Irontrellis Evidence

IronTrellis Evidence MCP server

IronTrellis (formerly Continuity) keeps a checkable record of who may act for whom, and which duties survive when an AI agent is replaced.

irontrellis-evidence is a stdio MCP (Model Context Protocol) server with one tool, irontrellis_collect_evidence, that copies operator-selected files into a protected evidence packet if the configured agent still holds the authority in a format-2 IronTrellis history (format 2 is the history format this release writes). One operation id is one operation, so a retry reconciles the original attempt instead of copying again.

Need several approved tools, or tools the model may call repeatedly? Use @ramex-labs/irontrellis-mcp-gateway (exactly-once jobs and per-call mode). This package is the smallest complete example of the same boundary: your application chooses the agent, the source files, the destination and the key before launching the server; none of them is a tool argument. Concepts: docs/PRINCIPLES.md, docs/GLOSSARY.md.

This is 1.0.0-rc.2.3; install it from the next tag.

What happens, call by call

The quickstart below builds this case and runs its first two steps: an agent, bea, holds a grant to collect the evidence packet for incident:42, and one input file is selected.

60-second quickstart

npm install -g @ramex-labs/irontrellis-mcp@next   # provides irontrellis-evidence (alias irontrellis-mcp), -setup and -demoirontrellis-evidence-setup /absolute/new-case     # synthetic input, disposable Ed25519 key, format-2 history, gateway.jsonirontrellis-evidence-demo /absolute/new-case/gateway.json

Expected: Tools: irontrellis_collect_evidence, then a RECORDED packet on the first call and RECONCILIATION_ONLY on the repeat, with packetVerified: true both times. To connect another MCP client, configure it to launch irontrellis-evidence --config /absolute/new-case/gateway.json (stdio).

Keep the case directory private; setup refuses to overwrite an existing directory. All three commands take --help and --version. A refusal (an existing target, a missing parent, a configuration that is missing, not 0600 or not valid) is one JSON line on stderr with exit code 2, {"status":"REFUSED","reason":<CODE>,"detail":<why>} (the server's own line names GATEWAY_CONFIGURATION_UNAVAILABLE as its reason and may add the underlying code), where detail names the file, field or limit at fault and never echoes configuration values or keys.

The tool

irontrellis_collect_evidence { operationId, resource }

Annotations: readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false. It creates files and never deletes any; repeating an id copies nothing.

An MCP tool error is a reply with isError: true. externalOutcome, which RECORDED, RECONCILIATION_ONLY and OUTCOME_UNKNOWN replies carry, is always NOT_PROVEN: a packet proves which selected bytes were copied, not that their contents are true.

Configuration

gateway.json (0600) has exactly these fields. Every choice is the operator's.

The copy is bounded: at most 8 files, 64 KiB each, 256 KiB in total, into outputDirectory/<sha256(operationId)>/.

Embedding

createEvidenceServer(loadEvidenceTool(configFile, { additionalPolicy? })) returns an SDK Server (@modelcontextprotocol/server); serveEvidence(tool) serves it on stdio, to 2026-07-28 and 2025-era clients alike, behind a strict-JSON input guard (16 KiB frames, no duplicate keys, 5-second frame deadline, at most 1,024 messages in any 60 seconds). Input that breaks the guard never reaches the tool: the server stops with exit code 2.

The server refuses at startup rather than serving a configuration it cannot verify (GATEWAY_CONFIGURATION_UNAVAILABLE, exit 2). A legacy or format-1 history opens read only and the tool does not act on it; migrate it with irontrellis migrate.

Limits

Check it yourself

From a clone of the repository:

pnpm installpnpm -r buildpnpm --filter @ramex-labs/irontrellis-mcp test

The tests drive the server over stdio, through a real MCP client and with raw frames: a retry, a revoked grant, a retired session, a replaced key, attempts to substitute the actor, paths or resource, duplicate keys, oversized or unfinished frames, and a message flood. They check this package as it ships. They do not test your deployment, and the limits stated above still apply.

Dependencies: @ramex-labs/irontrellis, @modelcontextprotocol/server and @modelcontextprotocol/client (2.2.0, pinned exactly). Apache-2.0.

Last reviewed: 24 October 2026. This page is revisited at each release.