EVIDE MCP

MCP server connecting AI agents to theEVIDE External Evidentiary DepositAPI.

How to obtain a DAPI:dapi-certification.com

Plans and pricing:app.certifywebcontent.com/pricing

git clone https://github.com/emanuelcelano/evide-mcp cd evide-mcp npm install

{ "mcpServers": { "evide": { "command": "node", "args": ["/path/to/evide-mcp/index.js"], "env": { "EVIDE_API_KEY": "evd_your_key_here", "EVIDE_DAPI_NUMBER": "0123456789", "EVIDE_OWNER_ID": "your_owner_id", "EVIDE_OWNER_ROLE": "AI System Operator", "EVIDE_AGENT_SYSTEM": "MyAgentSystem", "EVIDE_AGENT_ID": "agent_xyz" } } } }

Deposit a finalized AI decision as an evidentiary record.

{ "source_reference": "CDR-2026-00421", "decision_type": "candidate_evaluation", "decision_summary": "Candidate approved for second round interview.", "classification_status": "stable", "threshold_status": "met", "boundary_status": "candidate", "human_oversight_level": "L2" }

Optional external artifacts(evidence_references):

{ "source_reference": "CDR-2026-00423", "decision_type": "claim_assessment", "decision_summary": "Claim rejected: documentation inconsistent with policy terms.", "evidence_references": [ { "artifact_type": "document", "pointer": "s3://evidence-store/claim-8812/policy.pdf", "declared_origin": "policy_management_system", "declared_relationship": "supporting_document", "declared_retention_status": "persistent_storage", "hash_algorithm": "sha256", "hash_value": "9f2c7a1b4e6d...", "hash_scope": "full_file", "hashed_by": "policy_management_system" } ] }

EVIDE anchors thedeclarationthat an artifact exists — the file itself is never uploaded, and EVIDE never computes or verifies its hash. That is whyhashed_byis mandatory whenever a hash is declared: an anchored digest with no stated provenance would be worthless. The client validates this before the request leaves, so a missing field produces a message naming it rather than a generic server rejection. Nothing is inferred:hashed_byis never filled in with the agent identity, because claiming the agent computed a digest it merely relayed would be a false provenance claim.

Declaring the array automatically setsextensions: ["evidence_references"]. That registry is opt-in in both directions — a block present but undeclared is rejected, and a declaration with no content is rejected too — so the client keeps the two aligned by construction.

Optional operational perimeter declarations(declarations, EVIDE ANCHOR):

{ "source_reference": "CDR-2026-00424", "decision_type": "operational_perimeter_declaration", "decision_summary": "Environment classification declared before agent action.", "declarations": [ { "declaration_type": "environment_classification", "declared_value": "production", "declarant": "devops-lead", "declared_at": "2026-08-03T16:30:00Z", "declared_attribution_status": "attributed" } ] }

A Declaration is an explicit, attributable, time-bound statement of the operational perimeter (environment, privileges, purpose, tools, prohibited operations, agent configuration) an agent was authorized within,beforeit acted. EVIDE preserves the declaration only — it never verifies its correctness, applies it as policy, or compares it against observed behavior. This is the primitive behind the incident that motivated it: an agent that mistakes a production database for a disposable test environment is exactly the case a declaredenvironment_classificationmakes independently reconstructable after the fact.

This MCP-level schema is deliberately simplified relative to the full API:declaration_type,declared_value,declarant,declared_at,declared_descriptionand a flatteneddeclared_attribution_statusare exposed here. Nestedsubject_references,authority_source.referencesanddeclared_relations(declaring that one Declaration supersedes, clarifies, or revokes another) are not — they remain available through the direct intake API for callers who need the nested form.

Declaring the array automatically setsextensions: ["declarations"], using the same opt-in registry asevidence_references— both can be declared together in the same deposit.

Each Declaration should represent a single attributable statement. When a request describes multiple independent facts -- for example, both an environment classification and a privilege scope -- each should be preserved as its own Declaration, not merged into one.

Compositedeclaration_typevalues (e.g.environment_and_privilege) are accepted by the schema --declaration_typeis free text by design -- but discouraged: a merged declaration cannot later be superseded, clarified, or revoked independently from the facts it bundles together. If the environment classification changes but the privilege scope does not, only theenvironment_classificationDeclaration should be superseded -- that becomes impossible once the two are combined into one.

Optional chain parameters(Evidentiary Continuity):

{ "source_reference": "CDR-2026-00422", "decision_type": "candidate_evaluation", "decision_summary": "Escalation resolved: candidate approved after compliance review.", "parent_evide_id": "aed9e966-6f25-4358-b784-b06eff939e91", "chain_type": "escalation_resolution", "matter_reference": "MATTER-2026-4471" }

The natural use is to pass theevide_idreturned by an earlierevide_escalateasparent_evide_idon the deposit that resolves it — producing a declared lineage from "the agent stopped here" to "this is how it was closed".

Chain validation is strict and has no silent fallback. If the parent does not exist, belongs to another evidentiary domain, is in a non-chainable status, or declares a differentmatter_reference, the whole deposit is refused rather than silently starting a new chain. The refusals arechain_parent_not_found(422),chain_parent_not_owned(403— an authorization decision, not a payload error),chain_parent_invalid_status(422) andchain_matter_mismatch(422).

Returns:evide_id,intake_hash,intake_timestamp_utc,profile_version, Forensic Cross-Check state, DWC and FAC states when present, and — when the record continues from another —chain_position,chain_typeandchain_root_evide_id.

