Skip to main content
Glama
Labeeb2339

local-evidence-mcp

by Labeeb2339
OverviewSchemaRelated ServersScoreDiscussions
Python

Local Evidence MCP

A policy-constrained local evidence boundary for MCP clients.

Local Evidence MCP boundary map showing three allowlisted example files, five advertised tools, zero execution capabilities, and an 18-test control inventory

Generated from the checked-in synthetic policy, server tool definitions, and named test inventory. It shows the intended capability boundary; the 18 tests are executable checks, not a completeness score or an independent security audit.

Local Evidence MCP retrieves a small, policy-gated evidence set and records reviewed conclusions without giving an agent general filesystem access.

This repository demonstrates a practical RAG and agent-harness pattern:

  • policy-gated reads instead of whole-vault access;

  • redaction before content reaches the client or search index;

  • optional local Ollama embeddings with deterministic lexical fallback;

  • content-digest embedding caches that do not store source text;

  • create-only notes and an append-only lesson ledger;

  • newline-delimited JSON-RPC over stdio with no runtime dependencies; and

  • explicit rejection of likely credentials and raw challenge flags.

The included vault and policy are synthetic examples. No personal vault data, private policy, embedding cache, agent configuration, or credentials are part of this repository.

Architecture

flowchart LR
    Client["MCP client"] -->|"JSON-RPC over stdio"| Server["Local Evidence MCP"]
    Server --> Policy["Policy validation"]
    Policy --> Guard["Path and symlink guard"]
    Guard --> Read["Allowlisted UTF-8 notes"]
    Read --> Redact["Credential and raw-flag redaction"]
    Redact --> Lexical["Lexical ranking"]
    Redact --> LocalEmbed["Optional loopback embeddings"]
    Lexical --> Results["Source-labelled results"]
    LocalEmbed --> Results
    Server -->|"O_EXCL"| Create["Create-only drafts"]
    Server -->|"O_APPEND"| Append["Append-only lessons"]

The server advertises no shell, SSH, browser, messaging, remote retrieval, or arbitrary filesystem capability. The only optional HTTP call is to an unauthenticated loopback embedding endpoint.

Related MCP server: Jusratio Case File

Quick start

Requirements: Python 3.11 or newer. Ollama is optional.

git clone https://github.com/Labeeb2339/local-evidence-mcp.git
cd local-evidence-mcp
./run_server.cmd --check

On macOS or Linux:

chmod +x run_server.sh
./run_server.sh --check

The default health check uses examples/vault and examples/policy.example.json. If Ollama is not available, the check reports that lexical fallback is active; retrieval still works.

Try a JSON-RPC request directly:

'{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | ./run_server.cmd

Configure your own evidence root

Copy the example policy to a local, ignored file and edit only the relative paths that should be visible:

Copy-Item examples/policy.example.json policy.json
$env:LOCAL_EVIDENCE_ROOT = "D:\path\to\your\notes"
$env:LOCAL_EVIDENCE_POLICY = "$PWD\policy.json"
./run_server.cmd --check

The policy separates four decisions:

Section

Purpose

read.files

Exact files the server may read

read.globs

Non-recursive relative globs, such as notes/*.md

excluded

Paths denied even if another rule matches

write

One create-only directory and one append-only file

Limits cap file size, result count, write size, index size, and chunk length. Absolute paths, traversal components, NTFS stream syntax, recursive read globs, and linked files are rejected.

To force offline lexical mode, set embeddings.enabled to false. When embeddings are enabled, the endpoint must use plain HTTP on 127.0.0.1, localhost, or ::1; remote and credential-bearing URLs are refused.

MCP client configuration

After installing the package with python -m pip install -e ., a client can launch it with the console script:

{
  "mcpServers": {
    "local-evidence": {
      "command": "local-evidence-mcp",
      "args": [
        "--root",
        "<absolute-path-to-evidence-root>",
        "--policy",
        "<absolute-path-to-local-policy.json>"
      ]
    }
  }
}

Keep the real policy and evidence root outside version control. The example policy is safe to publish because it references only the included synthetic fixtures.

