Elucora Evidence MCP Server
Capture a public web source and return a portable, cryptographically signed evidence receipt.
Elucora is a hosted MCP server. There is nothing to install: point your client at
https://elucora.com/mcp. Two of the four tools need no API key at all, so a client can verify
and read receipts before anyone signs up for anything.
An agent can seal the exact page, PDF, or JSON field behind a claim, hand the receipt to
someone else, and have them verify it without trusting Elucora's dashboard or its API.
| Tool | Key required | What it does |
|---|
elucora_verify | No | Checks whether a receipt is genuine and unaltered, and what source bytes it covers. |
elucora_get_receipt | No | Reads a receipt: source, sealed passage, signature status, Bitcoin anchor state. |
elucora_capture | Yes | Fetches a public HTTP(S) source, preserves the original bytes, optionally pins an exact quote or JSON Pointer, and returns a signed receipt. Consumes quota and contacts the source. |
elucora_attest | Yes | Seals a SHA-256 hash the caller already holds, for content with no URL. Proves the content existed then and has not changed since — not where it came from. Consumes quota. |
The free tier is 500 receipts a month with no card.
Connecting
elucora_verify and elucora_get_receipt work with no credentials. For the two tools that
contact a source or spend quota, create an API key at
elucora.com/dashboard/keys, then:
{
"mcpServers": {
"elucora": {
"url": "https://elucora.com/mcp",
"headers": { "Authorization": "Bearer elu_live_..." }
}
}
}
The server implements stateless Streamable HTTP, protocol version 2025-11-25.
Hosts should keep a human approval step before elucora_capture: it makes a request to an
external URL and consumes the account's monthly quota.
What a receipt proves
- The captured bytes and the selected evidence match their recorded SHA-256 hashes
- Elucora issued the receipt and it has not been altered since, by ES256 signature over
RFC 8785 canonical JSON
- The entry is in a public hash-linked log, published as signed checkpoints outside Elucora
- When a timestamp authority is configured, an RFC 3161
token binds the entry to an independently signed time, and entry digests are submitted to
OpenTimestamps for Bitcoin anchoring
A valid receipt proves integrity, issuer, and time. It does not prove that the source was
telling the truth.
Limits, stated before you find them
- Captures are HTTP, not a browser. A page that renders its content with JavaScript is captured
as the shell the server sent. Filings, feeds, APIs and article pages are exactly right; single
page applications and social posts are not.
- Elucora is trusted at the moment of capture. The receipt proves what Elucora was served.
Everything after that instant is verifiable without trusting Elucora at all.
- No affidavit. Nothing here is offered as court-admissible; that is a matter for a court and
its rules, not for a vendor.
- One operator, and a young log. Both are publicly countable at
elucora.com/transparency.
Verifying without Elucora
Every receipt carries jwks_url, and verification keys are published at
/.well-known/jwks.json. Any ES256 implementation
can check a receipt offline. The public verifier for a receipt lives at /verify/{id}.
Links