Elucora Evidence MCP Server

Capture a public web source and return a portable, cryptographically signed evidence receipt.

Elucora is a hosted MCP server. There is nothing to install: point your client at https://elucora.com/mcp. Two of the four tools need no API key at all, so a client can verify and read receipts before anyone signs up for anything.

An agent can seal the exact page, PDF, or JSON field behind a claim, hand the receipt to someone else, and have them verify it without trusting Elucora's dashboard or its API.

Tools

Tool	Key required	What it does
`elucora_verify`	No	Checks whether a receipt is genuine and unaltered, and what source bytes it covers.
`elucora_get_receipt`	No	Reads a receipt: source, sealed passage, signature status, Bitcoin anchor state.
`elucora_capture`	Yes	Fetches a public HTTP(S) source, preserves the original bytes, optionally pins an exact quote or JSON Pointer, and returns a signed receipt. Consumes quota and contacts the source.
`elucora_attest`	Yes	Seals a SHA-256 hash the caller already holds, for content with no URL. Proves the content existed then and has not changed since — not where it came from. Consumes quota.

The free tier is 500 receipts a month with no card.

Connecting

elucora_verify and elucora_get_receipt work with no credentials. For the two tools that contact a source or spend quota, create an API key at elucora.com/dashboard/keys, then:

config.json

{
  "mcpServers": {
    "elucora": {
      "url": "https://elucora.com/mcp",
      "headers": { "Authorization": "Bearer elu_live_..." }
    }
  }
}

The server implements stateless Streamable HTTP, protocol version 2025-11-25.

Hosts should keep a human approval step before elucora_capture: it makes a request to an external URL and consumes the account's monthly quota.

What a receipt proves

The captured bytes and the selected evidence match their recorded SHA-256 hashes
Elucora issued the receipt and it has not been altered since, by ES256 signature over RFC 8785 canonical JSON
The entry is in a public hash-linked log, published as signed checkpoints outside Elucora
When a timestamp authority is configured, an RFC 3161 token binds the entry to an independently signed time, and entry digests are submitted to OpenTimestamps for Bitcoin anchoring

A valid receipt proves integrity, issuer, and time. It does not prove that the source was telling the truth.

Limits, stated before you find them

Captures are HTTP, not a browser. A page that renders its content with JavaScript is captured as the shell the server sent. Filings, feeds, APIs and article pages are exactly right; single page applications and social posts are not.
Elucora is trusted at the moment of capture. The receipt proves what Elucora was served. Everything after that instant is verifiable without trusting Elucora at all.
No affidavit. Nothing here is offered as court-admissible; that is a matter for a court and its rules, not for a vendor.
One operator, and a young log. Both are publicly countable at elucora.com/transparency.

Verifying without Elucora

Every receipt carries jwks_url, and verification keys are published at /.well-known/jwks.json. Any ES256 implementation can check a receipt offline. The public verifier for a receipt lives at /verify/{id}.

Elucora Evidence API README