[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_134":135},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_49":48,"_50":51,"_52":53,"_54":55,"_56":-5,"_57":48,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":-5,"_77":-5,"_78":-5,"_79":80,"_81":-5,"_82":44,"_83":84,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94},"apiUrl","https://odel.app/api","creator","vaaraio","moduleId","vaara-server","@vaaraio/vaara-server","displayName","Vaara MCP Server","tagline","Accountable autonomy MCP server: gating, tamper-evident audit for every action","iconKey","external/c0780f4011bb9147a21c69f1e750778c6e20eed7923b05119192a7e91e161b49.svg","category","local","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","pricingModel","free","priceCredits",0,"creatorUserId","system:external-import","createdAt",1790466398000,"updatedAt","sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=io.github.vaaraio%2Fvaara-server","sourceVerified",true,"sourceMissingSince","importedAt","upstreamStars",13,"upstreamUpdatedAt",1790418221000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/vaaraio/vaara","githubRepoFullName","vaaraio/vaara","releaseId","ext-vaaraio-vaara-server","version","2.0.0","descriptionMarkdown","

\n \n \n $\"Vaara\"$ \n \n

\n\n

\n $\"PyPI\"$ \n $\"License\"$ \n $\"CI\"$ \n $\"OpenSSF$ \n $\"Vaara$ \n $\"DOI$ \n $\"OpenSSF$ \n $\"Hugging$ \n

\n\n

\n $\"Downloads\"$ \n

\n\n

Accountable Autonomy.

\n\n

A verifiable receipt for every autonomous action, checkable by anyone.

\n\nYour AI agent transferred the funds, wrote the file, called the tool. Later, someone who does not trust you asks you to prove exactly what it did and why: a regulator, an auditor, a customer after an incident. Your own logs will not settle it, because you could have edited them.\n\n## Quick start\n\n```bash\npip install vaara # Python: CLI, MCP proxy, server\nbrew tap vaaraio/tap && brew install vaara # macOS: CLI + menu-bar app (built from source)\nnpm install @vaara/client # TypeScript client for the HTTP API\n```\n\n```python\nimport vaara\n\n@vaara.govern\ndef transfer_funds(to: str, amount: float) -> str:\n ...\n```\n\nThat is the whole thing. Every call to a governed function is risk-scored and decided against your policy before the body runs. An allowed call runs, and the decision, the call, and the outcome land in a hash-chained, tamper-evident record anyone can verify offline. Sign it at export (`vaara trail export`, which needs `pip install 'vaara[export]'`) for third-party proof. Records persist to `~/.vaara/trail/audit.db` by default, so evidence survives restarts. Python 3.10+, zero runtime dependencies.\n\nBoth `deny` and `escalate` raise `vaara.Blocked`, since an escalation means a human has not answered yet. On a fresh install the example above runs. The default operating point is `balanced`, which allows below 0.55 and denies above 0.85, and a first call to `transfer_funds` scores 0.275 with a conformal interval of [0.085, 0.465]. Vaara decides on the interval's upper bound, and with no outcome history that interval is wide, so a riskier call escalates before its point estimate reaches the threshold. Feeding real outcomes back through `report_outcome` narrows it. The other presets are listed by `vaara mode list`. To watch decisions without acting on them, start with `@vaara.govern(shadow=True)`.\n\n### Check a receipt with nothing installed\n\n[vaara.io/verify.html](https://vaara.io/verify.html) is the Vaara Resin. One HTML file, no build step and no dependencies. Paste in a receipt and it recomputes the DSSE pre-authentication encoding, takes its digest, and checks the Ed25519 signature with WebCrypto. The receipt never leaves the tab, nothing uploads, and the page works with the network off, so verification is not a service and Vaara is not a party to it. Save the file and it keeps working.\n\nIt also states what a passing check does not establish: that the key belongs to the party you expect, that the signed statement is true, that `decided_at` means anything without an external time authority, or that one receipt is a whole history.\n\nThe explorer on the same page reads the public transparency log straight from your browser. Look a trail head up by digest, or paste a public key to see everything published under it. No account and no sign-in, because the key is the identity. Publishing to that log is opt-in and off by default (`vaara trail publish-head`), so an absence there means nothing was published rather than nothing happened.\n\n### See who else has checked it\n\n[vaara.io/conformance.html](https://vaara.io/conformance.html) is the results page. It carries every suite and its verdict, and every party other than the maintainer who ran the checkers and reported what they found in public. Rows are chained, each holding the digest of the row before it, so removing or reordering one breaks every digest after it and the break is visible to anyone. The maintainer cannot take a row down either. A run that disagrees with ours is a row too, with the reason stated, and there is no blacklist.\n\nThe aggregate runner grades every suite at once, and grades another implementation's vectors the same way:\n\n```bash\ngit clone https://github.com/vaaraio/vaara && cd vaara\npip install cryptography rfc8785 # the checkers' only dependencies\npython scripts/conformance_runner.py # grade the reference corpus\npython scripts/conformance_runner.py --vectors-dir ./your_vectors # grade your own\n```\n\nIt prints a prefilled link at the end of every run, so asking for a row takes one click. The named, versioned rule set, what a pass does and does not establish, and the full suite list are in [docs/conformance-profile.md](https://github.com/vaaraio/vaara/blob/main/docs/conformance-profile.md).\n\n

