evidence-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited evidence-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Invoke when the user asks to:
npx degit evidence-dev/template my-project
cd my-project
npm install
npm run sources
npm run devnpm run devOpens at http://localhost:3000. Hot reloading is on by default — save a .md file to see changes instantly.
npm run buildOutputs a static site to the build/ directory. All pages and queries are pre-rendered at build time.
| Command | Description |
|---|---|
npx degit evidence-dev/template my-project | Create a new project from the template |
npm run sources | Extract data from sources (run before first dev or build) |
npm run dev | Start the development server |
npm run build | Build the app for production |
npm run build:strict | Build, but fails on any query or component error |
npm run preview | Preview the built site locally |
Ctrl/Cmd + C | Stop the dev server |
r | Restart the dev server (while running) |
Pass flags with an extra -- separator:
npm run dev -- --port 4000
npm run dev -- --host 0.0.0.0 # useful inside containers
npm run dev -- --open /my-page # open a specific page on startupnpm run sources Flags| Flag | Description |
|---|---|
--changed | Only run sources whose queries have changed |
--sources source1,source2 | Run sources from specified sources only |
--queries query1,query2 | Run specific queries only |
--debug | Show debug output |
npm run dev Flags| Flag | Description |
|---|---|
--port <port> | Specify port (default 3000, auto-increments if taken) |
--host [host] | Specify hostname |
--open [path] | Open browser to path on startup |
dev and build use Vite under the hood and support Vite's CLI options. preview uses npx serve and supports Serve's options.
my-project/
├── pages/ # Markdown pages (.md files)
│ ├── index.md # Home page
│ └── +layout.svelte # Custom layout (optional override)
├── sources/ # Data source definitions
│ └── my_source/
│ ├── connection.yaml # Non-secret connection config
│ ├── connection.options.yaml # Secret credentials (base64)
│ └── my_query.sql # Source queries
├── static/ # Static assets (images, favicon)
├── evidence.config.yaml # Evidence configuration
└── package.jsonPages are .md files in pages/. Add a file to add a route — pages/sales/overview.md becomes /sales/overview.
.sql files in sources/) run directly against your data source in the source's SQL dialect. Run with npm run sources. Populate the data cache..md files) use DuckDB dialect, run against the data cache on every page load. Results are directly available to components.Reference cached data in a markdown query as source_name.query_name:
select * from my_source.my_query
<DataTable data={orders_summary} />Copy the default layout to override it:
cp .evidence/template/src/pages/+layout.svelte pagesKey EvidenceDefaultLayout props:
| Prop | Default | Description |
|---|---|---|
title | — | App title replacing the Evidence logo |
logo | — | Image path replacing the Evidence logo |
lightLogo / darkLogo | — | Separate logos for light/dark mode |
hideSidebar | false | Hide sidebar navigation |
hideHeader | false | Hide the page header |
hideBreadcrumbs | false | Hide breadcrumbs |
hideTOC | false | Hide table of contents |
fullWidth | false | Content spans full screen width |
maxWidth | — | Content width in pixels (default ~1280px) |
neverShowQueries | false | Remove "show queries" option in deployed app |
sidebarDepth | 3 | Sidebar nav depth (2 or 3) |
githubRepo | — | GitHub repo URL shown in header |
Evidence is a static site generator by default. npm run build pre-renders every page and query into HTML. The output in build/ can be served from any static host.
Build process:
build:strict, the build stops — the old deployed version keeps servingSchedule or trigger regular builds to keep data fresh.
`npm run build:strict` fails if:
{#if} to avoid this)Evidence static output can be deployed to:
In production, credentials must be supplied as environment variables. They are never read from connection.options.yaml at build time on the server.
To find the exact variable names for your sources:
npm run devhttp://localhost:3000/settingsCredential variable format:
EVIDENCE_SOURCE__<source_name>__<variable_name>Variable names are case sensitive — preserve the casing shown on the settings page.
| Prefix | Usage | Example |
|---|---|---|
EVIDENCE_SOURCE__name__var | Database credentials for a named source | EVIDENCE_SOURCE__my_db__password |
EVIDENCE_VAR__name | Variables usable inside source queries | EVIDENCE_VAR__customer_name |
VITE_name | Variables accessible in .md pages via import.meta.env | VITE_tier=premium |
Using `EVIDENCE_VAR__` in a source query:
select * from orders
where customer_name = '${customer_name}'Using `VITE_` in a page:
<script>
const tier = import.meta.env.VITE_tier;
</script>
{#if tier === 'premium'}
Premium content
{/if}Evidence reads a .env file at the project root for local development.
Configure dev credentials via the settings page at localhost:3000/settings.
Configure prod credentials as environment variables on your deployment platform.
Common data environment patterns:
schema credential parameter)#### Static Site Generation (default)
#### Single Page App (SPA)
Enabling SPA mode:
package.json scripts:"build": "VITE_EVIDENCE_SPA=true evidence build",
"preview": "VITE_EVIDENCE_SPA=true evidence preview"npm install --save-dev @sveltejs/adapter-staticsvelte.config.js at the project root:import adapter from '@sveltejs/adapter-static';
export default {
kit: {
adapter: adapter({
fallback: 'index.html'
})
},
};index.html. NGINX example:root /path/to/your/project/build/;
location / {
try_files $uri $uri/ $uri.html /index.html;
}Serve Evidence from a subdirectory, e.g. https://acme.com/analytics.
`evidence.config.yaml`:
deployment:
basePath: /my-base-pathRules:
//All markdown links are automatically adjusted to include the base path.
Adjust the build output directory (required for npm run preview to work correctly):
"build": "EVIDENCE_BUILD_DIR=./build/my-base-path evidence build"Custom Svelte components do not have links auto-adjusted. Use addBasePath:
<script>
export let link;
import { addBasePath } from '@evidence-dev/sdk/utils/svelte';
</script>
<a href={addBasePath(link)}>My Link</a>Install Evidence inside a dbt project:
cd path/to/your/dbt/project
npx degit evidence-dev/template reports
npm --prefix ./reports install
npm --prefix ./reports run sources
npm --prefix ./reports run devThis co-locates modelling changes (/models) and reporting changes (/reports) in the same commits.
Caution — npm run dev and npm run sources write to shared cache/output directories. Do not run alongside other Evidence CLI agents on the same project.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.