Agent evidence

io.github.probityai由 GitHub 帳號 probityai 發布v0.2.5更新於 Nov 3, 2026

Offline, read-only tools that verify AI claims against evidence and replay conformance vectors.

已驗證STDIO僅桌面開發者工具安全與監控AI 與機器學習

概覽

AI 產生的概覽

離線、唯讀的 MCP 伺服器，讓助理依據呼叫端提供的證據位元組核驗關於 AI 系統的主張，並重播一致性測試向量。

可以做什麼
  • 針對呼叫端提供的證據位元組核驗單一主張，或執行內建範例主張，回傳 supported、contradicted 或 not_established。
  • 列出隨附的向量語料庫及其套件版本與向量數量，以參考驗證器分頁重播某個語料庫，並解釋單一向量的清單項目、所測條件與輸入位元組。
  • 以精確鍵在已發布詞彙表中查詢詞彙，找不到時提供相近鍵建議。
  • 檢查某個產物是否具有 TEA、CycloneDX 或 in-toto 文件所列的摘要值。
  • 將 JSON 文件正規化為 RFC 8785 位元組，並以呼叫端信任的 Ed25519 金鑰驗證 DSSE 信封。
適用情境
適合稽核人員、事件複核人員與依賴方，需要對 AI 主張取得可重播的判定；也適合希望以相同方式檢查自身紀錄的工具作者。適用於證據已固定在本地、需要離線複核的情境。
執行需求
以本機 stdio 程序執行，從 PyPI 套件 agent-evidence-mcp 安裝。README 的快速開始需要 Python 3.11 或更新版本、uv 以及驗證器套件 probity-verify。未宣告任何驗證、環境變數或標頭。
安裝前請注意
依其說明為唯讀且離線：不抓取也不寫入任何內容。判定完全取決於呼叫端提供的證據位元組，因此 supported 結果的可信度僅等同於該輸入。DSSE 驗證只信任呼叫端提供的 Ed25519 金鑰。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Agent evidence，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Probity

[CI] [PyPI] [Downloads] [Licence] [Stars]

Open tools that check claims about AI agents against evidence you pinned: an offline verifier today, with the observer joining this repository. The standard layer (corpus, vocabulary, admission rules and crates) lives in https://github.com/probityai/agent-evidence-vectors.

[A report of seven passages with one missing. A log reader reads what the report holds, passes over the gap and ends in a check. probity-verify reads the report against the source capture, stops at the gap and returns contradicted, reason selected_span_missing_from_record.]

It's for auditors, incident reviewers and relying parties who need a decision they can replay, and for tool authors who want their records checked the same way.

Install the released verifier: uv add probity-verify==0.2.4, then pip install probity-verify==0.2.4.

Verified by Probity (github.com/probityai/probity). The probityai command line is released: uv add probityai==0.1.0, then pip install probityai==0.1.0.

Quick start

Check a sample claim with the released package. You need Python 3.11 or newer and uv; there is nothing to clone:

sh
samples="$(uvx --from probity-verify==0.2.4 python -c 'import importlib.resources as r; print(r.files("probity_verify") / "samples")')"uvx probity-verify==0.2.4 "$samples/case.json" --policy "$samples/policy-june.json"

It prints a decision packet that opens:

text
Probity decision packet v1Case: "source-coverage-demo"Claim: source_text_coverage/v1Decision: contradictedReason: selected_span_missing_from_record

A selected passage is in the source capture but missing from the stored report. Swap in policy-april.json for not_established, or case-complete.json with policy-complete.json for supported.

Status

memberwhat it isreleased
packages/probity-verifyoffline verifier: supported, contradicted or not_established for a claim against pinned bytes0.2.2 on PyPI
packages/observerrecords what an agent run did into pinned evidence the verifier can check0.1.1 on PyPI (agent-evidence-observer)
packages/ratchetsigned, replayable receipts for improving an agent against held-out cases0.3.2 on PyPI (probity-ratchet)
packages/probityaithe probityai command; probityai verify today, each member adds its own subcommand0.1.0 on PyPI (probityai)

Work on the repository

sh
uv sync --all-packages --all-extrasuv run python -m pytest

Documentation

pageread it for
probity-verifythe verifier, its adapters and its recipes
Repository layoutthe workspace, the probityai command seam, CI and releases
Agent instructionscommands to run before a change
Contributingreporting a problem and opening a pull request

License

Apache-2.0, per directory: each member carries its own LICENSE.

來源：README.md，提交 15b0b4b

工具

9

verify_claim

Verify a claim against evidence

Decide one claim against evidence bytes the caller supplies, with probity-verify.

輸入參數case必填policy必填artifacts

verify_sample

Run a bundled sample claim

Run a bundled sample claim: contradicted, not_established or supported.

輸入參數scenario必填

list_vector_corpora

List conformance vector corpora

Name every shipped corpus with its suite revision and vector counts where it declares them.

無需輸入參數。

run_vectors

Replay a conformance vector corpus

Replay one corpus with the bundled reference verifier; per-vector rows come back in pages.

輸入參數limitcorpusoffset

explain_vector

Explain one conformance vector

Return one vector: its manifest entry, the conditions it tests, and its input bytes.

輸入參數corpusvector_id必填

lookup_term

Look up a vocabulary term

Look a term up in the released vocabulary by exact key; otherwise suggest close keys.

輸入參數term必填

check_artifact_digest

Check an artifact digest against a document

Check that an artifact has a digest a TEA, CycloneDX or in-toto document names.

輸入參數document必填artifact_textartifact_base64

canonicalize_json

Canonicalize JSON under RFC 8785

Admit one JSON document and return its RFC 8785 canonical bytes, with the jcs-admit crate.

輸入參數profiledocument必填

verify_dsse

Verify a DSSE envelope

Verify a DSSE envelope against Ed25519 keys the caller trusts, with the dsse crate.

輸入參數envelope必填thresholdtrusted_keys必填

版本歷史

3
  1. v0.2.5最新Nov 1, 2026
  2. v0.2.4Oct 29, 2026
  3. v0.2.0Oct 20, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分
  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分