Prefer the explicit pipeline?

\n\nThe decorator drives the same engine you can call directly when you want the decision object in hand.\n\n```python\nfrom vaara.pipeline import InterceptionPipeline\n\npipeline = InterceptionPipeline()\nresult = pipeline.intercept(\n agent_id=\"agent-007\",\n tool_name=\"fs.write_file\",\n parameters={\"path\": \"/etc/service.yaml\", \"content\": \"...\"},\n agent_confidence=0.8,\n)\nif result.allowed:\n pipeline.report_outcome(result.action_id, outcome_severity=0.0)\nelse:\n print(result.reason)\n```\n\nEvery call gets a risk score and an allow / block / escalate decision against your policy, then the call, the decision, and the real outcome are written to the audit trail. `report_outcome` closes the loop: the scorer reweights based on which signals actually predicted the outcome. Every release carries SLSA v1 build provenance as a GitHub artifact attestation (SLSA Build Level 2), and the PyPI wheel is the same file, so `gh attestation verify vaara--py3-none-any.whl --repo vaaraio/vaara` checks either download. Optional ML classifier: `pip install 'vaara[ml]'`.\n

\n\n

Verify it without trusting the producer

\n\nWriting a trail is the easy half. The half that matters is letting someone who does not trust you check it, with no key, no access, and none of your code. Every Vaara record is content-addressed and fail-closed on authenticity, and ships with public conformance vectors plus a standalone checker that imports no Vaara code, so an independent party reproduces every verdict offline.\n\n```bash\nvaara verify-bundle evidence-bundle.json\n```\n\n`ok` only when a signature is actually established, not merely present in a log. The same property drives the standards work behind [the Vaara Receipt Internet-Draft](https://datatracker.ietf.org/doc/draft-sirkkavaara-vaara-receipt/): evidence that holds up for someone who runs none of your software. The full verifier set, the trust model for each verb, and where trust comes from in each case are in [docs/verifying-evidence.md](https://github.com/vaaraio/vaara/blob/main/docs/verifying-evidence.md).\n\nTo check that claim yourself, without installing Vaara, run the standalone checker against the published vectors. Its only dependencies are `cryptography` and `rfc8785`:\n\n```bash\ngit clone https://github.com/vaaraio/vaara\ncd vaara\npip install cryptography rfc8785 # the checker's only dependencies\npython tests/vectors/external_evidence_v0/_check_independent.py\n```\n\nIt re-derives every verdict from the receipt bytes and the public key alone. The output shows the property the trail is built for: a receipt dropped from inside a declared boundary is a provable gap from the held set, with no issuer access and no external witness.\n\nFor the whole loop in one runnable file, produce a signed record, verify it yourself, then watch a single forged byte get caught, see [examples/prove-it-yourself/](https://github.com/vaaraio/vaara/blob/main/examples/prove-it-yourself/). The logs-versus-evidence argument behind it is in [docs/logs-vs-evidence.md](https://github.com/vaaraio/vaara/blob/main/docs/logs-vs-evidence.md).\n

