Elucora Evidence API

com.elucora由 elucora.com 发布官方发布者v1.4.0更新于 Oct 24, 2026

Capture a web source, or seal a hash you hold, into a signed receipt anyone can verify offline.

已验证Streamable HTTP可网页运行网页搜索与抓取安全与监控

概览

AI 生成的概览

托管型 MCP 服务器，可将公开网页来源抓取或把 SHA-256 哈希封装为可离线验证的签名证据回执。

可以做什么
抓取公开 HTTP(S) 来源，保留原始字节，可选固定某段引文或 JSON Pointer，并返回签名回执（消耗配额）。封装调用方已持有的 SHA-256 哈希，用于没有 URL 的内容（消耗配额）。无需密钥即可验证回执是否真实、未被篡改及其覆盖的字节。无需密钥即可读取回执的来源、封存段落、签名状态和比特币锚定状态。
适用场景
适合需要证明某个网页、PDF 或 JSON 字段在某一时刻确实存在，并把回执交给他人、让对方无需信任厂商后台即可核验的场景。适用于申报文件、订阅源、API 和文章页面；不适用于依赖 JavaScript 渲染的页面或社交媒体帖子。
运行要求
远程 MCP 端点，无需安装。验证和读取回执不需要凭据。抓取和封装需要 Elucora API 密钥，以 Bearer 令牌放在 Authorization 请求头中。免费额度为每月 500 份回执，无需信用卡。需要能访问被抓取的来源。
安装前请注意
抓取会向外部 URL 发起请求并消耗账户每月配额，建议保留人工审批步骤。API 密钥是放在 Authorization 请求头中的机密。抓取瞬间需信任 Elucora；回执只证明完整性、签发方和时间，不证明来源内容真实，也不作为法庭可采证据。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Elucora Evidence API，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.elucora%2Fevidence/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "elucora-evidence-api": {
      "type": "http",
      "url": "https://elucora.com/mcp"
    }
  }
}

README

Elucora Evidence MCP Server

Capture a public web source and return a portable, cryptographically signed evidence receipt.

Elucora is a hosted MCP server. There is nothing to install: point your client at https://elucora.com/mcp. Two of the four tools need no API key at all, so a client can verify and read receipts before anyone signs up for anything.

An agent can seal the exact page, PDF, or JSON field behind a claim, hand the receipt to someone else, and have them verify it without trusting Elucora's dashboard or its API.

Tools

ToolKey requiredWhat it does
elucora_verifyNoChecks whether a receipt is genuine and unaltered, and what source bytes it covers.
elucora_get_receiptNoReads a receipt: source, sealed passage, signature status, Bitcoin anchor state.
elucora_captureYesFetches a public HTTP(S) source, preserves the original bytes, optionally pins an exact quote or JSON Pointer, and returns a signed receipt. Consumes quota and contacts the source.
elucora_attestYesSeals a SHA-256 hash the caller already holds, for content with no URL. Proves the content existed then and has not changed since — not where it came from. Consumes quota.

The free tier is 500 receipts a month with no card.

Connecting

elucora_verify and elucora_get_receipt work with no credentials. For the two tools that contact a source or spend quota, create an API key at elucora.com/dashboard/keys, then:

json
{  "mcpServers": {    "elucora": {      "url": "https://elucora.com/mcp",      "headers": { "Authorization": "Bearer elu_live_..." }    }  }}

The server implements stateless Streamable HTTP, protocol version 2025-11-25.

Hosts should keep a human approval step before elucora_capture: it makes a request to an external URL and consumes the account's monthly quota.

What a receipt proves

  • The captured bytes and the selected evidence match their recorded SHA-256 hashes
  • Elucora issued the receipt and it has not been altered since, by ES256 signature over RFC 8785 canonical JSON
  • The entry is in a public hash-linked log, published as signed checkpoints outside Elucora
  • When a timestamp authority is configured, an RFC 3161 token binds the entry to an independently signed time, and entry digests are submitted to OpenTimestamps for Bitcoin anchoring

A valid receipt proves integrity, issuer, and time. It does not prove that the source was telling the truth.

Limits, stated before you find them

  • Captures are HTTP, not a browser. A page that renders its content with JavaScript is captured as the shell the server sent. Filings, feeds, APIs and article pages are exactly right; single page applications and social posts are not.
  • Elucora is trusted at the moment of capture. The receipt proves what Elucora was served. Everything after that instant is verifiable without trusting Elucora at all.
  • No affidavit. Nothing here is offered as court-admissible; that is a matter for a court and its rules, not for a vendor.
  • One operator, and a young log. Both are publicly countable at elucora.com/transparency.

Verifying without Elucora

Every receipt carries jwks_url, and verification keys are published at /.well-known/jwks.json. Any ES256 implementation can check a receipt offline. The public verifier for a receipt lives at /verify/{id}.

Links

来源：README.md，提交 24e5993

工具

0
SourceWeft 尚未读取此服务器的工具。

版本历史

1
  1. v1.4.0最新Sep 16, 2026

评分

已满足适用检查项的 85%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分