Agent evidence

io.github.probityai由 GitHub 账号 probityai 发布v0.2.5更新于 Nov 3, 2026

Offline, read-only tools that verify AI claims against evidence and replay conformance vectors.

已验证STDIO仅桌面开发者工具安全与监控AI 与机器学习

概览

AI 生成的概览

离线、只读的 MCP 服务器，让助手依据调用方提供的证据字节核验关于 AI 系统的声明，并重放一致性测试向量。

可以做什么
  • 针对调用方提供的证据字节核验单条声明，或运行内置示例声明，返回 supported、contradicted 或 not_established。
  • 列出随附的向量语料库及其套件版本与向量数量，用参考验证器分页重放某个语料库，并解释单个向量的清单条目、所测条件与输入字节。
  • 按精确键在已发布词表中查询术语，找不到时给出相近键建议。
  • 检查某个产物是否具有 TEA、CycloneDX 或 in-toto 文档中列出的摘要值。
  • 将 JSON 文档规范化为 RFC 8785 字节，并用调用方信任的 Ed25519 密钥验证 DSSE 信封。
适用场景
适合审计人员、事件复核人员和依赖方，需要对 AI 声明获得可重放的判定；也适合希望以同样方式检查自身记录的工具作者。适用于证据已固定在本地、需要离线复核的场景。
运行要求
作为本地 stdio 进程运行，从 PyPI 包 agent-evidence-mcp 安装。README 的快速开始需要 Python 3.11 或更高版本、uv 以及验证器包 probity-verify。未声明任何认证、环境变量或请求头。
安装前请注意
按其说明为只读且离线：不抓取也不写入任何内容。判定完全取决于调用方提供的证据字节，因此 supported 结果的可信度仅等同于该输入。DSSE 验证只信任调用方提供的 Ed25519 密钥。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Agent evidence，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Probity

[CI] [PyPI] [Downloads] [Licence] [Stars]

Open tools that check claims about AI agents against evidence you pinned: an offline verifier today, with the observer joining this repository. The standard layer (corpus, vocabulary, admission rules and crates) lives in https://github.com/probityai/agent-evidence-vectors.

[A report of seven passages with one missing. A log reader reads what the report holds, passes over the gap and ends in a check. probity-verify reads the report against the source capture, stops at the gap and returns contradicted, reason selected_span_missing_from_record.]

It's for auditors, incident reviewers and relying parties who need a decision they can replay, and for tool authors who want their records checked the same way.

Install the released verifier: uv add probity-verify==0.2.4, then pip install probity-verify==0.2.4.

Verified by Probity (github.com/probityai/probity). The probityai command line is released: uv add probityai==0.1.0, then pip install probityai==0.1.0.

Quick start

Check a sample claim with the released package. You need Python 3.11 or newer and uv; there is nothing to clone:

sh
samples="$(uvx --from probity-verify==0.2.4 python -c 'import importlib.resources as r; print(r.files("probity_verify") / "samples")')"uvx probity-verify==0.2.4 "$samples/case.json" --policy "$samples/policy-june.json"

It prints a decision packet that opens:

text
Probity decision packet v1Case: "source-coverage-demo"Claim: source_text_coverage/v1Decision: contradictedReason: selected_span_missing_from_record

A selected passage is in the source capture but missing from the stored report. Swap in policy-april.json for not_established, or case-complete.json with policy-complete.json for supported.

Status

memberwhat it isreleased
packages/probity-verifyoffline verifier: supported, contradicted or not_established for a claim against pinned bytes0.2.2 on PyPI
packages/observerrecords what an agent run did into pinned evidence the verifier can check0.1.1 on PyPI (agent-evidence-observer)
packages/ratchetsigned, replayable receipts for improving an agent against held-out cases0.3.2 on PyPI (probity-ratchet)
packages/probityaithe probityai command; probityai verify today, each member adds its own subcommand0.1.0 on PyPI (probityai)

Work on the repository

sh
uv sync --all-packages --all-extrasuv run python -m pytest

Documentation

pageread it for
probity-verifythe verifier, its adapters and its recipes
Repository layoutthe workspace, the probityai command seam, CI and releases
Agent instructionscommands to run before a change
Contributingreporting a problem and opening a pull request

License

Apache-2.0, per directory: each member carries its own LICENSE.

来源：README.md，提交 15b0b4b

工具

9

verify_claim

Verify a claim against evidence

Decide one claim against evidence bytes the caller supplies, with probity-verify.

输入参数case必填policy必填artifacts

verify_sample

Run a bundled sample claim

Run a bundled sample claim: contradicted, not_established or supported.

输入参数scenario必填

list_vector_corpora

List conformance vector corpora

Name every shipped corpus with its suite revision and vector counts where it declares them.

无需输入参数。

run_vectors

Replay a conformance vector corpus

Replay one corpus with the bundled reference verifier; per-vector rows come back in pages.

输入参数limitcorpusoffset

explain_vector

Explain one conformance vector

Return one vector: its manifest entry, the conditions it tests, and its input bytes.

输入参数corpusvector_id必填

lookup_term

Look up a vocabulary term

Look a term up in the released vocabulary by exact key; otherwise suggest close keys.

输入参数term必填

check_artifact_digest

Check an artifact digest against a document

Check that an artifact has a digest a TEA, CycloneDX or in-toto document names.

输入参数document必填artifact_textartifact_base64

canonicalize_json

Canonicalize JSON under RFC 8785

Admit one JSON document and return its RFC 8785 canonical bytes, with the jcs-admit crate.

输入参数profiledocument必填

verify_dsse

Verify a DSSE envelope

Verify a DSSE envelope against Ed25519 keys the caller trusts, with the dsse crate.

输入参数envelope必填thresholdtrusted_keys必填

版本历史

3
  1. v0.2.5最新Nov 1, 2026
  2. v0.2.4Oct 29, 2026
  3. v0.2.0Oct 20, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分
  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分