\n\n

What the evidence looks like

\n\n`vaara compliance report --db audit.db --format json` against a real trail produces an article-level evidence record an auditor reads directly. Articles with no recorded events return `evidence_insufficient`, not a rubber stamp.\n\n```json\n{\n \"system_name\": \"Acme HR Assistant\",\n \"overall_status\": \"evidence_insufficient\",\n \"trail_integrity\": {\"size\": 105, \"chain_intact\": true},\n \"articles\": [\n {\"article\": \"Article 12(1)\", \"title\": \"Record-Keeping (Logging)\",\n \"status\": \"evidence_sufficient\", \"strength\": \"strong\", \"evidence_count\": 105},\n {\"article\": \"Article 15(1)\", \"title\": \"Accuracy, Robustness and Cybersecurity\",\n \"status\": \"evidence_insufficient\", \"strength\": \"absent\", \"evidence_count\": 0}\n ]\n}\n```\n\nEach verdict carries the threshold-versus-observed snapshot, the rationale, and the underlying records, so a reviewer traces `status` back to a concrete event. The same data renders as a Notified-Body PDF, a static HTML dashboard, or a Sigstore-signed handoff envelope. See [docs/COMPLIANCE.md](https://github.com/vaaraio/vaara/blob/main/docs/COMPLIANCE.md).\n

\n\n

What you get

\n\n- **Gate every tool call you route through it** against your own policy: allow, block, or escalate. Coverage is whatever you wrap; each adapter documents the surface it sees, and the Claude Code plugin states its four explicitly.\n- **A tamper-evident trail** an outside party verifies without trusting your stack, with the chain head anchorable to an external RFC 3161 / eIDAS timestamp so its existence is provable against a clock you do not control.\n- **Article-level EU AI Act evidence**, honest about the gaps instead of papering over them.\n- **Governance of the model call itself**, not only the tools around it: a hardware-rooted inference receipt that a second, different local model cross-checks. This is the sovereign inference harness, new in v1.0.\n- **Enforcement, not only a record** (v1.1.0): a credential broker mints a signed, short-lived credential bound to the attestation digest and scoped to one tool, its argument commitment, and tenant, with typed capability scopes that bound what a call may do. A gateway in front of a protected tool refuses any call without a valid, attestation-bound grant, so a bypass stops being silent. Off by default.\n- **Gap-evident completeness** (v1.4.0): each authorization receipt can carry a signed per-boundary sequence and running count, so a dropped receipt inside a declared boundary is a provable gap from the held receipts alone, with no issuer access and no external witness (`vaara verify-contiguity`). Off by default.\n- **Independent re-mint** (v1.14.0): a second generator in each public vector set reproduces the signed carrier byte-exact from the declared canonicalization alone, with no Vaara import. A verifier that has never run Vaara software reproduces the same bytes.\n

