Accountable Autonomy for AI agents under the EU AI Act: policy-gated tool calls, hash-chained tamper-evident audit trails with external time
Accountable Autonomy for AI agents under the EU AI Act: policy-gated tool calls, hash-chained tamper-evident audit trails with external time anchoring, and independently verifiable attestation plus execution receipts per MCP tool call. Exposed over MCP by the vaara mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Everything the assistant can do here goes through one of these:
Article — level EU AI Act evidence**, honest about the gaps instead of papering over themGap — evident completeness** (v1.4.0): each authorization receipt can carry a signed per-boundary sequence and running count, so a dropped receipt inside aCross — model held-out recall 66.8% [64.9, 68.7] over n=2,277 with no eval-set attacker model in TRAIN; the weakest sub-cell is data_exfil against aBIPIA — pressure FPR on benign tool calls 1.2% [0.4, 3.6] across four agent backends (Claude Haiku 4.5, Llama-3.1-8B, Mistral-7B, Qwen-2.5-7B). Down fromMulti — attacker PAIR robustness: 0/25 successes per attacker across Qwen2.5-32B, Qwen2.5-72B, Llama-3.3-70B on identical seeds, Wilson upper 13.3%Distribution — free conformal coverage on the score; MWU regret bound O(sqrt(T log N))Post-quantum — an optional parallel ML-DSA-65 / FIPS 204 signature over the same preimage, so a stripped post-quantum signature is a detectable downgrade ratherRoot — agnostic evidence**: the same Article 12 record is provable with or without a hardware TEE and re-expressible as an IETF RATS EAR (AR4SI vector)Framework — Entry pointLangChain — VaaraCallbackHandler, vaara_wrap_toolCrewAI — VaaraCrewGovernancePath — ContentsPlenty of knowledge and memory servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Vaara's toolset — Article, Gap, Cross and 9 more — is a fair guide to whether it matches your workflow.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Article | level EU AI Act evidence**, honest about the gaps instead of papering over them. |
| Gap | evident completeness** (v1.4.0): each authorization receipt can carry a signed per-boundary sequence and running count, so a dropped receipt inside a declared boundary is a provable gap from the held receipts alone, with |
| Cross | model held-out recall 66.8% [64.9, 68.7] over n=2,277 with no eval-set attacker model in TRAIN; the weakest sub-cell is data_exfil against a closed-weight model at 38.9%. This is the honest worst case; the in-distributio |
| BIPIA | pressure FPR on benign tool calls 1.2% [0.4, 3.6] across four agent backends (Claude Haiku 4.5, Llama-3.1-8B, Mistral-7B, Qwen-2.5-7B). Down from 35.2% on v8. |
| Multi | attacker PAIR robustness: 0/25 successes per attacker across Qwen2.5-32B, Qwen2.5-72B, Llama-3.3-70B on identical seeds, Wilson upper 13.3%. |
| Distribution | free conformal coverage on the score; MWU regret bound O(sqrt(T log N)). |
| Post-quantum | an optional parallel ML-DSA-65 / FIPS 204 signature over the same preimage, so a stripped post-quantum signature is a detectable downgrade rather than a silent loss. |
| Root | agnostic evidence**: the same Article 12 record is provable with or without a hardware TEE and re-expressible as an IETF RATS EAR (AR4SI vector), whether rooted in a TPM 2.0 host, an AMD SEV-SNP confidential VM, or no TE |
| Framework | Entry point |
| LangChain | VaaraCallbackHandler, vaara_wrap_tool |
| CrewAI | VaaraCrewGovernance |
| Path | Contents |
{
"mcpServers": {
"vaara": {
"command": "npx",
"args": ["-y", "@vaara/client"]
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
A knowledge graph your assistant keeps between sessions — entities, relations and observations that persist.
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Your workspace, on speaking terms with AI — search, read and write Notion pages and databases.
A structured scratchpad for hard problems — stepwise reasoning with revisions, branches and visible logic.
Symbol-level code navigation, refactoring and memory for coding agents — the IDE brain your assistant has been missing.
Chat with your second brain — search, read and write vault notes through the Local REST API.