Vaara MCP Server

Accountable Autonomy.

A verifiable receipt for every autonomous action, checkable by anyone.

Your AI agent transferred the funds, wrote the file, called the tool. Later, someone who does not trust you asks you to prove exactly what it did and why: a regulator, an auditor, a customer after an incident. Your own logs will not settle it, because you could have edited them.

Quick start

pip install vaara                            # Python: CLI, MCP proxy, server

brew tap vaaraio/tap && brew install vaara # macOS: CLI + menu-bar app (built from source) npm install @vaara/client # TypeScript client for the HTTP API

import vaara

@vaara.govern def transfer_funds(to: str, amount: float) -> str: ...

That is the whole thing. Every call to a governed function is risk-scored and decided against your policy before the body runs. An allowed call runs, and the decision, the call, and the outcome land in a hash-chained, tamper-evident record anyone can verify offline, with a signed receipt beside it. Sign the whole trail at export (vaara trail export) for third-party proof. Records persist to ~/.vaara/trail/audit.db by default, so evidence survives restarts. Python 3.10+. The base install carries three runtime dependencies, cryptography, rfc8785 and cbor2, which sign and canonicalise the receipts.

Both deny and escalate raise vaara.Blocked, since an escalation means a human has not answered yet. On a fresh install the example above runs. The default operating point is balanced, which allows below 0.55 and denies above 0.85, and a first call to transfer_funds scores 0.275 with a conformal interval of [0.085, 0.465]. Vaara decides on the interval's upper bound, and with no outcome history that interval is wide, so a riskier call escalates before its point estimate reaches the threshold. Feeding real outcomes back through report_outcome narrows it. The other presets are listed by vaara mode list. To watch decisions without acting on them, start with @vaara.govern(shadow=True).

Check a receipt with nothing installed

vaara.io/verify.html is the receipt explorer, in English and Finnish. A static page and one script, no build step and no dependencies. Paste in a receipt and it recomputes the DSSE pre-authentication encoding, takes its digest, and checks the Ed25519 signature with WebCrypto. The receipt never leaves the tab, nothing uploads, and the page works with the network off, so verification is not a service and Vaara is not a party to it. Save the page with its script and it keeps working.

It also states what a passing check does not establish: that the key belongs to the party you expect, that the signed statement is true, that decided_at means anything without an external time authority, or that one receipt is a whole history.

The explorer on the same page reads the public transparency log straight from your browser. Look a trail head up by digest, or paste a public key to see everything published under it. No account and no sign-in, because the key is the identity. Publishing to that log is opt-in and off by default (vaara trail publish-head), so an absence there means nothing was published rather than nothing happened.

See who else has checked it

vaara.io/conformance.html is the results page. It carries every suite and its verdict, and every party other than the maintainer who ran the checkers and reported what they found in public. Rows are chained, each holding the digest of the row before it, so removing or reordering one breaks every digest after it and the break is visible to anyone. The maintainer cannot take a row down either. A run that disagrees with ours is a row too, with the reason stated, and there is no blacklist.

The aggregate runner grades every suite at once, and grades another implementation's vectors the same way:

git clone https://github.com/vaaraio/vaara && cd vaara

pip install cryptography rfc8785 # enough for 53 of the 55 suites; the two that skip name their extra python scripts/conformance_runner.py # grade the reference corpus python scripts/conformance_runner.py --vectors-dir ./your_vectors # grade your own

It prints a prefilled link at the end of every run, so asking for a row takes one click. The named, versioned rule set, what a pass does and does not establish, and the full suite list are in docs/conformance-profile.md.

Prefer the explicit pipeline?