\n\n

Where it plugs in

\n\nNative adapters route the major Python agent frameworks through the same pipeline, each via the framework's own hook, emitting identical audit events:\n\n| Framework | Entry point |\n|---|---|\n| LangChain | `VaaraCallbackHandler`, `vaara_wrap_tool` |\n| CrewAI | `VaaraCrewGovernance` |\n| OpenAI Agents SDK | `VaaraToolGuardrail`, `vaara_wrap_function` |\n| MCP server | `vaara.integrations.mcp_server` |\n\nTo put Vaara **in front of** an MCP server, run it as a proxy. Every `tools/call` routes through the pipeline before reaching the upstream; allowed calls forward transparently, blocked calls return an MCP error.\n\n```bash\nvaara-mcp-proxy \\\n --upstream npx --upstream-arg -y --upstream-arg @sap/mdk-mcp-server \\\n --db ./mcp_audit.db --shadow\n```\n\nStart with `--shadow`: every call is classified, scored, and recorded, nothing is blocked. After a few days, `vaara trail shadow-report --db ./mcp_audit.db` shows what enforcement would have done; then drop the flag and enforce, starting from a ready-made perimeter for common MCP servers in [examples/policies/mcp-starters/](https://github.com/vaaraio/vaara/blob/main/examples/policies/mcp-starters/README.md). Point your MCP client (Claude Code, Cursor, any host) at the proxy instead of the upstream. There is also an HTTP API (`pip install 'vaara[server]'`, `vaara serve`) and a first-party TypeScript client on npm ([`@vaara/client`](https://github.com/vaaraio/vaara/blob/main/clients/ts)) for non-Python agents. Framework details, the cloud and OSS guardrail adapters (Bedrock, Azure, GCP, NeMo, Guardrails AI, LLM Guard, Rebuff), and the multi-tenant proxy are in [docs/adapters.md](https://github.com/vaaraio/vaara/blob/main/docs/adapters.md).\n

\n\n

In CI

\n\nA policy is code, so it belongs in the pull request that changes it. The action validates the policy, runs its cases, and fails the build on a policy that does not parse, a failing case, or a trail whose chain or signature does not hold.\n\n```yaml\n- uses: vaaraio/vaara@v2\n with:\n policy: policies/production.yaml\n cases: policies/production.cases.yaml\n```\n\nPoint `trail` at a signed zip to verify one a job produced. Without a `pubkey` that checks the trail is internally intact; pass a key you obtained separately to bind the signer too, and the run says which of the two it did. Inputs, outputs and pinning are in [docs/github-action.md](https://github.com/vaaraio/vaara/blob/main/docs/github-action.md).\n\nThis checks artifacts. Gating the agent is the runtime's job, at the moment of the tool call.\n

