What it does
Evidence MCP gives an AI assistant a typed operation, archive_source(url, note), for keeping a source it has already found. The assistant chooses whether the source matters; deterministic code performs the preservation. The resulting artifact keeps the downloaded bytes together with where they came from, when they were retrieved, and a SHA-256 hash.
One call validates a public HTTP or HTTPS URL, downloads under size and redirect limits, hashes the bytes, and writes the artifact and metadata to local storage. A complete artifact folder appears through an atomic rename. The local copy is canonical; the server then attempts to synchronize provenance metadata to a private GitHub repository. It sends metadata, not the archived file.
The metadata includes the original and final URL, retrieval time, content type, byte count, note, and synchronization result. Identical bytes reuse the existing record. That deduplication does not add a second URL to the first record, so preserving identical responses is not the same as maintaining every source relationship.
A successful local save with a failed remote sync returns an explicit warning and keeps the local artifact. It does not report full success or discard the preserved bytes. Local storage and GitHub are separate systems without a shared transaction.
This tool does not search the web, summarize sources, crawl sites, or capture rendered pages. An HTML response is saved as raw server-returned HTML, not as a browser snapshot with its images and scripts.
What I worked on
I worked on the server engineering: the MCP surface, download procedure, provenance fields, storage behavior, GitHub synchronization, and failure disclosure. This is an AI-assisted personal engineering experiment. The important boundary is between the model’s decision to archive and the procedure that actually downloads, stores, hashes, and reports the result.
What has been checked
The repository’s automated tests run offline with a fake web, fake DNS, and fake GitHub responses. They cover URL restrictions, redirects, declared and streamed size limits, byte deduplication, filenames, atomic storage, authentication failures, remote conflicts, and partial-success reporting. Those dependencies are controlled substitutes, not authenticated production GitHub-sync evidence.
The README also documents exploit demonstrations through a real MCP client talking to the real local server. The private-address demonstration records zero requests reaching the fake private service through the archive tool. Separate forced failures check that the client receives fixed error messages rather than paths, secrets, raw exception text, or tracebacks. These establish the tested refusal and disclosure behavior, not a comprehensive security guarantee.
What remains unproven
The README explicitly leaves DNS rebinding incompletely prevented: the hostname is checked and then resolved again when the HTTP client connects. Other IPv6 transition formats are not fully handled. Timeouts apply per connect/read operation rather than as a total download deadline.
Remote synchronization is not atomic with local storage, simultaneous identical calls can produce a conflict, and there is no retry queue. The evidence store is not encrypted; notes are included in the private remote metadata. A hash identifies the bytes saved. It does not verify the source’s truth, authenticity, or continued availability.
The README and corresponding archive, storage, security, and MCP-client tests are the evidence for this record. No live credential or private evidence artifact is published here.