evidentia— plugin

<div align="center">

<picture> <source media="(prefers-color-scheme: dark)" srcset="docs/brand/evidentia-banner-dark.png"> <img src="docs/brand/evidentia-banner-light.png" alt="Evidentia — open-source compliance-as-code, OSCAL-native" width="820"> </picture>

<p> <strong>Open-source compliance-as-code</strong> — gap analysis, evidence collection, OSCAL emit. <br> Apache-2.0 · Python 3.12+ </p>

<p> <a href="#quickstart-60-seconds"><img src="https://img.shields.io/badge/Get%20Started-1D58A5?style=for-the-badge" alt="Get Started"></a> <a href="https://github.com/Polycentric-Labs/evidentia/wiki"><img src="https://img.shields.io/badge/Documentation-0E1B25?style=for-the-badge" alt="Documentation"></a> <a href="https://pypi.org/project/evidentia/"><img src="https://img.shields.io/badge/PyPI-15478A?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"></a> </p>

<p> <a href="https://pypi.org/project/evidentia/"><img src="https://img.shields.io/pypi/v/evidentia.svg" alt="PyPI version"></a> <a href="https://github.com/Polycentric-Labs/evidentia/actions/workflows/test.yml"><img src="https://github.com/Polycentric-Labs/evidentia/actions/workflows/test.yml/badge.svg?branch=main" alt="tests"></a> <a href="https://codecov.io/gh/Polycentric-Labs/evidentia"><img src="https://codecov.io/gh/Polycentric-Labs/evidentia/branch/main/graph/badge.svg" alt="codecov"></a> <a href="docs/parity-coverage.md"><img src="https://img.shields.io/badge/CLI%E2%86%94GUI%20parity-100%25-brightgreen.svg" alt="CLI↔GUI parity"></a> </p>

<p> <img src="https://img.shields.io/badge/python-3.12+-1D58A5.svg" alt="Python 3.12+"> <img src="https://img.shields.io/badge/license-Apache%202.0-green.svg" alt="License: Apache 2.0"> <a href="https://www.bestpractices.dev/projects/12724"><img src="https://www.bestpractices.dev/projects/12724/badge" alt="OpenSSF Best Practices"></a> <a href="https://scorecard.dev/viewer/?uri=github.com/Polycentric-Labs/evidentia"><img src="https://api.scorecard.dev/projects/github.com/Polycentric-Labs/evidentia/badge" alt="OpenSSF Scorecard"></a> </p>

<p> <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-1D58A5.svg" alt="Code of Conduct"></a> </p>

</div>

What is Evidentia?

Evidentia analyzes evidence against ingested NIST OSCAL catalogs. Its Python library, CLI and REST API emit OSCAL Assessment Results, SARIF for CI gates, OCSF Compliance + Detection Findings for SIEMs, and CycloneDX VEX for supply-chain workflows.

For compliance engineers, GRC teams and CISOs:

• Ship audit-grade evidence with cryptographic provenance (Sigstore + PEP 740 + SLSA Provenance v1).
• Map controls across 107 bundled catalogs.
• Drive AI agents (Claude Desktop, Claude Code, Copilot CLI) deterministically via MCP tools with signed output envelopes.

Install

pip install evidentia

Workspace (AI risk-statements, REST API, all collectors, MCP server):

pip install 'evidentia[ai,api,collectors,mcp]'

Container: docker pull ghcr.io/polycentric-labs/evidentia:v0.13.2 (cosign keyless OIDC + SLSA Provenance v1).

Getting Started covers air-gapped install, virtualenv setup and all extras.

Quickstart (60 Seconds)

evidentia gap analyze compares your --inventory controls with --frameworks catalogs. The wheel includes a sample inventory.

# 1. List bundled framework catalogs
evidentia catalog list

# 2. Locate the bundled sample inventory (maps to nist-800-53-rev5-moderate)
SAMPLE=$(python -c "import importlib.resources as r; print(r.files('evidentia.examples')/'sample-inventory.yaml')")

# 3. Run gap analysis against a framework
evidentia gap analyze \
  --inventory "$SAMPLE" --frameworks nist-800-53-rev5-moderate \
  --output gap-report.json

# 4. Emit OSCAL Assessment Results
evidentia gap analyze \
  --inventory "$SAMPLE" --frameworks nist-800-53-rev5-moderate \
  --output assessment-results.json --format oscal-ar

5-minute guide: Quickstart.