\n\n

How it scores

\n\nEach risk score blends five expert signals and keeps adapting as outcomes come back, and it carries a confidence interval with a coverage guarantee that holds regardless of the input distribution. On a held-out adversarial corpus the classifier reaches **85.6%** recall (95% Wilson [83.4, 87.6]) at a **5.1%** false-positive rate, and **0.0%** FPR on benign calls under live injection pressure. The hot-path rule scorer adds 140 µs mean per call on commodity CPU; the ML classifier is opt-in (`vaara[ml]`) and off that path. `make bench` reproduces the classifier figures below against the bundles that ship in the repo; it needs `pip install 'vaara[ml]'` and downloads the embedding model on first run.\n\n- 25,556-entry adversarial corpus (250 hand-curated + 25,306 LLM-generated). The v0.40 split assigns 24,619 of them leak-free by (category, generation batch) cell: 15,114 train, 2,921 val, 2,980 test, 3,604 holdout.\n- Classifier v11 (254 hand-features + 384-dim MiniLM embeddings) at threshold 0.8800 on held-out TEST n=1,827: recall 85.6% [83.4, 87.6] at FPR 5.1% [3.8, 6.9]. Recall is up 0.9 points on v9 and the false-positive rate is up 1.0. That trade is deliberate and the rest of this section is why.\n- Cross-model held-out recall 86.3% over n=5,600, against attacks written by Qwen2.5-72B, a model absent from TRAIN. v9 reads 67.4% on the same set. The previous published figure here was 66.8% [64.9, 68.7], measured on v8 against the v0.37 surface; v9 reproducing it within a point on a different attacker family and freshly generated data is the reason that number survived two releases unchanged. This is still the honest worst case, and the in-distribution number above is the easier denominator.\n- On four attack categories that the corpus had barely covered until v0.40, measured on 5,600 entries generated after v11's operating point was fixed: recall 63.1% to 87.0% and false positives 6.6% to 2.5% against v9. Credential exfiltration alone moves 45.9% to 80.3% at 10.0% to 3.9% FPR. Full record in [bench/V11-CANDIDATE.md](https://github.com/vaaraio/vaara/blob/main/bench/V11-CANDIDATE.md), including the earlier candidate that was rejected and why.\n- BIPIA-pressure FPR on benign tool calls 0.0% [0.0, 0.5]: none of 704 calls flagged across four agent backends (Claude Haiku 4.5, Llama-3.1-8B, Mistral-7B, Qwen-2.5-7B). v9 flags 2.7% of the same calls and v8 35.7%. `scripts/eval_bipia_entries.py` reproduces all three.\n- Multi-attacker PAIR robustness, measured on v0.31 and not re-run on v11: 0/25 successes per attacker across Qwen2.5-32B, Qwen2.5-72B, Llama-3.3-70B on identical seeds, Wilson upper 13.3% ([bench/vaara-bench-v0.31.md](https://github.com/vaaraio/vaara/blob/main/bench/vaara-bench-v0.31.md)).\n- Distribution-free conformal coverage on the score; MWU regret bound O(sqrt(T log N)).\n- Chain of custody: corpus, split, training commit, and bundle SHAs locked and printed by every script.\n\nMethod and per-cell breakdown: [docs/architecture.md](https://github.com/vaaraio/vaara/blob/main/docs/architecture.md) and [bench/](https://github.com/vaaraio/vaara/blob/main/bench/).\n

\n\n

Standards and attestation

\n\n- **[vaara.receipt/v1](https://github.com/vaaraio/vaara/blob/main/SPEC.md)** is the canonical parent spec for the signed receipt format: hash-chained, canonicalized with JCS (RFC 8785), verifiable offline from a public key. The x402 settlement binding and an eIDAS qualified-timestamp profile are downstream profiles that pin to it rather than competing formats. Receipts can carry a self-hosted RFC 3161 timestamp that Vaara mints offline.\n- **[SEP-2828](https://github.com/vaaraio/vaara/blob/main/docs/sep/sep-server-execution-record.md)** signed execution records, carried forward as the IETF Internet-Draft [`draft-sirkkavaara-vaara-receipt`](https://datatracker.ietf.org/doc/draft-sirkkavaara-vaara-receipt/). A second independent implementation has reproduced the SEP-2828 conformance vectors from a clean checkout with no shared code. Published corpora with independent checkers cover the fallback binding path ([`tests/vectors/fallback_projection_v0/`](https://github.com/vaaraio/vaara/blob/main/tests/vectors/fallback_projection_v0/)) and CrewAI governance decisions ([`tests/vectors/governance_decision_v0/`](https://github.com/vaaraio/vaara/blob/main/tests/vectors/governance_decision_v0/)).\n- **OVERT 1.0** ([overt.is](https://overt.is/)): Vaara is the Arbiter and emits Protocol Profile 1.0 Base Envelopes (canonical CBOR, Ed25519) alongside every record when attestation is on.\n- **Post-quantum**: an optional parallel ML-DSA-65 / FIPS 204 signature over the same preimage, so a stripped post-quantum signature is a detectable downgrade rather than a silent loss.\n- **Root-agnostic evidence**: the same Article 12 record is provable with or without a hardware TEE and re-expressible in IETF RATS EAR claims (AR4SI vector), whether rooted in a TPM 2.0 host, an AMD SEV-SNP confidential VM, or no TEE at all.\n- **Sovereign inference harness** (v1.0): a local model behind a signing proxy that emits a hardware-rooted inference receipt a second local model cross-checks. Developed privately, published here under AGPL-3.0.\n\nDetails and the offline checkers for each: [docs/standards.md](https://github.com/vaaraio/vaara/blob/main/docs/standards.md).\n

