Elucora Evidence API

com.elucora由 elucora.com 發布官方發布者v1.4.0更新於 Oct 24, 2026

Capture a web source, or seal a hash you hold, into a signed receipt anyone can verify offline.

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取安全與監控

概覽

AI 產生的概覽

託管型 MCP 伺服器，可擷取公開網頁來源，或將 SHA-256 雜湊封存為可離線驗證的簽章證據回執。

可以做什麼
擷取公開 HTTP(S) 來源、保留原始位元組，可選擇固定某段引文或 JSON Pointer，並回傳簽章回執（消耗配額）。封存呼叫端已持有的 SHA-256 雜湊，用於沒有 URL 的內容（消耗配額）。無需金鑰即可驗證回執是否真偽、是否遭竄改及其涵蓋的位元組。無需金鑰即可讀取回執的來源、封存段落、簽章狀態與比特幣錨定狀態。
適用情境
適合需要證明某個網頁、PDF 或 JSON 欄位在某一時點確實存在，並把回執交給他人、讓對方無須信任廠商後台即可查驗的情境。適用於申報文件、訂閱源、API 與文章頁面；不適用於以 JavaScript 渲染的頁面或社群貼文。
執行需求
遠端 MCP 端點，無需安裝。驗證與讀取回執不需要憑證。擷取與封存需要 Elucora API 金鑰，以 Bearer 權杖放在 Authorization 標頭中。免費方案每月 500 份回執，不需信用卡。需要能連線至被擷取的來源。
安裝前請注意
擷取會向外部 URL 發出請求並消耗帳戶每月配額，建議保留人工核准步驟。API 金鑰是放在 Authorization 標頭中的機密。擷取當下需信任 Elucora；回執只證明完整性、簽發者與時間，不證明來源內容為真，也不作為法院可採證據。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Elucora Evidence API，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.elucora%2Fevidence/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "elucora-evidence-api": {
      "type": "http",
      "url": "https://elucora.com/mcp"
    }
  }
}

README

Elucora Evidence MCP Server

Capture a public web source and return a portable, cryptographically signed evidence receipt.

Elucora is a hosted MCP server. There is nothing to install: point your client at https://elucora.com/mcp. Two of the four tools need no API key at all, so a client can verify and read receipts before anyone signs up for anything.

An agent can seal the exact page, PDF, or JSON field behind a claim, hand the receipt to someone else, and have them verify it without trusting Elucora's dashboard or its API.

Tools

ToolKey requiredWhat it does
elucora_verifyNoChecks whether a receipt is genuine and unaltered, and what source bytes it covers.
elucora_get_receiptNoReads a receipt: source, sealed passage, signature status, Bitcoin anchor state.
elucora_captureYesFetches a public HTTP(S) source, preserves the original bytes, optionally pins an exact quote or JSON Pointer, and returns a signed receipt. Consumes quota and contacts the source.
elucora_attestYesSeals a SHA-256 hash the caller already holds, for content with no URL. Proves the content existed then and has not changed since — not where it came from. Consumes quota.

The free tier is 500 receipts a month with no card.

Connecting

elucora_verify and elucora_get_receipt work with no credentials. For the two tools that contact a source or spend quota, create an API key at elucora.com/dashboard/keys, then:

json
{  "mcpServers": {    "elucora": {      "url": "https://elucora.com/mcp",      "headers": { "Authorization": "Bearer elu_live_..." }    }  }}

The server implements stateless Streamable HTTP, protocol version 2025-11-25.

Hosts should keep a human approval step before elucora_capture: it makes a request to an external URL and consumes the account's monthly quota.

What a receipt proves

  • The captured bytes and the selected evidence match their recorded SHA-256 hashes
  • Elucora issued the receipt and it has not been altered since, by ES256 signature over RFC 8785 canonical JSON
  • The entry is in a public hash-linked log, published as signed checkpoints outside Elucora
  • When a timestamp authority is configured, an RFC 3161 token binds the entry to an independently signed time, and entry digests are submitted to OpenTimestamps for Bitcoin anchoring

A valid receipt proves integrity, issuer, and time. It does not prove that the source was telling the truth.

Limits, stated before you find them

  • Captures are HTTP, not a browser. A page that renders its content with JavaScript is captured as the shell the server sent. Filings, feeds, APIs and article pages are exactly right; single page applications and social posts are not.
  • Elucora is trusted at the moment of capture. The receipt proves what Elucora was served. Everything after that instant is verifiable without trusting Elucora at all.
  • No affidavit. Nothing here is offered as court-admissible; that is a matter for a court and its rules, not for a vendor.
  • One operator, and a young log. Both are publicly countable at elucora.com/transparency.

Verifying without Elucora

Every receipt carries jwks_url, and verification keys are published at /.well-known/jwks.json. Any ES256 implementation can check a receipt offline. The public verifier for a receipt lives at /verify/{id}.

Links

來源：README.md，提交 24e5993

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v1.4.0最新Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分