Crystallize the agent statebefore proceedingat a high-stakes or contestable boundary.

{ "source_reference": "ESC-2026-00089", "agent_state_summary": "Transaction exceeds regulatory threshold. Human review required.", "escalation_trigger": "regulatory_threshold", "escalation_reason": "Amount exceeds €50,000 -- requires compliance officer approval.", "boundary_status": "verified_partial", "unresolved_signals": ["compliance_officer_availability", "aml_flag_status"] }

evide_escalateaccepts the same optional chain,evidence_referencesanddeclarationsparameters asevide_intake, for the case where one escalation continues from another.

Available triggers:high_stakes_decision·contestable_state·legal_ambiguity·regulatory_threshold·governance_uncertainty·semantic_instability·human_review_required·authority_incoherence

Returns the configured owner and agent identity. Does not expose the full API key.

Returns verification guidance for a previously deposited record.

Three additional tools let an agent drive the full ESB lifecycle:

The closure is anchored immediately, exactly as withevide_intake: the buffer opensalongsideit, it does not delay or replace it. What the buffer adds is the trajectory — how the conditions settled over a real window, rather than only what they were at the crossing.

A real observation window is required.The server refuses a close occurring less than two seconds after the open, because a buffer that closes instantly observed nothing. The measured window comes back aswindow_seconds.test_mode: truebypasses this, and is exposed only because the server accepts it: a buffer closed in test mode did not observe a real window, and the record will not pretend otherwise.

stabilization_scoreis declared, never computed.Neither EVIDE nor this client calculates it. Out-of-range values are rejected rather than clamped, because clamping would hide a client error. If you have no basis for a score, omit it — the client does not supply one on your behalf. Same principle already applied tohashed_byandreadiness_gate.

Phase fields are enforced client-side.buffer/updateandbuffer/closeaccept different key sets. Sendingstabilization_scoreto an observation, orstability_trendto a close, is refused with a message naming the tool it belongs to — rather than being silently discarded, which is what the API itself did until July 2026.

evide_intake_esb → closure anchored, buffer_id returned, buffer OPEN ↓ evide_buffer_observe → stability_trend, continuity_state, ↓ causal_persistence_signal, stabilization_source evide_buffer_close → verdict + window_seconds "crossing-sufficient, NOT absolute epistemic truth"

Boundary Readiness and the Independent Gate

Agent-originated intakes default toboundary_readiness: candidate. In the absence of an independently declared readiness gate, FCC, DWC and FAC may remainunknown.This is an evidentiary result, not a processing failure.

boundary_readinessdeclares whether anindependentgate assessed the boundary. A depositing agent is not that gate: it cannot attest to its own readiness at a boundary any more than a system can self-certify. The client therefore never fabricates one —readiness_gate_idandreadiness_gate_scopemust come from the caller, and any status other thancandidateis refused without them.

The same applies tounresolved_signals, which carries the identifiersa gatecould not resolve during its assessment. Withcandidatethe array is empty by definition, not by restriction: no assessment took place, so nothing could have been left open. What theagentcould not decide is a different thing, and lives inescalation_reasonandagent_state_summary.

This is the intended lifecycle, and it is already how independent integrations use the schema in production:

agent ↓ evide_escalate / evide_intake → boundary_readiness: candidate ↓ FCC / DWC / FAC: unknown independent gate (human supervisor, orchestrator, external governance component) ↓ assessment → boundary_readiness: verified_partial with its own readiness_gate

The agent never has to impersonate the gate. Same principle already applied tohashed_by: the client does not invent a declaration that belongs to someone else.

Current MCP abstractions intentionally expose only the intervention types required by the implemented tools (approvalforevide_intake,escalationforevide_escalate). Additional intervention semantics — for exampleoverrideorrejection— will be introduced only when a concrete agent workflow requires them, rather than speculating about future use cases.

The same reasoning applies tohuman_oversight.is_declared, which is alwaystrue. This is not a shortcut: the server cannot start without a DAPI number, so every deposit made through it is by construction attributable to a declared accountable human. There is no anonymous path to leave open. The oversightlevelremains the caller's choice (L1/L2/L3); only the existence of a declared authority is fixed, because the transport itself guarantees it.

authority = accountable human / organization (DAPI-bound) execution_identity = the agent that produced the closure escalation_context = why crystallization was requested

Responsibility always converges on the DAPI-verified owner. The agent cannot self-certify.

First live agent evidentiary crystallization:May 2026, via Claude Desktop + MCP.

continuity.state: degraded boundary_readiness: verified_partial unresolved_signals: 8 FCC: DEGRADED

The record preserved a degraded governance state without flattening instability into false certainty.

LinkedIn -- First Live Agent Evidentiary Crystallization

- EVIDE JSON Schema
- API Documentation
- Payload Canonicalization
- Closure Layer
- EVIDE vs Execution Certification
- Pricing & Service Conditions

Dott. Emanuel Celano-- Informatica in Aziendainfo@informaticainazienda.itBologna, Italy

Use of this server requires a valid DAPI identity and an active EVIDE subscription. Service conditions:app.certifywebcontent.com/pricing#service-conditions

Attested healthcare-finance MCP. Scan medical bills, estimate appeal probability, generate state-specific appeal letters, benchmark commercial rates, look up ICD-10/CPT/NPI/DEA. Every response Ed25519-signed so LLMs can cite + verify.