\n\n

Surface stability

\n\nThe public surface is fixed: the signed envelope (`vaara.receipt/v1`), capability constraints, the credential grant and gateway, and the `@vaara.govern` entry point. No new primitives are planned. New behavior ships as profiles that pin to `vaara.receipt/v1`, not as new core types, and no new format bindings will be added (the last was v1.13.0). From here the work is hardening and subtraction within this surface, so anyone building on it has a stable target.\n

\n\n

Docs

\n\n| Path | Contents |\n|---|---|\n| [docs/verifying-evidence.md](https://github.com/vaaraio/vaara/blob/main/docs/verifying-evidence.md) | Every verifier and its trust model |\n| [docs/logs-vs-evidence.md](https://github.com/vaaraio/vaara/blob/main/docs/logs-vs-evidence.md) | Logs vs evidence: proving what an agent did, and what the AI Act actually requires |\n| [docs/prove-what-an-ai-agent-did.md](https://github.com/vaaraio/vaara/blob/main/docs/prove-what-an-ai-agent-did.md) | The four properties a provable record of agent actions needs |\n| [docs/eu-ai-act-article-12.md](https://github.com/vaaraio/vaara/blob/main/docs/eu-ai-act-article-12.md) | Article 12 record-keeping: what it requires, what it does not, what to demand from tooling |\n| [docs/tamper-evident-audit-trail.md](https://github.com/vaaraio/vaara/blob/main/docs/tamper-evident-audit-trail.md) | How the trail works, its honest limits, and what it costs |\n| [docs/vaara-vs-observability-vs-grc.md](https://github.com/vaaraio/vaara/blob/main/docs/vaara-vs-observability-vs-grc.md) | Vaara vs Datadog/Splunk vs Vanta/Drata: three different questions |\n| [docs/dogfood/](https://github.com/vaaraio/vaara/blob/main/docs/dogfood/README.md) | Our marketing runs under this gate; the signed trail and key to verify it |\n| [docs/architecture.md](https://github.com/vaaraio/vaara/blob/main/docs/architecture.md) | Scoring, conformal coverage, time anchor, formal properties |\n| [SPEC.md](https://github.com/vaaraio/vaara/blob/main/SPEC.md) | The canonical vaara.receipt/v1 receipt format spec |\n| [docs/standards.md](https://github.com/vaaraio/vaara/blob/main/docs/standards.md) | SEP-2828, SEP-2787, OVERT, the sovereign inference harness |\n| [docs/adapters.md](https://github.com/vaaraio/vaara/blob/main/docs/adapters.md) | Framework and cloud/OSS guardrail adapters, multi-tenant proxy |\n| [docs/COMPLIANCE.md](https://github.com/vaaraio/vaara/blob/main/docs/COMPLIANCE.md) | EU AI Act and DORA article mapping, eval numbers |\n| [docs/multi-replica-deployment.md](https://github.com/vaaraio/vaara/blob/main/docs/multi-replica-deployment.md) | Scaling past one proxy process: per-replica chains, rotation, archive index |\n| [docs/kubernetes-rancher.md](https://github.com/vaaraio/vaara/blob/main/docs/kubernetes-rancher.md) | Running the proxy on Kubernetes with Rancher: chart, storage, enforcement, network isolation |\n| [docs/supported-platforms.md](https://github.com/vaaraio/vaara/blob/main/docs/supported-platforms.md) | Python, container and Kubernetes versions Vaara supports, and which have been verified |\n| [CHANGELOG.md](https://github.com/vaaraio/vaara/blob/main/CHANGELOG.md) | Version-by-version evolution |\n| [docs/PRIOR_ART.md](https://github.com/vaaraio/vaara/blob/main/docs/PRIOR_ART.md) | When each concept first shipped, plus adjacent work |\n

