EVIDIQ Clause

Clause decodes agreements and policy documents into plain language and makes the reading checkable. Three mechanisms do the work, and each one is a hard gate rather than a preference:

1. Citations are checked, not trusted. Every statement carries a quote plus character offsets into your document. The server locates the quote verbatim in the caller's document and drops any statement whose quote is not there, reporting citationsDropped. Returning an invented clause is mechanically impossible, not a matter of prompt discipline.

2. The reasoning step is attributable. Inference runs on 0G Compute, only on models whose tee_attested is true, checked against the router's live registry at call time rather than a hardcoded allowlist. Each report records the model, provider address, request id, TDX attestation and the exact cost in wei.

3. The record is sealed. A JCS digest over a closed field set, an EIP-191 signature, chained to the previous report so a removed record shows as a sequence gap, and anchored to 0G Storage. The anchored body is sealed with AES-256-GCM unless anchorInClear is set — the key is returned to you once and is not persisted here; what stays readable on 0G is the manifest (sequence, previous hash, digest, timestamp, compute traces), which is enough for anyone to verify a report you show them.

And because all of that is mechanical, checking is free: verify_report re-verifies the digest, the EIP-191 signature, the chain and every citation against the supplied source — it never calls the model, and it never will.

Status: deployed on the EVIDIQ-only VPS at https://mcp.evidiq.dev/clause/mcp (port 3024), x402 gate enforced. Registered on OKX.AI as Agent #10584 "EVIDIQ Clause" (ASP, under review), 8 services, A2MCP only, no A2A. Registration tx 0x4635fb38…213dd58. Five paid tools settle on X Layer in USDT0; the three free tools (capabilities, verify_report, quote) are free forever and never call the LLM by design.

What it does

• decode_document (0.05 USDT0) — plain-language rendering, section by section. Every rendered statement carries the quoted original span it came from; statements the model cannot quote are never asserted.

• risk_flags (0.10 USDT0) — the seven hazards enumerated: auto-renewal, unilateral change, liability cap, penalty, notice period, assignment, arbitration venue. Each flag: severity, quoted span, why it matters to the reader.

• obligation_calendar (0.10 USDT0) — dated duties extracted into a schedule: what is owed, by whom, when, from which quoted clause. Relative dates resolved against a caller-supplied reference date.

• compare_documents (0.15 USDT0) — two documents diffed on meaning rather than characters, with which side each change favours and the quoted spans on both sides, each verified against its own source.

• verdict_report (0.25 USDT0) — decode + flags + calendar + bottom line, two-pass: an extractor, then an independent reviewing pass that must justify or drop each flag. EIP-191 signed, chained, anchored to 0G Storage, full compute trace.

• capabilities (free) — tools, prices, the models in use with their TEE status, limits.

• verify_report (free) — recomputes the JCS digest, checks the EIP-191 signature, walks the chain for gaps, re-checks every citation against the supplied source text. Pure cryptography and string matching.

• quote (free) — the exact x402 challenge for any paid tool.

Models in use (as advertised by capabilities)

Costs are recorded per report in wei of 0G, verbatim from x_0g_trace, and are never converted to USD — the rate moves and a signed report should not contain a number that ages.

Related MCP server: TrustAtom MCP Server

Proven on-chain (2026-08-06, X Layer eip155:196, USDT0)

Real x402 settlements against https://mcp.evidiq.dev/clause/mcp with the gate enforced, every one status settled:

Total settled: 0.65 USDT0. Plainly stated: payer and payee are both the fleet wallet, so the balance is unchanged by design — the transfers are real and on-chain, and they round-trip. This table is evidence of settlement, not revenue.

The signed verdict from that run — seq 6, citationsDropped 0, 0G Storage anchor tx 0x832f9330…17d92 — is preserved in full (docs/live-test/results/verdict_report.json): digest 0x215b1b00…b2ab5, EIP-191 signature by 0x8a3c7524Aaed081825aC88eC7f4cCECFc583ee7D, compute traces from qwen3-vl-30b and deepseek-v4-flash with their provider addresses, request ids and wei costs. The five paid outputs are all in docs/live-test/results/ together with the input documents (tenancy-v1.txt, tenancy-v2.txt).

Live test recording

The recording is a genuine asciinema capture made with --idle-time-limit 2, so waits over two seconds are shortened — the session took about three minutes, the GIF runs 19.3s. No frame was edited. Quoted latencies are wall-clock from the log, not the GIF timeline. The run covers all eight tools, the gate probes (402/415), an OpenClaw agent session (zerog/glm-5.2), the five settled paid calls and the verify_report tamper check.

MP4 for clients that will not animate a GIF: clause-livetest.mp4

Tests — the gates that make the claims hold

40/40 passing, twelve gates: C1 C2 C3 T1 T2 F1 F2 G1 V1 B1 S1 L1. Three of them guard the actual promises, so they are worth spelling out:

• C1 — a fabricated citation is dropped. A statement whose quote is not in the document at the given offsets never reaches the caller, and is counted in citationsDropped. This is the anti-hallucination mechanism, and it is mechanical.

• T1 — a non-attested model is refused. assertTeeAttested reads GET /v1/models from the 0G router — not a hardcoded allowlist — and throws unless tee_attested is exactly true. A report can never be produced by a model that cannot be attested; the call fails closed rather than signing.

• F1 — no free tool reaches the router. The three free tools are spied on and must record zero calls to the compute client. The router credit is a real asset behind an endpoint that takes no payment; an LLM-backed free tool would be an open faucet.

The rest: offset drift is caught (C2), unsupported stays unsupported (C3), the registry is read live (T2), free tools answer bare {} with 200 (F2), paid tools gate 402 / 415 (G1), tampering and chain gaps are detected (V1), no marketplace reputation fields and no legal-advice phrasing anywhere (B1), no URL fetching in the document path (S1), size limits enforced before any paid work (L1).

Boundaries

• A reading aid, not advice. Clause shows what the text says and where. It is not legal advice, and it does not recommend signing anything.

• No outbound fetching. Documents arrive as text (up to 200,000 characters) or as base64 image pages (up to 20) in the request — never fetched from a URL.

• No marketplace reputation fields. Compass owns those; Clause never emits them.

Not verified — stated plainly

• Image (scanned-page) input — the code path exists and fails safely, but no scanned page has been put through it yet; citations on image input are returned marked unverified.

• Independent anchor re-check — verify_report reports the anchor as recorded in the store; it does not re-query a 0G indexer.

• The agent is under review, not listed — nothing above should be read as a listing claim.

Fast start

npm install
npm run build          # tsc — must be clean
npm test               # vitest — 40 tests, twelve gates
npm run dev            # tsx start-server.ts (CLAUSE_X402_BYPASS=1 bypasses the gate)

Environment template in .env.example (all secret slots empty): the 0G router key (OG_COMPUTE_API_KEY), the EIP-191 signer (CLAUSE_SIGNER_PRIVATE_KEY, corresponding to 0x8a3c7524Aaed081825aC88eC7f4cCECFc583ee7D — no fallback key exists in source), the 0G Storage anchoring key (OG_PRIVATE_KEY), and the x402 credentials.

Deployment: container evidiq-clause, host port 127.0.0.1:3024, Traefik fronts mcp.evidiq.dev/clause with prefix strip; the signed-report chain lives on the mounted volume /root/evidiq-clause-data → /data/clause.db.