Metadata-Version: 2.5
Name: evidentia-mcp
Version: 0.13.0
Summary: Model Context Protocol (MCP) server for Evidentia — exposes gap analysis, risk generation, explanation, and OSCAL emit to MCP-aware AI clients (Claude Desktop, Claude Code, ChatGPT, etc.)
Project-URL: Homepage, https://github.com/polycentric-labs/evidentia
Project-URL: Repository, https://github.com/polycentric-labs/evidentia
Project-URL: Issues, https://github.com/polycentric-labs/evidentia/issues
Project-URL: Changelog, https://github.com/polycentric-labs/evidentia/blob/main/CHANGELOG.md
Author-email: Allen Byrd <allen@allenfbyrd.com>
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: ai-agent,compliance,grc,mcp,model-context-protocol
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
Classifier: Typing :: Typed
Requires-Python: <3.15,>=3.12
Requires-Dist: evidentia-ai<0.14.0,>=0.13.0
Requires-Dist: evidentia-collectors<0.14.0,>=0.13.0
Requires-Dist: evidentia-core<0.14.0,>=0.13.0
Requires-Dist: mcp<3.0,>=2.2.0
Description-Content-Type: text/markdown

# evidentia-mcp

Model Context Protocol server for Evidentia. It exposes 15 tools for catalog reads, gap analysis, continuous monitoring, local evidence ingestion and artifact verification.

## Quick start

```bash
pip install evidentia[mcp]
evidentia mcp doctor
evidentia mcp serve
```

The default transport is stdio. HTTP and SSE are also supported. For bind settings, client configuration and scope registries, see [MCP client setup](../../docs/wiki/2-guides/mcp-client-setup.md).

## Tool surface

| Tool | Purpose |
|---|---|
| `list_frameworks` | List catalog metadata |
| `get_control` | Read one catalog control |
| `gap_analyze` | Analyze a local inventory |
| `gap_diff` | Compare gap reports |
| `conmon_list_cadences` | List continuous-monitoring cadences |
| `conmon_next_due` | Calculate a cadence due date |
| `conmon_check_state` | Read cadence state |
| `conmon_health` | Report cadence health |
| `gap_analyze_sarif` | Emit gap results as SARIF |
| `collect_ocsf` | Ingest a local OCSF file |
| `tprm_vendor_list` | List local vendor records |
| `poam_list` | List local POA&M records |
| `verify_signed_artifact` | Verify an Evidentia signed artifact |
| `conmon_series` | Read a cadence evidence series |
| `get_catalog_native` | Read a validated native catalog bundle at an exact digest |

The [generated tool reference](../../docs/wiki/4-reference/mcp-tools.md) records signatures. Existing tool names and schemas retain the [append-only contract](../../docs/api-stability.md#mcp-tool-contract).

## Scope and source handling

`get_catalog_native` requires a configured CIMD registry and an explicit literal grant for that tool. Missing registries and wildcard grants do not authorize it. Its only arguments are `framework_id` and `bundle_sha256`; it cannot import, download or accept a source path. A stale digest returns a fixed tool error. Default registry migration does not add the new grant.

The existing fourteen tools keep their established no-registry behavior. With a registry, identity and scope checks run before handlers and signing. CIMD scope metadata is not client authentication; use the documented authenticated transport boundary for remote access. File-taking tools remain restricted by `--allow-root`.

Optional signed outputs bind the delivered payload under the existing envelope. Check the signature and the documented envelope limits before trusting an output. Credentials are not accepted in tool arguments.

## License

Apache-2.0. See the workspace root LICENSE file. Native source documents retain their own notices and terms.
