Validate what an MCP server declares against what it actually does, with a tamper-evident SHA-256 evidence ledger.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-evidence-validator","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP Evidence Validator [](https://www.bestpractices.dev/projects/14122) [](https://www.bestpractices.dev/projects/14122) Validate what an MCP server *declares* against what it *actually does*, and produce a tamper-evident evidence record you can hand to an auditor. **Status:** v0.5.0 — published on PyPI with build attestations · **License:** Apache-2.0 · **Language:** Python 3.10+ (stdlib only, zero dependencies) **Built by [Empire Labs Pty Ltd](https://empirelabs.com.au)** and published as part of the Empire Stack — the evidence layer for agent actions. Related public work: - [witnessos](https://github.com/narko4u/witnessos) — credential-brokered enforcement and cryptographic evidence for agent actions; the evidence-grade ladder these checks descend from (E0 Declared → E1 Observed → E2 Enforced → E3 Corroborated → E4 Anchored). - [evidence-record-spec](https://github.com/narko4u/evidence-record-spec) — portable, evidence-grade record format for agent actions. --- ## Why Model Context Protocol (MCP) is the industry standard for connecting AI agents to tools and data. It is now governed by the Agentic AI Foundation (AAIF) under the Linux Foundation, with 97M+ monthly SDK downloads and 10,000+ active public servers. But the protocol leaves the *evidence* problem open: - A server declares tool schemas and permissions, but nothing verifies those declarations against observed runtime behaviour. - An annotation can be accurate at declaration time and silently stale minutes later, when the contract it was bound to mutates underneath it. - MCP has already seen the first malicious server (Sept 2025), CVE-2025-6514 (CVSS 9.6, RCE), and a hosting-platform breach affecting 3,000+ downstream applications. The **declared-vs-observed gap** is the measurement finding that matters. This validator is a reference imple…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.