← Documentation

EVIDIQ Lineage

Supply-chain provenance & AI dependency risk for autonomous agents. Give an agent an npm or PyPI manifest and receive a 14-rule risk analysis, live OSV vulnerability advisories, license audits, standard SBOMs/AI-BOMs, and a canonical EIP-191 signed report.

Quickstart

Connect the Streamable HTTP MCP endpoint, inspect capabilities, and validate your manifest before making a paid call.

claude mcp add --transport http evidiq-lineage https://mcp.evidiq.dev/lineage/mcp

Or probe the live pricing discovery endpoint:

curl -s https://mcp.evidiq.dev/lineage/x402

Prefer a Skill file? Fetch the agent-readable EVIDIQ Lineage Skill:

curl -s https://mcp.evidiq.dev/lineage/skill.md

What Lineage is for

Supported Ecosystems & Manifests

Lineage supports native parsing for both inline data strings and remote file URLs across npm and PyPI ecosystems.

{
  "ecosystem": "npm",
  "filename": "package.json",
  "content": "{\"dependencies\": {\"express\": \"^4.18.2\"}}"
}

{
  "ecosystem": "pypi",
  "filename": "requirements.txt",
  "content": "requests==2.31.0\nflask>=3.0.0"
}

Ten MCP tools

Five free tools support preflight and verification. Five paid tools have different immutable prices based on workload.

Paid analysis & BOM tools

• verify_package_claim — Query npm/PyPI registry to verify package existence, version, and publisher metadata. (0.005 USDT0)
• audit_licenses — Audit manifest dependencies for Copyleft (GPL/AGPL), incompatible, or missing licenses. (0.01 USDT0)
• generate_sbom — Generate standard CycloneDX 1.6 or SPDX 3.0 Software Bill of Materials. (0.015 USDT0)
• scan_dependencies — Execute full 14-rule supply-chain risk engine + live OSV vulnerability checks. (0.02 USDT0)
• generate_aibom — Generate CycloneDX-AI-1.6 AI-BOM for models, datasets, and TEE runtimes. (0.03 USDT0)

Free preflight and verification

• lineage_capabilities — Inspect supported ecosystems, dataset versions, 14 rules catalog, and pricing. (free)
• validate_manifest — Validate manifest or lockfile syntax without network calls or payment. (free)
• estimate_cost — Quote the immutable cost of any paid tool. (free)
• verify_lineage_report — Recompute report integrity and verify trusted EIP-191 authenticity against an expected or configured signer. (free)
• get_artifact — Retrieve a content-addressed JSON artifact by exact ID. (free)

14 Deterministic Security Risk Rules

Recommended workflow

1. Call lineage_capabilities for current rules catalog and versions.
2. Call validate_manifest to check manifest syntax without making network calls or paying.
3. Call estimate_cost for the intended operation.
4. Submit one paid call per request. Lineage enforces strict x402 payment authorization.
5. Preserve the report and artifact IDs to verify reports received from another party.

Reports and artifacts

Every paid result carries a complete report body: request parameters, component digests, engine version, result, SHA-256 integrity digest, and an EIP-191 signature.

{
  "reportId": "lin-7f9a2b1c8d3e4f0a",
  "result": {
    "verdict": "PASS",
    "score": 100,
    "totalComponents": 14,
    "findings": []
  },
  "integrity": {
    "algorithm": "sha256",
    "canonicalization": "evidiq-jcs-v1",
    "digest": "0x8f3c7e...",
    "signature": "0x1b2c3d...",
    "signer": "0x2a8efe3093278bb4bd3b2d9c7b5ba992ca4fc9b0"
  }
}

x402 pricing

Payments use x402 v2 exact scheme with USDT0 (6 decimals) on X Layer (eip155:196). The public discovery endpoint lists all ten tools.

Verification and settlement run through the official OKX Onchain OS Payment SDK (@okxweb3/x402-core and @okxweb3/x402-evm). The OKX facilitator verifies each authorization and settles it on X Layer before any scan begins.

Licensing

EVIDIQ owns and licenses its original Lineage code under MIT. Third-party dependencies maintain their own open-source licenses preserved in THIRD_PARTY_NOTICES.md.

← Back to docs