The decorator drives the same engine you can call directly when you want the decision object in hand.

from vaara.pipeline import InterceptionPipeline

pipeline = InterceptionPipeline() result = pipeline.intercept( agent_id="agent-007", tool_name="fs.write_file", parameters={"path": "/etc/service.yaml", "content": "..."}, agent_confidence=0.8, ) if result.allowed: pipeline.report_outcome(result.action_id, outcome_severity=0.0) else: print(result.reason)

Every call gets a risk score and an allow / block / escalate decision against your policy, then the call, the decision, and the real outcome are written to the audit trail. report_outcome closes the loop: the scorer reweights based on which signals actually predicted the outcome. Every release carries SLSA v1 build provenance as a GitHub artifact attestation (SLSA Build Level 2), and the PyPI wheel is the same file, so gh attestation verify vaara- -py3-none-any.whl --repo vaaraio/vaara checks either download. Optional ML classifier: pip install 'vaara[ml]'.

Verify it without trusting the producer

Writing a trail is the easy half. The half that matters is letting someone who does not trust you check it, with no key, no access, and none of your code. Every Vaara record is content-addressed and fail-closed on authenticity, and ships with public conformance vectors plus a standalone checker that imports no Vaara code, so an independent party reproduces every verdict offline.

vaara verify-bundle evidence-bundle.json

ok only when a signature is actually established, not merely present in a log. The same property drives the standards work behind the Vaara Receipt Internet-Draft: evidence that holds up for someone who runs none of your software. The full verifier set, the trust model for each verb, and where trust comes from in each case are in docs/verifying-evidence.md.

To check that claim yourself, without installing Vaara, run the standalone checker against the published vectors. Its only dependencies are cryptography and rfc8785:

git clone https://github.com/vaaraio/vaara

cd vaara pip install cryptography rfc8785 # the checker's only dependencies python tests/vectors/external_evidence_v0/_check_independent.py

It re-derives every verdict from the receipt bytes and the public key alone. The output shows the property the trail is built for: a receipt dropped from inside a declared boundary is a provable gap from the held set, with no issuer access and no external witness.

For the whole loop in one runnable file, produce a signed record, verify it yourself, then watch a single forged byte get caught, see examples/prove-it-yourself/. The logs-versus-evidence argument behind it is in docs/logs-vs-evidence.md.

What the evidence looks like

vaara compliance report --db audit.db --format json against a real trail produces an article-level evidence record an auditor reads directly. Articles with no recorded events return evidence_insufficient, not a rubber stamp.

{

"system_name": "Acme HR Assistant", "overall_status": "evidence_insufficient", "trail_integrity": {"size": 105, "chain_intact": true}, "articles": [ {"article": "Article 12(1)", "title": "Record-Keeping (Logging)", "status": "evidence_sufficient", "strength": "strong", "evidence_count": 105}, {"article": "Article 15(1)", "title": "Accuracy, Robustness and Cybersecurity", "status": "evidence_insufficient", "strength": "absent", "evidence_count": 0} ] }

Each verdict carries the threshold-versus-observed snapshot, the rationale, and the underlying records, so a reviewer traces status back to a concrete event. The same data renders as a Notified-Body PDF, a static HTML dashboard, or a Sigstore-signed handoff envelope. See docs/COMPLIANCE.md.

What you get

• Gate every tool call you route through it against your own policy: allow, block, or escalate. Coverage is whatever you wrap; each adapter documents the surface it sees, and the Claude Code plugin states its four explicitly.
• A tamper-evident trail an outside party verifies without trusting your stack, with the chain head anchorable to an external RFC 3161 / eIDAS timestamp so its existence is provable against a clock you do not control.
• Article-level EU AI Act evidence, honest about the gaps instead of papering over them.
• Governance of the model call itself, not only the tools around it: a hardware-rooted inference receipt that a second, different local model cross-checks. This is the sovereign inference harness, new in v1.0.
• Enforcement, not only a record (v1.1.0): a credential broker mints a signed, short-lived credential bound to the attestation digest and scoped to one tool, its argument commitment, and tenant, with typed capability scopes that bound what a call may do. A gateway in front of a protected tool refuses any call without a valid, attestat