin/evidra verify --dir ./evidence

The summary keeps declarations, observations, and reports distinct. Verification checks recorder stores rather than deciding whether the operation achieved its real-world goal.

Evidra distinguishes several different statements:

• Chain integrity checks that stored records remain in their signed, hash-linked order.
• Signature validity checks records against the public key stored with that recorder. A local recorder key does not independently establish an organizational identity.
• Evidence coverage reports known degraded windows recorded after evidence persistence failures. A complete value does not prove that no unknown loss occurred.
• Reconciliation produced by evidra summarize surfaces execution starts that have no matching finish event; this is separate from verification coverage.
• Proxy observations attest to execution boundaries visible at the Evidra MCP boundary, not to side effects beyond it.
• Agent declarations and reports are preserved as attributed claims; their presence does not make them independently true.

Evidra does not independently prove that the external system reached the agent's intended state. It records and reconciles claims and observations available at the MCP boundary.

• One stdio upstream MCP server per Evidra endpoint process.
• Protocol enforcement with --enforce=all (the default), or observe-only operation with --enforce=off.
• Local evidence directories, with one recorder directory per process.
• MCP protocol versions 2025-06-18, 2025-03-26, and 2024-11-05.
• No required hosted service.
• No built-in operational tool catalogue; upstream tools are exposed unchanged alongside evidra_prescribe and evidra_report.

Go integrations can import the public evidence and reconciliation packages as github.com/vitas/evidra/pkg/evidence and github.com/vitas/evidra/pkg/report. The endpoint implementation in pkg/proxy is not a supported integration API.

• Getting started
• CLI reference
• Architecture
• Evidence format and trust model
• Validation status and limitations

After the Core documentation, the separate Evidra Bench project provides benchmark workflows built around reproducible evidence.

See CONTRIBUTING.md for the development workflow and SECURITY.md for the vulnerability-reporting process and security scope.

Evidra is licensed under the Apache License 2.0.