Live Demo

No install: a self-hosted asciinema recording of doctor → catalog list → gap analyze → oscal verify on the Meridian Financial sample, and a clickable, backend-free demo console:

▶ Watch the CLI demo · Click through the demo console

Features

• OSCAL-native end-to-end — Ingest NIST OSCAL catalogs (Catalog 1.2.1); emit OSCAL Assessment Results + Plan-of-Action-and-Milestones (POA&M) on the established FedRAMP Rev 5 package rail.
• FedRAMP CR26 machine-readable SDR emission — evidentia conmon ksi emits the CR26 Security Decision Record keySecurityIndicators block (10 families / 46 KSIs) conformant to FedRAMP's official 2026-06-24 schemas (vendored at pinned upstream SHAs, drift-watched weekly) — the first production-grade open-source emitter of the CR26 SDR format.
• Cryptographic evidence chain — Sigstore keyless signing on Assessment Results; PEP 740 attestations on every published wheel; SLSA Provenance v1 on the container; CycloneDX 1.7 SBOM on every GitHub Release.
• 107 framework catalogs + 16 crosswalks: 36 catalogs carry statement text for every non-withdrawn entry; 71 carry headings only. Coverage includes NIST 800-53 Rev 5 (full 1,196 controls + Low/Moderate/High/Privacy baselines), CSF 2.0, FedRAMP (Rev 5 baselines + CR26 Key Security Indicators + the 179 provider-facing CR26 Requirements), CMMC 2.0 L1/L2, OpenSSF OSPS Baseline (Maturity 1/2/3 + first public OSCAL serialization), ISO 27001:2022, EU AI Act, DORA, NIS2, GDPR, all 15 comprehensive US state privacy laws, FFIEC IT Examination Handbook booklets, CMS ARS 5.2 and the CJIS 6.1 requirements companion, OCC Bulletin 2026-13 / FRB SR 26-2.
• 19 credentialed evidence collectors: AWS; GitHub (OSPS conformance helpers); Postgres, MySQL, Oracle, SQLite, MS-SQL; Snowflake; Databricks; Okta; Google Workspace; Entra ID / Microsoft 365; storage retention (S3, Azure Blob, GCS); enterprise retention (Google Vault, Splunk Enterprise, Elasticsearch ILM); incident clocks (ServiceNow, Jira Cloud, PagerDuty); Vanta, Drata, BitSight and SecurityScorecard. Findings align with OCSF. Entra/M365 and retention preserve source coverage. Public registries: 11 selectors with outcome, traversal and freshness; compliance unknown, SSL Labs live access disabled. Incident clocks preserve native events and exact elapsed seconds under profile grants; legal notification deadlines remain undetermined.
• SCAP imports: CLI, API and console preserve XCCDF/OVAL native results, source hashes, completion provenance and explicit artifact eligibility.
• Release cadence: Public GitHub releases and offline spacing. Explicit saving; no proof of installed patches.
• OCSF-aligned findings — OCSF Compliance Finding (class_uid 2003) via --format ocsf; OCSF Detection Finding (class_uid 2004) via --format ocsf-detection. SARIF 2.1.0 for CI gates via --format sarif. CycloneDX VEX defaults to 1.6; select 1.7 explicitly with --format cyclonedx-vex --vex-spec-version 1.7.
• 15 MCP tools: Use Evidentia from Claude Desktop, Claude Code or any MCP host. Append-only tool contract per docs/api-stability.md (NORMATIVE). Signed output envelopes (CIMD) per docs/evidence-integrity.md.
• OSPS Baseline conformance — First public open-source project to ship a machine-readable per-control OSPS Baseline conformance attestation (OSPS-CONFORMANCE.md) with a CI gate that re-validates every evidence link on push/PR/cron.

What's in the Box

Documentation

• Wiki — Getting Started, Guides, Concepts, Reference, Compliance, Project meta (auto-synced from docs/wiki/ on every push to main)
• docs/api-stability.md — append-only contract; what's frozen vs evolving
• docs/architecture/ — system design + extension points
• OSPS-CONFORMANCE.md — OpenSSF OSPS Baseline self-attestation + CI gate
• docs/verification.md — consumer-side recipes for PEP 740 + cosign + osv-scanner + SLSA Provenance v1
• EOL.md — version support windows + cessation comms policy
• docs/engineering-practices.md — Evidentia build, test and shipping practices: safeguards and the failures that shaped them

Recent Releases

v0.13.2 (2026-10-21) — Second day-N rebuild: the certifi Critical and fresh bases. OSCAL verify API error categories come from a closed vocabulary (CodeQL #203). The v0.13.1 scrub returned a slice of the verifier message, which the taint analysis still treated as verifier text; the API now returns one literal from a fixed set of categories and Verification error for anything else.

v0.13.1 (2026-10-19) — Container rebuild on a fresh hardened base. OSCAL verify API returns error categories only (CodeQL #203, CWE-209). POST /api/oscal/verify strips verifier detail (exception text, server paths) from each errors entry and returns the category, for example DSSE verification failed; the CLI keeps the full message.

v0.13.0 (2026-10-19) — Evidence provenance and native imports. Upstream release publication cadence (V13-28). collect release-cadence, its API and the Collect screen observe the fixed public GitHub Releases profile.

Full release history: CHANGELOG.md | GitHub Releases

Community & Governance

• GOVERNANCE.md — project governance + decision-making
• CONTRIBUTING.md — how to contribute (issues, PRs, catalogs)
• SECURITY.md — vulnerability reporting policy (private via GHSA)
• Code of Conduct
• FAQ (wiki) — frequent operator questions

AI Assistance

This project was developed alongside AI platforms.

Custom infrastructure and integrations built in-house.

Tools and details: docs/ai-assistance.md.

License

Apache-2.0 — embeddable in commercial products without copyleft.