Proof-carrying MCP evidence server: let AI agents query your audit trail

Your coding agent already pulls incident context from observability tools. The problem: those tools return claims. An agent citing "the log said X" is citing hearsay — nothing in the answer proves the log wasn't edited after the fact. This guide shows how to give your agents proof-carrying answers instead.

What the evidence server does

Agent Flight Recorder keeps a hash-chained, append-only ledger of everything your agents do. The MCP evidence server exposes that ledger to external AI agents — Claude Code, Cursor, Codex — as four deterministic tools. Deterministic means no LLM in the loop and no judgment: only recorded facts plus cryptographic proofs.

• tape.query — read-only search of actions by agent, session, time range, or kind. Every record carries its chain hashes.
• tape.verify_range — re-runs the hash-chain verification over any sequence interval. Returns pass/fail plus the first broken link when tampering is detected.
• tape.causality — the cross-agent causality chain for one record: declared caused_by links walked upstream, records that cite it downstream. (Pro/Team)
• tape.evidence_pack — an HMAC-sealed JSON extract of a query result: evidence another agent can cite and anyone can re-verify. (Pro/Team)

The defensible part: every response embeds a freshly recomputed chain-verification verdict. A compromised MCP host cannot silently strip the proof — the verdict travels inside the answer itself.

Why this exists now

On October 14, 2026 the observability industry converged on agents interrogating observability over MCP: groundcover shipped agent-to-agent observability with direct MCP tools, DigitalOcean launched Insights with AI-agent observability, and NeuBird launched its Agentic Reliability Center with universal MCP integration. Every one of them returns unverified claims. Proof-carrying answers are the missing half — incident analysis that cites tamper-evident evidence, not log snippets.

Connect Claude Code

Add to your project's .mcp.json (create an API key under Settings → API keys in your workspace):

{
  "mcpServers": {
    "agent-flight-recorder": {
      "type": "sse",
      "url": "https://flightrecorder.getingeniousai.com/mcp/sse",
      "headers": { "Authorization": "Bearer afr_YOUR_API_KEY" }
    }
  }
}

Or use the Streamable HTTP transport with a plain JSON-RPC POST to https://flightrecorder.getingeniousai.com/mcp — same tools, same auth header.

Connect Cursor

In Cursor Settings → MCP, add a new server:

Name:  agent-flight-recorder
Type:  SSE
URL:   https://flightrecorder.getingeniousai.com/mcp/sse
Headers:
  Authorization: Bearer afr_YOUR_API_KEY

Connect Codex

In your Codex MCP configuration:

{
  "mcp_servers": {
    "agent-flight-recorder": {
      "transport": "sse",
      "url": "https://flightrecorder.getingeniousai.com/mcp/sse",
      "headers": { "Authorization": "Bearer afr_YOUR_API_KEY" }
    }
  }
}

Try it: the 60-second proof

Once connected, ask your agent: "Use tape.verify_range on my production agent and tell me whether the ledger is intact." The answer comes back with the verdict embedded — pass/fail, records verified, and if anything was altered, the exact sequence number of the first broken link. Then ask for "the evidence pack for the last incident window" (Pro/Team): you get a JSON document sealed with HMAC-SHA256 that any third party can re-verify independently.

Gating and limits

• tape.query and tape.verify_range work on every plan, including free — the agent that uses it becomes the evangelist.
• tape.causality and tape.evidence_pack need Pro or Team; free workspaces get a machine-readable plan_required error, never a silent downgrade.
• Rate-limited per API key (120 calls/minute).
• The server is strictly read-only: it can never write to the ledger, append actions, or mutate state — enforced in the handler layer.

What it can't prove (honest limits)

The ledger records what the agent reported — a recorded attestation is not proof the agent behaved correctly in the world, only that the record is complete, consistent, and unaltered. Metadata is redacted before it leaves the server: raw prompts and secrets never cross the wire. Verification checks integrity of the record, not truth of the content.