Tools

Tool

Boundary

evidence_status

Reports configured capabilities and exclusions

evidence_search

Searches sanitized allowlisted chunks

evidence_read

Reads one sanitized allowlisted file

evidence_create_note

Creates a new draft with exclusive-create semantics

evidence_append_lesson

Appends one evidence-backed entry to a fixed ledger

Tool input is checked again at runtime instead of relying only on the JSON schemas presented to the MCP client.

Security properties

Risk

Control

Broad filesystem exposure

Relative allowlist plus resolved-root containment

Traversal or linked-file escape

Component validation and symlink rejection

Secret leakage in reads

Redaction before direct output and chunking

Sensitive query or durable write

Credential and raw-flag rejection

Destructive overwrite

`O_CREAT

Rewrite of the lesson ledger

Fixed destination opened with O_APPEND

Embedding data leakage

Loopback-only endpoint and vector-only cache

Prompt injection in notes

Evidence warnings and no execution tools

Regex redaction is defense in depth, not a substitute for keeping secrets out of the evidence root. Local operating-system permissions still define who can start the process and edit its policy.

Test

The full suite uses only the standard library:

$env:PYTHONPATH = "src"
python -m unittest discover -s tests -v
python scripts/generate_readme_assets.py --check

CI runs the suite on Python 3.11, 3.12, and 3.13 and performs a Gitleaks scan. Tests cover path containment, exclusions, redaction, lexical fallback, semantic ranking, plaintext-free caching, create-only and append-only writes, sensitive input rejection, symlink handling, and MCP protocol responses.

Design scope

This is a compact reference implementation, not a hosted vector database or an enterprise authorization service. It's most useful when an assistant needs a small local knowledge boundary that degrades safely when the embedding service is offline.

License

MIT

Available Tools

5 tools
evidence_append_lessonC

Append one evidence-backed lesson to the configured ledger.

ParametersJSON Schema
NameRequiredDescriptionDefault
lessonYes
subjectYes
source_refsNo
verified_evidenceYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description bears full responsibility for disclosing behavioral implications. It mentions 'append' which is a mutation, but does not disclose side effects, idempotence, or any constraints on the ledger.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler or redundant information, making it highly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has four parameters and no output schema, yet the description omits parameter meanings, return behavior, and error conditions. The minimal detail may leave an AI agent uncertain about how to correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the description does not explain the meanings of subject, lesson, verified_evidence, or source_refs. The agent must infer semantics from parameter names alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the verb 'append', the resource 'evidence-backed lesson', and the destination 'configured ledger', making the primary function clear. However, it does not explicitly differentiate from sibling tools like evidence_create_note, though the resource type differs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no instructions on when to use this tool in preference to siblings such as evidence_read or evidence_search. No prerequisites, exclusions, or alternative scenarios are mentioned, leaving the agent without explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evidence_create_noteB

Create a new evidence note in one configured directory; never overwrite.

ParametersJSON Schema
NameRequiredDescriptionDefault
dateNo
slugYes
tagsNo
titleYes
summaryYes
decisionYes
evidenceYes
next_actionsYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses that the tool never overwrites existing notes, which is a key behavioral trait. However, it does not explain what happens on duplicate slugs, permission requirements, or the return value, missing important details for a creation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently communicates the core purpose and a critical guarantee. No wasted words; it is appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with eight parameters and no output schema, the description is too sparse. It omits field meanings, on-conflict behavior (beyond 'never overwrite'), and return details, leaving agents without enough context to invoke it reliably. Sibling tool names help, but the description itself under-delivers.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero coverage, and the description does not mention any of the eight parameters (e.g., slug, summary, decision, next_actions). The agent gets no additional semantic context for required fields, making it difficult to construct valid inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create a new evidence note') and resource, and adds a distinguishing guarantee ('never overwrite'). This separates it from siblings that read, search, or append lessons, providing a specific and unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies creation context via 'Create a new,' which distinguishes it from read/search/append siblings, but it doesn't explicitly state when to use this tool vs alternatives or mention exclusions. There is no mention of when not to use it or references to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evidence_readA

Read one allowlisted UTF-8 note with potential credentials and raw challenge flags redacted.

