The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the BLACKPROOF Local MCP listing page.
BLACKPROOF is a free, open-source, local-first cyber evidence app under AGPL-3.0-only. Create, import, encrypt, export and verify dossiers directly in your browser. No account, activation key or application server is required. Use it to prepare cyber reviews, internal audits and supplier questionnaires. Bring your own review checklist, document answers, evidence references and reservations, then track the remaining preparation work. Source documents and audit conclusions still require human assessment; this is not a system scanner or an automated certification service.
Core flow:
questionnaire ou grille d'audit → réponses et références → preuves attendues → points à corriger → dossier interne → export relu facultatif.
apps/web — public website and local-first appapps/web/src/content/analyses (sourced Markdown analyses and publication drafts)packages/core — ProofGraph, ProofDebt, ProofPack logicpackages/verifier — standalone Delivery verifier CLI/SDKpackages/mcp — local, read-only MCP server for minimized verification and comparisontests/e2e — Chromium tests for the local-first editor and verification flowsscripts — schema generation, security checks and deployment toolingdocs — project context and technical documentationRequirements: Node.js 22.23.2 (see .nvmrc) and pnpm 10.34.5.
The authoritative local gate is:
pnpm verify:all runs schema drift checks, TypeScript/Astro/Svelte validation,
unit tests, the static build, CSP generation, local-only artifact checks, the dependency
and repository security audits, and the Chromium end-to-end tests.
Questionnaires, ProofPacks and Delivery snapshots are processed on the user's device;
saved dossiers are encrypted in browser IndexedDB. No server upload is implemented
or permitted for import, creation, editing, backup or verification. Downloading an
export saves a local file; users transmit it separately, outside BLACKPROOF.
See docs/LOCAL_FIRST_STORAGE.md and docs/SECURITY_MODEL.md before changing a
storage, export or destructive operation.
Use the local MCP server to check a selected ProofPack before transmission, compare two review snapshots through aggregate changes, and obtain public preparation checklists for cyber reviews, internal audits and questionnaires. It does not expose answers, evidence references or files to the agent. It runs over stdio on the user's device, not on the public website.
See installation, tools, fictional walkthrough and security limits. Private mode requires an end-to-end local client/model. A local transport alone cannot stop a host from forwarding results to a remote model.
The /analyses section is generated from a validated Astro content collection.
Drafts are excluded from public routes, RSS and the sitemap. The complete authoring
and verification workflow is documented in docs/EDITORIAL_ANALYSES.md.
The original software, documentation, schemas and standalone verifier are
licensed under GNU AGPL version 3 only. See LICENSE and NOTICE.
Third-party dependencies retain their own licences in THIRD_PARTY_NOTICES.md.
Contributions are welcome: see CONTRIBUTING.md. Project names and logos are
covered separately by TRADEMARKS.md.
Source: https://github.com/l0gfr/BLACKPROOF-AGPL
pnpm build produces the static site in apps/web/dist/. Serve it over HTTPS
(or localhost for development), with the CSP and security headers described in
docs/DEPLOY_APACHE.md. Publish the corresponding source of your version and
keep the licence/source link visible.
The application stores dossiers locally in browser IndexedDB. Back up encrypted dossiers before changing hostname or browser profile: browser storage is scoped to an origin and is not synchronized by the host.
The hosted public status registry is retired. Local verification and detached signatures remain available. A historical or unavailable registry must never be interpreted as proof that a Delivery is currently active.