\n\nVaara helps deployers assemble evidence for their own conformity work. It does not certify compliance or constitute legal advice. Deployers own their obligations under the EU AI Act and other applicable law.\n\nCommercial license and paid pilots available: see [vaara.io](https://vaara.io/#pilots) or contact [hello@vaara.io](mailto:hello@vaara.io). Licensing terms are in [LICENSING.md](https://github.com/vaaraio/vaara/blob/main/LICENSING.md), and the commercial licence is described in [COMMERCIAL.md](https://github.com/vaaraio/vaara/blob/main/COMMERCIAL.md).\n\n## Acknowledgements\n\n- Listed in the industry acknowledgements of the [IMDA Model AI Governance Framework for Agentic AI v1.5](https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf) (Singapore, 20 May 2026).\n- The [AMD AI Developer Program](https://www.linkedin.com/posts/amd-developer_meet-henri-sirkkavaara-henri-created-vaara-activity-7459667676555132928-QFSd) ran a developer testimonial of Vaara in May 2026.\n- [Article 14 runtime: why oversight of agentic AI has to be evidenced as action, not model](https://futurium.ec.europa.eu/ga/apply-ai-alliance/community-content/article-14-runtime-why-oversight-agentic-ai-has-be-evidenced-action-not-model), the position post on the EU Apply AI Alliance Futurium.\n- [Article 12 and the difference between a log and evidence](https://futurium.ec.europa.eu/en/apply-ai-alliance/community-content/article-12-and-difference-between-log-and-evidence), the companion position post on the EU Apply AI Alliance Futurium.\n- [Sovereign proof for the AI Act](https://futurium.ec.europa.eu/en/apply-ai-alliance/community-content/sovereign-proof-ai-act), the latest position post on the EU Apply AI Alliance Futurium.\n\n## Citation\n\nIf you build on Vaara or its receipt format, cite the repository (see [CITATION.cff](https://github.com/vaaraio/vaara/blob/main/CITATION.cff)) and the specification it implements:\n\nHenri Sirkkavaara. *The Vaara Receipt: A Recomputable Receipt Format for Decisions About Agent Actions.* IETF Internet-Draft [draft-sirkkavaara-vaara-receipt](https://datatracker.ietf.org/doc/draft-sirkkavaara-vaara-receipt/).\n\nEvery tagged release is archived by Zenodo and minted a DOI. Cite [10.5281/zenodo.22027975](https://doi.org/10.5281/zenodo.22027975) for the software as a whole, which always resolves to the newest version, or the version DOI printed on a specific release for the exact bytes you ran.\n\n## License\n\nCopyright © 2026 Henri Sirkkavaara. Licensed under AGPL-3.0-or-later. See [LICENSE](https://github.com/vaaraio/vaara/blob/main/LICENSE).\n\n\n\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt",1790396200000,"priceCents","trialDays","iconType","svg","upstream",{"_112":113,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123},"requiredSecrets",[],"tags",[97,98,99,100,101,102,103,104,105,106,107,108,109,110,111],"assets",[],"stats",{"_95":44,"_96":44},"ratingAvg","reviewCount","agent-governance","agent-security","ai-act","ai-agents","ai-governance","article-12","attestation","audit-trail","compliance","confidential-computing","eu-ai-act","ima","llm-security","python","remote-attestation","topics",[97,98,99,100,101,102,103,104,105,106,107,108,109,129,110,111,130,131,132,133],"license","AGPL-3.0","language","Python","registryName","io.github.vaaraio/vaara-server","homepage","https://vaara.io","packages",[124],{"_125":126,"_127":128,"_72":73},"registryType","pypi","identifier","vaara","mcp","runtime-monitoring","sovereign-ai","tpm","trusted-computing","ENV",{"_136":137,"_138":139,"_140":141,"_142":-7},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272","SENTRY_ENABLE_LOCAL"]