ParametersJSON Schema
NameRequiredDescriptionDefault
relative_pathYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of disclosing behavior. It mentions redaction of credentials and challenge flags, which is valuable, but does not cover error handling, path validation, or what happens if the note is not allowlisted. The description provides some behavioral context beyond the raw schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the verb and resource, with no redundant phrases. Every word adds meaning, making it an exemplary model of conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with one parameter and no output schema, the description covers the essential functionality and important behavior (redaction). While it could mention error conditions or path resolution, the tool's simplicity means this level of detail is largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter, relative_path, with no description and 0% coverage. The tool description implies the path identifies the note but does not explicitly explain its format, what 'relative' refers to, or allowlist criteria. The parameter name is self-explanatory, and 'allowlisted' adds a constraint, providing marginal compensation for the lack of schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool reads a note, with specific qualifiers (allowlisted UTF-8, redaction) that distinguish it from sibling tools like evidence_create_note, evidence_search, and evidence_append_lesson. The verb 'Read' and resource 'note' make the purpose immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that this tool is used for reading existing notes by relative path, but it does not explicitly state when to use it versus alternatives. Sibling tool names provide context, but the description itself offers no guidance such as 'use evidence_search to find notes before reading.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evidence_statusA

Show the configured evidence boundary, retrieval mode, and write policy.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. The verb 'show' indicates a non-destructive read operation, which is a useful behavioral cue. However, it does not disclose other potential behaviors such as authentication requirements, data source details, or what happens if no configuration exists. For a zero-parameter status tool, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one concise sentence with no filler. It front-loads the action ('Show') and specifically lists the three configuration aspects covered. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (no parameters, no output schema, no annotations), the description provides sufficient context: it states what information is shown. It could ideally clarify the output format or whether it returns a summary, but for a simple status tool, the description is nearly complete. Minor gap is absence of return-value details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema is trivially covered. Per baseline, 0 params rate 4. The description adds no parameter-specific meaning because there are none to describe.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: to show configured evidence boundary, retrieval mode, and write policy. It uses a specific verb ('show') and resource ('configured evidence...'), and it distinguishes from siblings like evidence_read (which likely reads evidence content) and evidence_create_note (which creates notes).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (when needing to inspect current configuration) but provides no explicit guidance on when not to use it or alternatives. There are no exclusions or comparisons to sibling tools, so usage context is inferred rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.5/5.0
Disambiguation5/5

Each tool has a distinct, non-overlapping purpose: read a single note, create a note, check status, search notes, and append a lesson. There is no ambiguity about which tool to use for a given operation.

Naming Consistency4/5

All tools share the 'evidence_' prefix and mostly follow a verb_noun pattern (read, create_note, search, append_lesson). 'evidence_status' is a minor deviation as it uses a noun rather than an explicit verb like 'get_status' or 'show_status', but the overall pattern is consistent and readable.

Tool Count5/5

With 5 tools, the server is well-scoped for its purpose of managing local evidence notes. Each tool covers a core operation without unnecessary bloat, making the set easy to navigate.

Completeness4/5

The tool set covers the primary lifecycle: create, read, search, and append lessons, plus status. It lacks explicit update/delete operations, but given the 'never overwrite' policy and the append-only nature of lessons, these omissions are likely intentional and not a major gap.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • FilePilot AI

    cuiheng511
    A
    license
    Not graded
    quality
    A
    maintenance
    Local-first MCP server for safely searching, reading, summarizing, tagging, deduplicating, and organizing local files with scoped access, read-only defaults, and dry-run plans.
    16
    MIT

  • Change Trace MCP

    Canlendula
    A
    license
    A
    quality
    B
    maintenance
    A local-first, model-neutral MCP server for collecting and normalizing change-scoped release evidence. It provides deterministic Git change summaries, evidence collection, and review bundles for agent review.
    7
    18
    Apache 2.0

  • TheUnderdark

    kulabisbeebellkbbai-oss
    F
    license
    Not graded
    quality
    B
    maintenance
    An MCP server exposing narrowly scoped storage workflows with Overseer approval integration and redacted execution evidence, currently in fixture-only development for testing via stdio.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Labeeb2339/local-evidence-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server